Audit 348596

Reference Number: 2024-003 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Agriculture Federal Program: Dairy Business Innovation Initiatives Assistance Listing Number: 10.176 Award Number and Year: AM200100XXXXG081 (9/30/2020 – 9/30/2024), 21DBIVT1004 (10/31/2021 – 10/30/2024), AM22DBIVT1015 (9/30/2022 – 9/29/2025), AM21DBIVT1011 (9/30/2022 – 9/29/2026), 23DBIVT1018 (9/30/2023 – 9/29/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Agency of Agriculture (Agency) were not reported to FSRS in accordance with FFATA requirements. Context: Nine subaward transactions were selected for testing, including eight original subawards and one subaward amendment. Of the nine subawards selected, only one was reported timely in accordance with FFATA requirements. Specifically, we noted the following exceptions: • 1 of 8 original subawards was not reported to FSRS. The subaward was in the amount of $250,000. • 1 of 1 subaward amendment was not reported to FSRS. The subaward was a negative adjustment of $225,445. • 6 of 8 original subawards were not reported to FSRS timely. All subawards were reported on 4/24/2024 but they were issued from 1/27/2021 to 3/21/2024 and were reported from 24 days to 3 years and 2 months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency did not have procedures and controls in place to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency develop procedures and internal controls to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements and that all previously issued subawards are reported. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Eligibility case reviews performed by the Agency of Human Services (Agency) were untimely and lacked proper documentation. Context: The Agency has implemented an Automated Data Processing (ADP) system referred to as the ACCESS system that is utilized in the eligibility determination process of many programs, including SNAP. ACCESS is used to process and store all case file information for eligibility determination and benefit calculations, it automatically terminates household eligibility at the end of their certification period unless recertified and provides data necessary to meet Federal issuance and reconciliation reporting requirements. Forty participants were selected for testing and the following exceptions were noted: • For 1 of 40 participants selected for testing, the participant was initially determined to be eligible in ACCESS, but when a quality review was performed four months later, the participant was determined to be ineligible. The ineligible participant received benefits for two months before their benefits were terminated. • 5 of 40 participants selected for testing were not reviewed timely. A minimum of four case reviews must be performed by each district in the month in which the applicant is determined eligible in ACCESS. The five exceptions were reviewed in a subsequent month after the applicant was determined eligible. • For 16 of 40 participants selected for testing, supervisory review and verification of the applicants’ eligibility was not dated by the supervisor. Cause: The Agency’s procedures were not sufficient to ensure that eligibility case reviews were performed timely and were properly documented. Internal controls did not detect or prevent the errors. Effect The failure to perform eligibility case reviews timely resulted in an ineligible applicant receiving benefits for two months before it was detected. Questioned costs: $2,296 Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility case reviews are performed timely and are properly documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Card Security Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: The state is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation for the daily/weekly card reconciliations was incomplete. Context: The Agency of Human Services (Agency) prepares the Weekly Card Activity Reconciliation report to document the daily/weekly EBT cards produced, issued or destroyed. This report verifies that the number of cards produced agrees to the number of cards issued and destroyed during the day/week. For 1 of 40 reconciliation reports selected for testing, the count of cards destroyed was not maintained. Cause: The Agency’s internal controls were not sufficient to ensure that the reconciliation of destroyed cards was maintained. Effect Failure to maintain documentation for destroyed cards could result in unauthorized use of EBT cards that are designated for destruction. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance internal controls to ensure that it maintains documentation of the daily/weekly reconciliation of destroyed EBT cards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of five contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Eligibility case reviews performed by the Agency of Human Services (Agency) were untimely and lacked proper documentation. Context: The Agency has implemented an Automated Data Processing (ADP) system referred to as the ACCESS system that is utilized in the eligibility determination process of many programs, including SNAP. ACCESS is used to process and store all case file information for eligibility determination and benefit calculations, it automatically terminates household eligibility at the end of their certification period unless recertified and provides data necessary to meet Federal issuance and reconciliation reporting requirements. Forty participants were selected for testing and the following exceptions were noted: • For 1 of 40 participants selected for testing, the participant was initially determined to be eligible in ACCESS, but when a quality review was performed four months later, the participant was determined to be ineligible. The ineligible participant received benefits for two months before their benefits were terminated. • 5 of 40 participants selected for testing were not reviewed timely. A minimum of four case reviews must be performed by each district in the month in which the applicant is determined eligible in ACCESS. The five exceptions were reviewed in a subsequent month after the applicant was determined eligible. • For 16 of 40 participants selected for testing, supervisory review and verification of the applicants’ eligibility was not dated by the supervisor. Cause: The Agency’s procedures were not sufficient to ensure that eligibility case reviews were performed timely and were properly documented. Internal controls did not detect or prevent the errors. Effect The failure to perform eligibility case reviews timely resulted in an ineligible applicant receiving benefits for two months before it was detected. Questioned costs: $2,296 Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility case reviews are performed timely and are properly documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Card Security Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: The state is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation for the daily/weekly card reconciliations was incomplete. Context: The Agency of Human Services (Agency) prepares the Weekly Card Activity Reconciliation report to document the daily/weekly EBT cards produced, issued or destroyed. This report verifies that the number of cards produced agrees to the number of cards issued and destroyed during the day/week. For 1 of 40 reconciliation reports selected for testing, the count of cards destroyed was not maintained. Cause: The Agency’s internal controls were not sufficient to ensure that the reconciliation of destroyed cards was maintained. Effect Failure to maintain documentation for destroyed cards could result in unauthorized use of EBT cards that are designated for destruction. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance internal controls to ensure that it maintains documentation of the daily/weekly reconciliation of destroyed EBT cards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of five contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Eligibility case reviews performed by the Agency of Human Services (Agency) were untimely and lacked proper documentation. Context: The Agency has implemented an Automated Data Processing (ADP) system referred to as the ACCESS system that is utilized in the eligibility determination process of many programs, including SNAP. ACCESS is used to process and store all case file information for eligibility determination and benefit calculations, it automatically terminates household eligibility at the end of their certification period unless recertified and provides data necessary to meet Federal issuance and reconciliation reporting requirements. Forty participants were selected for testing and the following exceptions were noted: • For 1 of 40 participants selected for testing, the participant was initially determined to be eligible in ACCESS, but when a quality review was performed four months later, the participant was determined to be ineligible. The ineligible participant received benefits for two months before their benefits were terminated. • 5 of 40 participants selected for testing were not reviewed timely. A minimum of four case reviews must be performed by each district in the month in which the applicant is determined eligible in ACCESS. The five exceptions were reviewed in a subsequent month after the applicant was determined eligible. • For 16 of 40 participants selected for testing, supervisory review and verification of the applicants’ eligibility was not dated by the supervisor. Cause: The Agency’s procedures were not sufficient to ensure that eligibility case reviews were performed timely and were properly documented. Internal controls did not detect or prevent the errors. Effect The failure to perform eligibility case reviews timely resulted in an ineligible applicant receiving benefits for two months before it was detected. Questioned costs: $2,296 Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility case reviews are performed timely and are properly documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Card Security Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: The state is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation for the daily/weekly card reconciliations was incomplete. Context: The Agency of Human Services (Agency) prepares the Weekly Card Activity Reconciliation report to document the daily/weekly EBT cards produced, issued or destroyed. This report verifies that the number of cards produced agrees to the number of cards issued and destroyed during the day/week. For 1 of 40 reconciliation reports selected for testing, the count of cards destroyed was not maintained. Cause: The Agency’s internal controls were not sufficient to ensure that the reconciliation of destroyed cards was maintained. Effect Failure to maintain documentation for destroyed cards could result in unauthorized use of EBT cards that are designated for destruction. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance internal controls to ensure that it maintains documentation of the daily/weekly reconciliation of destroyed EBT cards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of five contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Eligibility case reviews performed by the Agency of Human Services (Agency) were untimely and lacked proper documentation. Context: The Agency has implemented an Automated Data Processing (ADP) system referred to as the ACCESS system that is utilized in the eligibility determination process of many programs, including SNAP. ACCESS is used to process and store all case file information for eligibility determination and benefit calculations, it automatically terminates household eligibility at the end of their certification period unless recertified and provides data necessary to meet Federal issuance and reconciliation reporting requirements. Forty participants were selected for testing and the following exceptions were noted: • For 1 of 40 participants selected for testing, the participant was initially determined to be eligible in ACCESS, but when a quality review was performed four months later, the participant was determined to be ineligible. The ineligible participant received benefits for two months before their benefits were terminated. • 5 of 40 participants selected for testing were not reviewed timely. A minimum of four case reviews must be performed by each district in the month in which the applicant is determined eligible in ACCESS. The five exceptions were reviewed in a subsequent month after the applicant was determined eligible. • For 16 of 40 participants selected for testing, supervisory review and verification of the applicants’ eligibility was not dated by the supervisor. Cause: The Agency’s procedures were not sufficient to ensure that eligibility case reviews were performed timely and were properly documented. Internal controls did not detect or prevent the errors. Effect The failure to perform eligibility case reviews timely resulted in an ineligible applicant receiving benefits for two months before it was detected. Questioned costs: $2,296 Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility case reviews are performed timely and are properly documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Card Security Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: The state is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation for the daily/weekly card reconciliations was incomplete. Context: The Agency of Human Services (Agency) prepares the Weekly Card Activity Reconciliation report to document the daily/weekly EBT cards produced, issued or destroyed. This report verifies that the number of cards produced agrees to the number of cards issued and destroyed during the day/week. For 1 of 40 reconciliation reports selected for testing, the count of cards destroyed was not maintained. Cause: The Agency’s internal controls were not sufficient to ensure that the reconciliation of destroyed cards was maintained. Effect Failure to maintain documentation for destroyed cards could result in unauthorized use of EBT cards that are designated for destruction. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance internal controls to ensure that it maintains documentation of the daily/weekly reconciliation of destroyed EBT cards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of five contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-007 Prior Year Finding: No Federal Agency: U.S. Department of Defense State Agency: Vermont State Military Department Federal Program: National Guard Military Operations and Maintenance (O&M) Projects Assistance Listing Number: 12.401 Award Number and Year: W912LN2421001 (10/1/2023 – 9/20/2024) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont State Military Department (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Context: One of five transactions selected for testing was incurred prior to the award’s period of performance. The expense was for a transaction incurred in the month of September 2023 but the award’s period of performance began on 10/1/2023. Cause: The Department’s procedures were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Internal controls did not prevent or detect the error. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: Below the reportable limit. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-008 Prior Year Finding: 2023-005 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC, UCFE, UCX, TRA UI393002355A50 (10/2022-9/30/2023), TRA 24A55UT000024 (10/1/2023-9/30/2024), RESEA UI380102260A50 (1/1/2022-9/30/2024) RESEA 23A60UR000010 (1/1/2023-9/30/2025), Admin UI393532355A50 (10/1/2022-12/31/2025), Admin 24A55UI000063 (10/1/2023-12/31/2026), ARPA Fraud UI370952155A50 (9/1/2021-8/31/2025), ARPA Equity UI370952155A50 (10/1/2022-10/31/2025), CARES UI347462055A50 (4/1/2021-6/30/2025), DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Status Report, UI Programs – This report is used to report program and administrative expenditures. All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Additional information on OMB Number 1205-0461 can be accessed at http://www.dol.gov/agencies/eta/grants/management and scroll down to the section on Financial Reporting. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UI Projects (administration and benefits). ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) – Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that it had submitted required financial, performance, and special reports had been reviewed and approved by an authorized State official prior to submission, and the Department was unable to provide supporting documentation that agreed with the data included in the submitted financial reports. Context: We reviewed a sample of the financial and performance reports filed during fiscal year 2024. The following exceptions were noted: ETA 9130: Supporting documentation was insufficient to support the data reported in 2 of 2 quarters reviewed. Support could not be provided that 2 of 2 quarters reviewed had been reviewed and approved prior to submission. ETA 191: Support could not be provided that 2 of 2 reports reviewed had been reviewed and approved prior to submission. ETA 9050: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9055: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports were accurate, agreed with supporting documentation, and were reviewed and approved prior to submission. Effect: Auditors were unable to verify the accuracy of the financial reports submitted by the Department. A lack of review and approval of financial and performance reports could allow incorrect data to be reported for the program which could misrepresent the State’s financial and programmatic performance in the program. Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all financial and performance reports are accurate, agree with supporting documentation, and are reviewed by an authorized State official prior to submission. We also recommend that supporting documentation and evidence of supervisory review is maintained and available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-009 Prior Year Finding: 2023-007 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without supporting documentation and documentation of supervisory review and approval. Context: Sixty transactions were selected for testing and the following exceptions were noted: • For six of sixty transactions selected for testing, the Department was unable to provide documentation to support the transactions totaling $510. • For six of sixty transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment. Cause: The Department’s procedures were not sufficient to ensure that payments were supported, reviewed, and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not supported and reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: $510 which represents the total unsupported expenditures. Recommendation: We recommend the Department reviews and enhances its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are supported and reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-010 Prior Year Finding: 2023-008 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: Admin 24A55UI000063 (10/1/2023-12/31/2026), DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Context: Sixty transactions were selected for testing and the following exceptions were noted: • Five of sixty transactions were charged to the award before the allowable period of performance. The grant award start date was October 1, 2023, but costs were incurred in July, August, and September 2023. Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: $2,980, which represents the total incurred before the allowable period of performance. Recommendation: We recommend the Department review and enhance its procedures and controls to ensure that prior to charging costs to the program, they are incurred within an award’s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-008 Prior Year Finding: 2023-005 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC, UCFE, UCX, TRA UI393002355A50 (10/2022-9/30/2023), TRA 24A55UT000024 (10/1/2023-9/30/2024), RESEA UI380102260A50 (1/1/2022-9/30/2024) RESEA 23A60UR000010 (1/1/2023-9/30/2025), Admin UI393532355A50 (10/1/2022-12/31/2025), Admin 24A55UI000063 (10/1/2023-12/31/2026), ARPA Fraud UI370952155A50 (9/1/2021-8/31/2025), ARPA Equity UI370952155A50 (10/1/2022-10/31/2025), CARES UI347462055A50 (4/1/2021-6/30/2025), DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Status Report, UI Programs – This report is used to report program and administrative expenditures. All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Additional information on OMB Number 1205-0461 can be accessed at http://www.dol.gov/agencies/eta/grants/management and scroll down to the section on Financial Reporting. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UI Projects (administration and benefits). ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) – Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that it had submitted required financial, performance, and special reports had been reviewed and approved by an authorized State official prior to submission, and the Department was unable to provide supporting documentation that agreed with the data included in the submitted financial reports. Context: We reviewed a sample of the financial and performance reports filed during fiscal year 2024. The following exceptions were noted: ETA 9130: Supporting documentation was insufficient to support the data reported in 2 of 2 quarters reviewed. Support could not be provided that 2 of 2 quarters reviewed had been reviewed and approved prior to submission. ETA 191: Support could not be provided that 2 of 2 reports reviewed had been reviewed and approved prior to submission. ETA 9050: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9055: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports were accurate, agreed with supporting documentation, and were reviewed and approved prior to submission. Effect: Auditors were unable to verify the accuracy of the financial reports submitted by the Department. A lack of review and approval of financial and performance reports could allow incorrect data to be reported for the program which could misrepresent the State’s financial and programmatic performance in the program. Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all financial and performance reports are accurate, agree with supporting documentation, and are reviewed by an authorized State official prior to submission. We also recommend that supporting documentation and evidence of supervisory review is maintained and available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-009 Prior Year Finding: 2023-007 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without supporting documentation and documentation of supervisory review and approval. Context: Sixty transactions were selected for testing and the following exceptions were noted: • For six of sixty transactions selected for testing, the Department was unable to provide documentation to support the transactions totaling $510. • For six of sixty transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment. Cause: The Department’s procedures were not sufficient to ensure that payments were supported, reviewed, and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not supported and reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: $510 which represents the total unsupported expenditures. Recommendation: We recommend the Department reviews and enhances its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are supported and reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-010 Prior Year Finding: 2023-008 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: Admin 24A55UI000063 (10/1/2023-12/31/2026), DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Context: Sixty transactions were selected for testing and the following exceptions were noted: • Five of sixty transactions were charged to the award before the allowable period of performance. The grant award start date was October 1, 2023, but costs were incurred in July, August, and September 2023. Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: $2,980, which represents the total incurred before the allowable period of performance. Recommendation: We recommend the Department review and enhance its procedures and controls to ensure that prior to charging costs to the program, they are incurred within an award’s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Highway Planning and Construction Assistance Listing Number: 20.205 Award Number and Year: FFY2023 – FFY2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) omitted required federal award information from subawards it issued in the program and did not adequately monitor subrecipients. Context: Nineteen subawards were selected for testing and the following exceptions were noted: • For 16 of 19 subawards selected for testing, the federal award date was not included on the subaward agreement. • For 1 of 19 subawards selected for testing, the last on-site subrecipient monitoring visit was performed in FY 2019 and the next on-site monitoring did not take place until FY 2024. Per the VTrans subrecipient monitoring plan, on-site monitoring must be performed no less than every three years. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required federal information. Although VTrans subsequently modified its subaward issuance process, controls in effect during the audit period were not sufficient to ensure that subawards included all required information. Procedures and internal controls were also not sufficient to ensure that timely on-site monitoring visits were performed in accordance with its monitoring plan. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Failure to conduct adequate subrecipient monitoring may result in a failure of VTrans to detect that subawards are used for unauthorized purposes, are managed in violation of the terms and conditions of the subawards, or that subaward performance goals are not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by VTrans personnel on a timely basis. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-012 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Highway Planning and Construction Assistance Listing Number: 20.205 Award Number and Year: FFY2023 – FFY2024 Compliance Requirement: Special Tests and Provisions – Wage Rate Requirements Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – All laborers and mechanics employed by contractors or subcontractors to work on construction contracts in excess of $2,000 financed by federal assistance funds must be paid wages not less than those established for the locality of the project (prevailing wage rates) by the Department of Labor (DOL) (40 USC 3141–3144, 3146, and 3147.) Per 29 CFR Part 5 – Labor Standards Provisions Applicable to Contacts Governing Federally Financed and Assisted Construction, nonfederal entities shall include in their construction contracts subject to the Wage Rate Requirements a provision that the contractor or subcontractor comply with those requirements and the DOL regulations. This includes a requirement for the contractor or subcontractor to submit to the nonfederal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls). Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) did not receive weekly certified payrolls from all contractors. Context: Ten contracts were selected for testing, which included forty weekly certified payrolls tested. One of forty weekly certified payrolls was not received by VTrans. Cause: Procedures were not sufficient to ensure that VTrans obtained all required weekly certified payrolls. Internal controls did not detect or prevent the error. Effect: Failure to obtain weekly payrolls could prevent VTrans from detecting if a contractor pays less than the prevailing wage. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance procedures and internal controls to ensure that it obtains weekly certified payrolls from all contractors. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-013 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Federal Transit Cluster Assistance Listing Number: 20.500, 20.507, 20.526 Award Number and Year: VT-04-0021-01 (3/14/2013 – 6/30/2016) Compliance Requirement: Cash Management, Period of Performance Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.343(b) requires nonfederal entities to liquidate all obligations incurred under the federal award no later than 90 calendar days after the end date of the period of performance as specified in the terms and conditions of the federal award unless the federal awarding agency or pass-through entity authorizes an extension. Per the U.S. Department of Transportation, Federal Transit Administration (FTA), circular FTA C 5010.1E Chapter 3, the recipient is responsible to initiate closeout of the Award, within 90 days after the end of the period of performance, or after all approved activities are completed and/or the applicable federal assistance has been expended for all eligible costs. Any deviation from the approved Award must be documented in the closeout amendment. US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Per 31 CFR Part 205 Subpart B, a State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Transportation (VTrans) drew down federal funds against an award for which the period of performance had expired. An award period extension was not authorized by FTA, nor had the award been closed out timely. Context: VTrans drew down $12,671 from a grant award for which the period of performance ended on June 30, 2016. An extension for the award was not authorized by FTA, nor did FTA authorize VTrans to reopen or modify the grant award. VTrans did not initiate closure of the award until after completion of the drawdown. Cause: The procedures used by VTrans were not sufficient to ensure that it closed out a grant award timely, nor were they sufficient to prevent the drawdown of funds against an expired grant award. Internal controls did not prevent or detect the errors. Effect: VTrans drew down funds against a grant award after the end of its period of performance. Questioned costs: $12,671, the amount of funds drawn down against the expired grant award. Recommendation: We recommend that VTrans review and enhance grant closeout procedures and internal controls to ensure that grants are closed out timely. We further recommend that VTrans review and enhance procedures and internal controls over cash management to ensure that cash draws are performed only against grants for which the period of performance has not expired. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-013 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Federal Transit Cluster Assistance Listing Number: 20.500, 20.507, 20.526 Award Number and Year: VT-04-0021-01 (3/14/2013 – 6/30/2016) Compliance Requirement: Cash Management, Period of Performance Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.343(b) requires nonfederal entities to liquidate all obligations incurred under the federal award no later than 90 calendar days after the end date of the period of performance as specified in the terms and conditions of the federal award unless the federal awarding agency or pass-through entity authorizes an extension. Per the U.S. Department of Transportation, Federal Transit Administration (FTA), circular FTA C 5010.1E Chapter 3, the recipient is responsible to initiate closeout of the Award, within 90 days after the end of the period of performance, or after all approved activities are completed and/or the applicable federal assistance has been expended for all eligible costs. Any deviation from the approved Award must be documented in the closeout amendment. US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Per 31 CFR Part 205 Subpart B, a State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Transportation (VTrans) drew down federal funds against an award for which the period of performance had expired. An award period extension was not authorized by FTA, nor had the award been closed out timely. Context: VTrans drew down $12,671 from a grant award for which the period of performance ended on June 30, 2016. An extension for the award was not authorized by FTA, nor did FTA authorize VTrans to reopen or modify the grant award. VTrans did not initiate closure of the award until after completion of the drawdown. Cause: The procedures used by VTrans were not sufficient to ensure that it closed out a grant award timely, nor were they sufficient to prevent the drawdown of funds against an expired grant award. Internal controls did not prevent or detect the errors. Effect: VTrans drew down funds against a grant award after the end of its period of performance. Questioned costs: $12,671, the amount of funds drawn down against the expired grant award. Recommendation: We recommend that VTrans review and enhance grant closeout procedures and internal controls to ensure that grants are closed out timely. We further recommend that VTrans review and enhance procedures and internal controls over cash management to ensure that cash draws are performed only against grants for which the period of performance has not expired. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-013 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Federal Transit Cluster Assistance Listing Number: 20.500, 20.507, 20.526 Award Number and Year: VT-04-0021-01 (3/14/2013 – 6/30/2016) Compliance Requirement: Cash Management, Period of Performance Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.343(b) requires nonfederal entities to liquidate all obligations incurred under the federal award no later than 90 calendar days after the end date of the period of performance as specified in the terms and conditions of the federal award unless the federal awarding agency or pass-through entity authorizes an extension. Per the U.S. Department of Transportation, Federal Transit Administration (FTA), circular FTA C 5010.1E Chapter 3, the recipient is responsible to initiate closeout of the Award, within 90 days after the end of the period of performance, or after all approved activities are completed and/or the applicable federal assistance has been expended for all eligible costs. Any deviation from the approved Award must be documented in the closeout amendment. US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Per 31 CFR Part 205 Subpart B, a State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Transportation (VTrans) drew down federal funds against an award for which the period of performance had expired. An award period extension was not authorized by FTA, nor had the award been closed out timely. Context: VTrans drew down $12,671 from a grant award for which the period of performance ended on June 30, 2016. An extension for the award was not authorized by FTA, nor did FTA authorize VTrans to reopen or modify the grant award. VTrans did not initiate closure of the award until after completion of the drawdown. Cause: The procedures used by VTrans were not sufficient to ensure that it closed out a grant award timely, nor were they sufficient to prevent the drawdown of funds against an expired grant award. Internal controls did not prevent or detect the errors. Effect: VTrans drew down funds against a grant award after the end of its period of performance. Questioned costs: $12,671, the amount of funds drawn down against the expired grant award. Recommendation: We recommend that VTrans review and enhance grant closeout procedures and internal controls to ensure that grants are closed out timely. We further recommend that VTrans review and enhance procedures and internal controls over cash management to ensure that cash draws are performed only against grants for which the period of performance has not expired. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-014 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP4407 (3/3/2021 – 12/31/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Administration (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of seven contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. The contract was procured in June 2020 in an initial amount of $5,000,000. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-015 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Student Support and Academic Enrichment Grants Assistance Listing Number: 84.424 Award Number and Year: S424A220047 (7/1/2022 – 9/30/2024) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Grantees draw funds via the G5 System. Grantees request funds by (1) creating a payment request using the G5 System through the Internet; (2) calling the Payee Hotline; or (3) if the grantee is placed on the reimbursement or cash monitoring payment method, submitting a Form 270, Request for Title IV Reimbursement or Heightened Cash Monitoring 2 (HCM2), (OMB No. 1845-0089), to an ED program or regional office. When creating a payment request in G5, the grantee enters the drawdown amounts, by award, directly into G5. Grantees can redistribute drawn amounts between grant awards by making adjustments in G5 to reflect actual disbursements for each award, as long as the net amount of the adjustments is zero. When requesting funds using the other two methods, grantees provide drawdown information to the hotline operator or on the Form 270, as applicable. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was unable to provide evidence of proper segregation of duties including a lack of review and approval of drawdown requests. Context: The Agency’s procedures and controls require that the Deputy Chief Fiscal Officer (CFO) prepares drawdowns and the Financial Director reviews and submits them in the G5 System. For 2 of 12 drawdown requests selected for testing, the Deputy CFO both compiled the drawdown information and reviewed and approved them in G5. Cause: The Agency did not follow its drawdown procedures and was unable to provide evidence of review and approval of drawdown requests. Internal controls did not detect or prevent the errors. Effect: There is an increased risk of undetected drawdown errors. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance its internal controls to ensure that drawdowns are reviewed and approved in accordance with the Agency’s policies and procedures. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-018 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) COVID-19 - American Rescue Plan – Elementary and Secondary School Emergency Relief –Homeless Children and Youth Assistance Listing Number: 84.425C, 84.425D, 84.425R, 84.425U, 84.425W Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425R210033 (2/23/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) S425W210047 (4/23/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards were not reported timely and accurately to FSRS. Context: Fifty-eight subawards were selected for testing which included twenty-three original subawards and thirty-four subaward amendments. Sixteen of fifty-eight transactions tested (28%) were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 3 of 58 subawards were not reported accurately to FSRS. • 13 of 58 subawards were not reported timely to FSRS. The subawards were reported from 3 months to more than two years late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency has not fully implemented its corrective action plan from the prior audit. Its procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its corrective action plan from the prior audit. It should review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-018 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) COVID-19 - American Rescue Plan – Elementary and Secondary School Emergency Relief –Homeless Children and Youth Assistance Listing Number: 84.425C, 84.425D, 84.425R, 84.425U, 84.425W Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425R210033 (2/23/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) S425W210047 (4/23/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards were not reported timely and accurately to FSRS. Context: Fifty-eight subawards were selected for testing which included twenty-three original subawards and thirty-four subaward amendments. Sixteen of fifty-eight transactions tested (28%) were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 3 of 58 subawards were not reported accurately to FSRS. • 13 of 58 subawards were not reported timely to FSRS. The subawards were reported from 3 months to more than two years late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency has not fully implemented its corrective action plan from the prior audit. Its procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its corrective action plan from the prior audit. It should review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-018 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) COVID-19 - American Rescue Plan – Elementary and Secondary School Emergency Relief –Homeless Children and Youth Assistance Listing Number: 84.425C, 84.425D, 84.425R, 84.425U, 84.425W Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425R210033 (2/23/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) S425W210047 (4/23/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards were not reported timely and accurately to FSRS. Context: Fifty-eight subawards were selected for testing which included twenty-three original subawards and thirty-four subaward amendments. Sixteen of fifty-eight transactions tested (28%) were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 3 of 58 subawards were not reported accurately to FSRS. • 13 of 58 subawards were not reported timely to FSRS. The subawards were reported from 3 months to more than two years late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency has not fully implemented its corrective action plan from the prior audit. Its procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its corrective action plan from the prior audit. It should review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-018 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) COVID-19 - American Rescue Plan – Elementary and Secondary School Emergency Relief –Homeless Children and Youth Assistance Listing Number: 84.425C, 84.425D, 84.425R, 84.425U, 84.425W Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425R210033 (2/23/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) S425W210047 (4/23/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards were not reported timely and accurately to FSRS. Context: Fifty-eight subawards were selected for testing which included twenty-three original subawards and thirty-four subaward amendments. Sixteen of fifty-eight transactions tested (28%) were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 3 of 58 subawards were not reported accurately to FSRS. • 13 of 58 subawards were not reported timely to FSRS. The subawards were reported from 3 months to more than two years late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency has not fully implemented its corrective action plan from the prior audit. Its procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its corrective action plan from the prior audit. It should review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-017 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2026) Compliance Requirement: Reporting – Performance Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Recipients must submit quarterly and final performance/progress reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide supporting documentation that agreed with the data included in the submitted reports. Context: For two of two quarterly performance reports selected for testing, supporting documentation provided by the Agency was insufficient to support the data reported. Cause: The Agency’s procedures and controls were not sufficient to ensure that performance reports were accurate and agreed with supporting documentation. Effect: Auditors were unable to verify the accuracy of performance reports submitted by the Agency. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that performance reports are accurate, agree with supporting documentation, and that supporting documentation is maintained and available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-018 Prior Year Finding: 2023-024 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards were not reported to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Three of fourteen subawards selected for testing were not reported to FSRS in accordance with FFATA requirements. Specifically, we noted the following exceptions: • Three of fourteen subawards were not reported to FSRS until after auditors requested samples for testing. The subawards were issued between 9/16/2022 and 9/6/2023 but were not reported to FSRS until 10/18/2024. As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely and to review previously issued subawards to ensure that all subawards were reported. The subaward exceptions noted were issued prior to the full implementation of the CAP. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements and that all previously issued subawards are reported. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-019 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – ACF-199 Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Work Participation Rates – State agencies must meet or exceed their minimum annual work participation rates. The minimum work participation rates are 50 percent for the overall rate and 90 percent for the two-parent rate. A state’s minimum work participation rate may be reduced by its caseload reduction credit. The Department of Health and Human Services (HHS) may penalize the state by an amount of up to 21 percent of the State Family Assistance Grant (SFAG) for violation of this provision. Penalty for Failure to Comply with Work Verification Plan – The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the state by an amount not less than 1 percent and not more than 5 percent of the SFAG for violation of this provision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Exceptions were noted regarding the reporting of work participation rates in the ACF-199 report by the Agency of Human Services (Agency) and errors were also noted in the documentation supporting the ACF-199 reports. Context: Forty participants were selected for testing and auditors noted several instances where work participation rates reported on the ACF-199 report did not agree with supporting documentation and that supporting documentation contained errors or was incomplete. Specifically, we noted the following: • For two of forty participants selected for testing, the participants’ wages/hours reported did not match supporting documentation. The error was due to a data system programming error that automatically limits a participant’s actual hours worked to forty when their actual hours exceed forty hours. • One of forty participants selected for testing did not have proper documentation of a change in circumstance. This resulted in two months in which the participant was not documented as engaged in work but had documented hours reported in the ACF-199 report. • For one of forty participants selected for testing, their average hours of work participation were not rereviewed within the six-month window required under the state plan. • For one of forty participants selected for testing, the amount reported did not agree with supporting documentation. The discrepancy was due to rounding errors. • For one of forty participants selected for testing, the employment verification form was not signed by a supervisor. Cause: The Agency’s procedures were not sufficient to ensure that work participation rates reported in the ACF-199 report were accurate, tied to supporting documentation, and that supporting documentation was accurate. Internal controls did not detect or prevent the errors. Effect Work Participation rates reported on the ACF-199 contained errors and did not tie to supporting documentation. HHS may penalize the Agency for its failure to ensure the accuracy of the data used when calculating work participation rates. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it maintains adequate documentation, verification, and internal control procedures to ensure the accuracy of work participation rates reported in the ACF-199 reports. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-019 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – ACF-199 Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Work Participation Rates – State agencies must meet or exceed their minimum annual work participation rates. The minimum work participation rates are 50 percent for the overall rate and 90 percent for the two-parent rate. A state’s minimum work participation rate may be reduced by its caseload reduction credit. The Department of Health and Human Services (HHS) may penalize the state by an amount of up to 21 percent of the State Family Assistance Grant (SFAG) for violation of this provision. Penalty for Failure to Comply with Work Verification Plan – The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the state by an amount not less than 1 percent and not more than 5 percent of the SFAG for violation of this provision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Exceptions were noted regarding the reporting of work participation rates in the ACF-199 report by the Agency of Human Services (Agency) and errors were also noted in the documentation supporting the ACF-199 reports. Context: Forty participants were selected for testing and auditors noted several instances where work participation rates reported on the ACF-199 report did not agree with supporting documentation and that supporting documentation contained errors or was incomplete. Specifically, we noted the following: • For two of forty participants selected for testing, the participants’ wages/hours reported did not match supporting documentation. The error was due to a data system programming error that automatically limits a participant’s actual hours worked to forty when their actual hours exceed forty hours. • One of forty participants selected for testing did not have proper documentation of a change in circumstance. This resulted in two months in which the participant was not documented as engaged in work but had documented hours reported in the ACF-199 report. • For one of forty participants selected for testing, their average hours of work participation were not rereviewed within the six-month window required under the state plan. • For one of forty participants selected for testing, the amount reported did not agree with supporting documentation. The discrepancy was due to rounding errors. • For one of forty participants selected for testing, the employment verification form was not signed by a supervisor. Cause: The Agency’s procedures were not sufficient to ensure that work participation rates reported in the ACF-199 report were accurate, tied to supporting documentation, and that supporting documentation was accurate. Internal controls did not detect or prevent the errors. Effect Work Participation rates reported on the ACF-199 contained errors and did not tie to supporting documentation. HHS may penalize the Agency for its failure to ensure the accuracy of the data used when calculating work participation rates. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it maintains adequate documentation, verification, and internal control procedures to ensure the accuracy of work participation rates reported in the ACF-199 reports. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address eleven specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Per 45 CFR 98.44(b), a Lead Agency must describe in the State Plan its established requirements for pre-service or orientation (to be completed within three months) and ongoing professional development for caregivers, teachers, and directors of child care providers of services for which assistance is provided under the CCDF that, to the extent practicable, align with the State framework. Accessible pre-service or orientation training in health and safety standards appropriate to the setting and age of children served addresses: (i) Each of the requirements relating to matters described in §98.41(a)(1)(i) through (xi) and specifying critical health and safety training that must be completed before caregivers, teachers, and directors are allowed to care for children unsupervised; (ii) At the Lead Agency option, matters described in § 98.41(a)(1)(xii); and (iii) Child development, including the major domains (cognitive, social, emotional, physical development and approaches to learning); Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not ensure that all providers completed required annual training nor that training in health and safety standards addresses the required eleven elements per 45 CFR sections 98.41 and 98.44(b)(1). Context: Forty child care providers were selected for testing and the following exceptions were noted: • For 4 of 40 child care providers selected for testing, the Agency was unable to provide documentation that it ensured the providers completed the required 15 hours of annual training or that a supervisor had documented approval of the training hours. • For 40 of 40 child care providers selected for testing, the Agency’s provider training did not include all 11 of the required health and safety topics. During a monitoring site visit conducted in November 2023 by the HHS Administration for Children & Families, Office of Child Care (OCC), the monitoring team did not find evidence that the Agency’s provider training content included all 11 health and safety topics. Therefore, OCC’s monitoring report identified noncompliance with this training requirement. Cause: The Agency’s procedures were not sufficient to ensure that its monitoring documentation of child care provider training was complete. When developing provider health and safety training content, the Agency did not ensure that it included all 11 health and safety topics required by 45 CFR section 98.44(b)(1). Internal controls did not detect or prevent these errors. Effect Deficiencies in the content and monitoring of provider health and safety training could result in inadequately trained child care providers which may create a risk to the health and safety of children receiving subsidies under the program. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance training monitoring procedures and controls to ensure that all child care providers complete required health and safety training. We further recommend that the Agency update its training content to ensure that it includes all required elements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Lead Agencies must have procedures in place for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each Lead Agency in its approved plan. A Lead Agency is the designated state, territorial, or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Procedures for documenting and verifying eligibility may be performed directly by the lead agency or other agencies engaged in the administration of CCDF. Per 45 CFR Section 98.20(c) - A Child's Eligibility for Child Care Services, for purposes of implementing the citizenship eligibility verification requirements mandated by title IV of the Personal Responsibility and Work Opportunity Reconciliation Act, 8 U.S.C. 1601 et seq., only the citizenship and immigration status of the child, who is the primary beneficiary of the CCDF benefit, is relevant. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to perform verification of U.S. citizenship for participants who were otherwise eligible under the program because they were in need of or receiving protective services. Context: For three of forty participants selected for testing, U.S. citizenship was not verified. Auditors noted that the Agency pooled funding for multiple federal programs with CCDF, which made eligibility for the other funding sources subject to CCDF rules. The Administration for Children and Families (ACF) performed a monitoring visit in November 2023 which identified an exception for U.S. citizenship verification. Through the Agency’s corrective action plan resulting from ACF’s monitoring visit, citizenship was verified back to 10/1/2023 (for FFY2024), however the Agency did not verify citizenship for participants receiving benefits prior to this date. Cause: The Agency’s procedures and controls were not sufficient to ensure that U.S. citizenship was verified for participants who were otherwise eligible under the program because they were in need of or receiving protective services. When the exception was noted by ACF, the Agency verified citizenship for FFY2024, but did not verify citizenship for participants receiving benefits prior to this date. Effect Failure to verify U.S. citizenship for participants could result in ineligible participants receiving benefits under the program. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it verifies U.S. citizenship for all participants and confirm that only eligible participants receive benefits under the program. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address eleven specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Per 45 CFR 98.44(b), a Lead Agency must describe in the State Plan its established requirements for pre-service or orientation (to be completed within three months) and ongoing professional development for caregivers, teachers, and directors of child care providers of services for which assistance is provided under the CCDF that, to the extent practicable, align with the State framework. Accessible pre-service or orientation training in health and safety standards appropriate to the setting and age of children served addresses: (i) Each of the requirements relating to matters described in §98.41(a)(1)(i) through (xi) and specifying critical health and safety training that must be completed before caregivers, teachers, and directors are allowed to care for children unsupervised; (ii) At the Lead Agency option, matters described in § 98.41(a)(1)(xii); and (iii) Child development, including the major domains (cognitive, social, emotional, physical development and approaches to learning); Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not ensure that all providers completed required annual training nor that training in health and safety standards addresses the required eleven elements per 45 CFR sections 98.41 and 98.44(b)(1). Context: Forty child care providers were selected for testing and the following exceptions were noted: • For 4 of 40 child care providers selected for testing, the Agency was unable to provide documentation that it ensured the providers completed the required 15 hours of annual training or that a supervisor had documented approval of the training hours. • For 40 of 40 child care providers selected for testing, the Agency’s provider training did not include all 11 of the required health and safety topics. During a monitoring site visit conducted in November 2023 by the HHS Administration for Children & Families, Office of Child Care (OCC), the monitoring team did not find evidence that the Agency’s provider training content included all 11 health and safety topics. Therefore, OCC’s monitoring report identified noncompliance with this training requirement. Cause: The Agency’s procedures were not sufficient to ensure that its monitoring documentation of child care provider training was complete. When developing provider health and safety training content, the Agency did not ensure that it included all 11 health and safety topics required by 45 CFR section 98.44(b)(1). Internal controls did not detect or prevent these errors. Effect Deficiencies in the content and monitoring of provider health and safety training could result in inadequately trained child care providers which may create a risk to the health and safety of children receiving subsidies under the program. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance training monitoring procedures and controls to ensure that all child care providers complete required health and safety training. We further recommend that the Agency update its training content to ensure that it includes all required elements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Lead Agencies must have procedures in place for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each Lead Agency in its approved plan. A Lead Agency is the designated state, territorial, or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Procedures for documenting and verifying eligibility may be performed directly by the lead agency or other agencies engaged in the administration of CCDF. Per 45 CFR Section 98.20(c) - A Child's Eligibility for Child Care Services, for purposes of implementing the citizenship eligibility verification requirements mandated by title IV of the Personal Responsibility and Work Opportunity Reconciliation Act, 8 U.S.C. 1601 et seq., only the citizenship and immigration status of the child, who is the primary beneficiary of the CCDF benefit, is relevant. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to perform verification of U.S. citizenship for participants who were otherwise eligible under the program because they were in need of or receiving protective services. Context: For three of forty participants selected for testing, U.S. citizenship was not verified. Auditors noted that the Agency pooled funding for multiple federal programs with CCDF, which made eligibility for the other funding sources subject to CCDF rules. The Administration for Children and Families (ACF) performed a monitoring visit in November 2023 which identified an exception for U.S. citizenship verification. Through the Agency’s corrective action plan resulting from ACF’s monitoring visit, citizenship was verified back to 10/1/2023 (for FFY2024), however the Agency did not verify citizenship for participants receiving benefits prior to this date. Cause: The Agency’s procedures and controls were not sufficient to ensure that U.S. citizenship was verified for participants who were otherwise eligible under the program because they were in need of or receiving protective services. When the exception was noted by ACF, the Agency verified citizenship for FFY2024, but did not verify citizenship for participants receiving benefits prior to this date. Effect Failure to verify U.S. citizenship for participants could result in ineligible participants receiving benefits under the program. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it verifies U.S. citizenship for all participants and confirm that only eligible participants receive benefits under the program. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address eleven specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Per 45 CFR 98.44(b), a Lead Agency must describe in the State Plan its established requirements for pre-service or orientation (to be completed within three months) and ongoing professional development for caregivers, teachers, and directors of child care providers of services for which assistance is provided under the CCDF that, to the extent practicable, align with the State framework. Accessible pre-service or orientation training in health and safety standards appropriate to the setting and age of children served addresses: (i) Each of the requirements relating to matters described in §98.41(a)(1)(i) through (xi) and specifying critical health and safety training that must be completed before caregivers, teachers, and directors are allowed to care for children unsupervised; (ii) At the Lead Agency option, matters described in § 98.41(a)(1)(xii); and (iii) Child development, including the major domains (cognitive, social, emotional, physical development and approaches to learning); Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not ensure that all providers completed required annual training nor that training in health and safety standards addresses the required eleven elements per 45 CFR sections 98.41 and 98.44(b)(1). Context: Forty child care providers were selected for testing and the following exceptions were noted: • For 4 of 40 child care providers selected for testing, the Agency was unable to provide documentation that it ensured the providers completed the required 15 hours of annual training or that a supervisor had documented approval of the training hours. • For 40 of 40 child care providers selected for testing, the Agency’s provider training did not include all 11 of the required health and safety topics. During a monitoring site visit conducted in November 2023 by the HHS Administration for Children & Families, Office of Child Care (OCC), the monitoring team did not find evidence that the Agency’s provider training content included all 11 health and safety topics. Therefore, OCC’s monitoring report identified noncompliance with this training requirement. Cause: The Agency’s procedures were not sufficient to ensure that its monitoring documentation of child care provider training was complete. When developing provider health and safety training content, the Agency did not ensure that it included all 11 health and safety topics required by 45 CFR section 98.44(b)(1). Internal controls did not detect or prevent these errors. Effect Deficiencies in the content and monitoring of provider health and safety training could result in inadequately trained child care providers which may create a risk to the health and safety of children receiving subsidies under the program. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance training monitoring procedures and controls to ensure that all child care providers complete required health and safety training. We further recommend that the Agency update its training content to ensure that it includes all required elements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Lead Agencies must have procedures in place for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each Lead Agency in its approved plan. A Lead Agency is the designated state, territorial, or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Procedures for documenting and verifying eligibility may be performed directly by the lead agency or other agencies engaged in the administration of CCDF. Per 45 CFR Section 98.20(c) - A Child's Eligibility for Child Care Services, for purposes of implementing the citizenship eligibility verification requirements mandated by title IV of the Personal Responsibility and Work Opportunity Reconciliation Act, 8 U.S.C. 1601 et seq., only the citizenship and immigration status of the child, who is the primary beneficiary of the CCDF benefit, is relevant. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to perform verification of U.S. citizenship for participants who were otherwise eligible under the program because they were in need of or receiving protective services. Context: For three of forty participants selected for testing, U.S. citizenship was not verified. Auditors noted that the Agency pooled funding for multiple federal programs with CCDF, which made eligibility for the other funding sources subject to CCDF rules. The Administration for Children and Families (ACF) performed a monitoring visit in November 2023 which identified an exception for U.S. citizenship verification. Through the Agency’s corrective action plan resulting from ACF’s monitoring visit, citizenship was verified back to 10/1/2023 (for FFY2024), however the Agency did not verify citizenship for participants receiving benefits prior to this date. Cause: The Agency’s procedures and controls were not sufficient to ensure that U.S. citizenship was verified for participants who were otherwise eligible under the program because they were in need of or receiving protective services. When the exception was noted by ACF, the Agency verified citizenship for FFY2024, but did not verify citizenship for participants receiving benefits prior to this date. Effect Failure to verify U.S. citizenship for participants could result in ineligible participants receiving benefits under the program. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it verifies U.S. citizenship for all participants and confirm that only eligible participants receive benefits under the program. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility by checking electronic data sources in accordance with federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). Per 42 CFR §435.915(b) and the Vermont State Plan, eligibility for Medicaid is effective on the first day of a month if an individual was eligible at any time during that month. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) incorrectly discontinued benefits for a Medicaid participant during the month in which eligibility was renewed. Context: For one of sixty participants selected for testing, the Agency performed a renewal of Medicaid benefits during the month of October and discontinued benefits for that month instead of backdating the claim to the beginning of the month. Cause: The Agency did not adequately follow procedures regarding eligibility renewals in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect A participant’s benefits were improperly discontinued for one month. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid eligibility renewals to ensure that benefits for eligible participants are not discontinued. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-023 Prior Year Finding: 2023-030 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: A subaward was not reported to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Thirty subawards totaling $6,709,156 were selected for testing, including twenty-eight initial subawards and two subaward amendments. We noted the following exception: • One of thirty subawards was not reported. The subaward was issued 9/26/2023 but it was not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exception noted occurred prior to the full implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-024 Prior Year Finding: 2023-031 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2025) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support a provider’s compliance with the prescribed health and safety standards. The provider health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Context: For one of sixty providers selected for testing, documentation was incomplete to support that the provider was in good tax standing. The provider’s tax standing was verified by the Agency, but the letter was not signed by the Vermont Tax Department Commissioner and uploaded to the PMM as required. As part of a prior year Corrective Action Plan (CAP), a process was developed to require letters of good standing be uploaded to the provider file in the PMM but when this provider’s tax standing was verified, the CAP had not been fully implemented. Cause: The Agency’s 3rd-Party provider did not consistently maintain verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been fully implemented. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency fully implement its CAP to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Utilization Control Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to properly document closure of a case referred to the Medicaid Fraud and Residential Abuse Unit (MFRAU) by the Special Investigations Unit (SIU). Context: For one of twenty-eight cases selected for testing, the SIU opened the case in FY2016, marked it as a high priority, and referred it to the MFRAU. The MFRAU closed the case in FY2018, however, the closure was not properly documented nor communicated. In FY2024 the case was classified by the SIU as administratively closed due to its age, but the results of the review and closure were not documented. Cause: The Agency did not adequately follow procedures regarding utilization control case review and closure in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect Failure to properly document and promptly close cases could allow unnecessary utilization of care and services to continue undetected and result in unnecessary or inappropriate use of Medicaid services. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid utilization control to ensure that cases are closed timely and that documentation of the results of reviews are maintained and communicated. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility by checking electronic data sources in accordance with federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). Per 42 CFR §435.915(b) and the Vermont State Plan, eligibility for Medicaid is effective on the first day of a month if an individual was eligible at any time during that month. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) incorrectly discontinued benefits for a Medicaid participant during the month in which eligibility was renewed. Context: For one of sixty participants selected for testing, the Agency performed a renewal of Medicaid benefits during the month of October and discontinued benefits for that month instead of backdating the claim to the beginning of the month. Cause: The Agency did not adequately follow procedures regarding eligibility renewals in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect A participant’s benefits were improperly discontinued for one month. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid eligibility renewals to ensure that benefits for eligible participants are not discontinued. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-023 Prior Year Finding: 2023-030 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: A subaward was not reported to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Thirty subawards totaling $6,709,156 were selected for testing, including twenty-eight initial subawards and two subaward amendments. We noted the following exception: • One of thirty subawards was not reported. The subaward was issued 9/26/2023 but it was not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exception noted occurred prior to the full implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-024 Prior Year Finding: 2023-031 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2025) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support a provider’s compliance with the prescribed health and safety standards. The provider health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Context: For one of sixty providers selected for testing, documentation was incomplete to support that the provider was in good tax standing. The provider’s tax standing was verified by the Agency, but the letter was not signed by the Vermont Tax Department Commissioner and uploaded to the PMM as required. As part of a prior year Corrective Action Plan (CAP), a process was developed to require letters of good standing be uploaded to the provider file in the PMM but when this provider’s tax standing was verified, the CAP had not been fully implemented. Cause: The Agency’s 3rd-Party provider did not consistently maintain verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been fully implemented. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency fully implement its CAP to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Utilization Control Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to properly document closure of a case referred to the Medicaid Fraud and Residential Abuse Unit (MFRAU) by the Special Investigations Unit (SIU). Context: For one of twenty-eight cases selected for testing, the SIU opened the case in FY2016, marked it as a high priority, and referred it to the MFRAU. The MFRAU closed the case in FY2018, however, the closure was not properly documented nor communicated. In FY2024 the case was classified by the SIU as administratively closed due to its age, but the results of the review and closure were not documented. Cause: The Agency did not adequately follow procedures regarding utilization control case review and closure in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect Failure to properly document and promptly close cases could allow unnecessary utilization of care and services to continue undetected and result in unnecessary or inappropriate use of Medicaid services. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid utilization control to ensure that cases are closed timely and that documentation of the results of reviews are maintained and communicated. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility by checking electronic data sources in accordance with federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). Per 42 CFR §435.915(b) and the Vermont State Plan, eligibility for Medicaid is effective on the first day of a month if an individual was eligible at any time during that month. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) incorrectly discontinued benefits for a Medicaid participant during the month in which eligibility was renewed. Context: For one of sixty participants selected for testing, the Agency performed a renewal of Medicaid benefits during the month of October and discontinued benefits for that month instead of backdating the claim to the beginning of the month. Cause: The Agency did not adequately follow procedures regarding eligibility renewals in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect A participant’s benefits were improperly discontinued for one month. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid eligibility renewals to ensure that benefits for eligible participants are not discontinued. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-023 Prior Year Finding: 2023-030 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: A subaward was not reported to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Thirty subawards totaling $6,709,156 were selected for testing, including twenty-eight initial subawards and two subaward amendments. We noted the following exception: • One of thirty subawards was not reported. The subaward was issued 9/26/2023 but it was not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exception noted occurred prior to the full implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-024 Prior Year Finding: 2023-031 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2025) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support a provider’s compliance with the prescribed health and safety standards. The provider health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Context: For one of sixty providers selected for testing, documentation was incomplete to support that the provider was in good tax standing. The provider’s tax standing was verified by the Agency, but the letter was not signed by the Vermont Tax Department Commissioner and uploaded to the PMM as required. As part of a prior year Corrective Action Plan (CAP), a process was developed to require letters of good standing be uploaded to the provider file in the PMM but when this provider’s tax standing was verified, the CAP had not been fully implemented. Cause: The Agency’s 3rd-Party provider did not consistently maintain verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been fully implemented. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency fully implement its CAP to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Utilization Control Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to properly document closure of a case referred to the Medicaid Fraud and Residential Abuse Unit (MFRAU) by the Special Investigations Unit (SIU). Context: For one of twenty-eight cases selected for testing, the SIU opened the case in FY2016, marked it as a high priority, and referred it to the MFRAU. The MFRAU closed the case in FY2018, however, the closure was not properly documented nor communicated. In FY2024 the case was classified by the SIU as administratively closed due to its age, but the results of the review and closure were not documented. Cause: The Agency did not adequately follow procedures regarding utilization control case review and closure in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect Failure to properly document and promptly close cases could allow unnecessary utilization of care and services to continue undetected and result in unnecessary or inappropriate use of Medicaid services. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid utilization control to ensure that cases are closed timely and that documentation of the results of reviews are maintained and communicated. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-028 Prior Year Finding: 2023-034 Federal Agency: U.S. Department of Homeland Security State Agency: Department of Public Safety Federal Program: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4474-DR-VT (2020), FEMA-4532-DR-VT (2020), FEMA-4621-DR-VT (2021), FEMA-4695-DR-VT (2023), FEMA-4720-DR-VT (2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Safety (Department) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: This is a repeat finding from the prior year and auditors note that progress has been made, though the corrective action plan from the prior year has not been fully implemented. Ninety-six subawards were selected for testing, including thirty-two which were issued in a prior year and sixty-four which were issued during FY2024. The following exceptions were noted: • 24 of 96 subawards were not reported to FSRS, totaling $17,306,440. o Of the exceptions noted, FY2024 subawards not reported were 13 of 64 and totaling $7,627,387 of $17,741,626. • 5 of 96 subawards were not reported timely to FSRS, totaling $10,937,684. o Of the exceptions noted, FY2024 subawards reported late were 4 of 64 and totaling $9,609,432 of $17,741,626. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subawards were reported timely or accurately to FSRS. Internal controls did not prevent or detect the errors. The corrective action plan from the prior year has not been fully implemented. Effect: The Department’s subaward reporting to FSRS was incomplete and inaccurate. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should continue to improve its procedures and internal controls to ensure that all required subawards and subaward modifications are reported accurately and timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-003 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Agriculture Federal Program: Dairy Business Innovation Initiatives Assistance Listing Number: 10.176 Award Number and Year: AM200100XXXXG081 (9/30/2020 – 9/30/2024), 21DBIVT1004 (10/31/2021 – 10/30/2024), AM22DBIVT1015 (9/30/2022 – 9/29/2025), AM21DBIVT1011 (9/30/2022 – 9/29/2026), 23DBIVT1018 (9/30/2023 – 9/29/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Agency of Agriculture (Agency) were not reported to FSRS in accordance with FFATA requirements. Context: Nine subaward transactions were selected for testing, including eight original subawards and one subaward amendment. Of the nine subawards selected, only one was reported timely in accordance with FFATA requirements. Specifically, we noted the following exceptions: • 1 of 8 original subawards was not reported to FSRS. The subaward was in the amount of $250,000. • 1 of 1 subaward amendment was not reported to FSRS. The subaward was a negative adjustment of $225,445. • 6 of 8 original subawards were not reported to FSRS timely. All subawards were reported on 4/24/2024 but they were issued from 1/27/2021 to 3/21/2024 and were reported from 24 days to 3 years and 2 months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency did not have procedures and controls in place to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency develop procedures and internal controls to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements and that all previously issued subawards are reported. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Eligibility case reviews performed by the Agency of Human Services (Agency) were untimely and lacked proper documentation. Context: The Agency has implemented an Automated Data Processing (ADP) system referred to as the ACCESS system that is utilized in the eligibility determination process of many programs, including SNAP. ACCESS is used to process and store all case file information for eligibility determination and benefit calculations, it automatically terminates household eligibility at the end of their certification period unless recertified and provides data necessary to meet Federal issuance and reconciliation reporting requirements. Forty participants were selected for testing and the following exceptions were noted: • For 1 of 40 participants selected for testing, the participant was initially determined to be eligible in ACCESS, but when a quality review was performed four months later, the participant was determined to be ineligible. The ineligible participant received benefits for two months before their benefits were terminated. • 5 of 40 participants selected for testing were not reviewed timely. A minimum of four case reviews must be performed by each district in the month in which the applicant is determined eligible in ACCESS. The five exceptions were reviewed in a subsequent month after the applicant was determined eligible. • For 16 of 40 participants selected for testing, supervisory review and verification of the applicants’ eligibility was not dated by the supervisor. Cause: The Agency’s procedures were not sufficient to ensure that eligibility case reviews were performed timely and were properly documented. Internal controls did not detect or prevent the errors. Effect The failure to perform eligibility case reviews timely resulted in an ineligible applicant receiving benefits for two months before it was detected. Questioned costs: $2,296 Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility case reviews are performed timely and are properly documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Card Security Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: The state is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation for the daily/weekly card reconciliations was incomplete. Context: The Agency of Human Services (Agency) prepares the Weekly Card Activity Reconciliation report to document the daily/weekly EBT cards produced, issued or destroyed. This report verifies that the number of cards produced agrees to the number of cards issued and destroyed during the day/week. For 1 of 40 reconciliation reports selected for testing, the count of cards destroyed was not maintained. Cause: The Agency’s internal controls were not sufficient to ensure that the reconciliation of destroyed cards was maintained. Effect Failure to maintain documentation for destroyed cards could result in unauthorized use of EBT cards that are designated for destruction. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance internal controls to ensure that it maintains documentation of the daily/weekly reconciliation of destroyed EBT cards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of five contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Eligibility case reviews performed by the Agency of Human Services (Agency) were untimely and lacked proper documentation. Context: The Agency has implemented an Automated Data Processing (ADP) system referred to as the ACCESS system that is utilized in the eligibility determination process of many programs, including SNAP. ACCESS is used to process and store all case file information for eligibility determination and benefit calculations, it automatically terminates household eligibility at the end of their certification period unless recertified and provides data necessary to meet Federal issuance and reconciliation reporting requirements. Forty participants were selected for testing and the following exceptions were noted: • For 1 of 40 participants selected for testing, the participant was initially determined to be eligible in ACCESS, but when a quality review was performed four months later, the participant was determined to be ineligible. The ineligible participant received benefits for two months before their benefits were terminated. • 5 of 40 participants selected for testing were not reviewed timely. A minimum of four case reviews must be performed by each district in the month in which the applicant is determined eligible in ACCESS. The five exceptions were reviewed in a subsequent month after the applicant was determined eligible. • For 16 of 40 participants selected for testing, supervisory review and verification of the applicants’ eligibility was not dated by the supervisor. Cause: The Agency’s procedures were not sufficient to ensure that eligibility case reviews were performed timely and were properly documented. Internal controls did not detect or prevent the errors. Effect The failure to perform eligibility case reviews timely resulted in an ineligible applicant receiving benefits for two months before it was detected. Questioned costs: $2,296 Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility case reviews are performed timely and are properly documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Card Security Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: The state is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation for the daily/weekly card reconciliations was incomplete. Context: The Agency of Human Services (Agency) prepares the Weekly Card Activity Reconciliation report to document the daily/weekly EBT cards produced, issued or destroyed. This report verifies that the number of cards produced agrees to the number of cards issued and destroyed during the day/week. For 1 of 40 reconciliation reports selected for testing, the count of cards destroyed was not maintained. Cause: The Agency’s internal controls were not sufficient to ensure that the reconciliation of destroyed cards was maintained. Effect Failure to maintain documentation for destroyed cards could result in unauthorized use of EBT cards that are designated for destruction. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance internal controls to ensure that it maintains documentation of the daily/weekly reconciliation of destroyed EBT cards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of five contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Eligibility case reviews performed by the Agency of Human Services (Agency) were untimely and lacked proper documentation. Context: The Agency has implemented an Automated Data Processing (ADP) system referred to as the ACCESS system that is utilized in the eligibility determination process of many programs, including SNAP. ACCESS is used to process and store all case file information for eligibility determination and benefit calculations, it automatically terminates household eligibility at the end of their certification period unless recertified and provides data necessary to meet Federal issuance and reconciliation reporting requirements. Forty participants were selected for testing and the following exceptions were noted: • For 1 of 40 participants selected for testing, the participant was initially determined to be eligible in ACCESS, but when a quality review was performed four months later, the participant was determined to be ineligible. The ineligible participant received benefits for two months before their benefits were terminated. • 5 of 40 participants selected for testing were not reviewed timely. A minimum of four case reviews must be performed by each district in the month in which the applicant is determined eligible in ACCESS. The five exceptions were reviewed in a subsequent month after the applicant was determined eligible. • For 16 of 40 participants selected for testing, supervisory review and verification of the applicants’ eligibility was not dated by the supervisor. Cause: The Agency’s procedures were not sufficient to ensure that eligibility case reviews were performed timely and were properly documented. Internal controls did not detect or prevent the errors. Effect The failure to perform eligibility case reviews timely resulted in an ineligible applicant receiving benefits for two months before it was detected. Questioned costs: $2,296 Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility case reviews are performed timely and are properly documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Card Security Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: The state is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation for the daily/weekly card reconciliations was incomplete. Context: The Agency of Human Services (Agency) prepares the Weekly Card Activity Reconciliation report to document the daily/weekly EBT cards produced, issued or destroyed. This report verifies that the number of cards produced agrees to the number of cards issued and destroyed during the day/week. For 1 of 40 reconciliation reports selected for testing, the count of cards destroyed was not maintained. Cause: The Agency’s internal controls were not sufficient to ensure that the reconciliation of destroyed cards was maintained. Effect Failure to maintain documentation for destroyed cards could result in unauthorized use of EBT cards that are designated for destruction. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance internal controls to ensure that it maintains documentation of the daily/weekly reconciliation of destroyed EBT cards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of five contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Eligibility case reviews performed by the Agency of Human Services (Agency) were untimely and lacked proper documentation. Context: The Agency has implemented an Automated Data Processing (ADP) system referred to as the ACCESS system that is utilized in the eligibility determination process of many programs, including SNAP. ACCESS is used to process and store all case file information for eligibility determination and benefit calculations, it automatically terminates household eligibility at the end of their certification period unless recertified and provides data necessary to meet Federal issuance and reconciliation reporting requirements. Forty participants were selected for testing and the following exceptions were noted: • For 1 of 40 participants selected for testing, the participant was initially determined to be eligible in ACCESS, but when a quality review was performed four months later, the participant was determined to be ineligible. The ineligible participant received benefits for two months before their benefits were terminated. • 5 of 40 participants selected for testing were not reviewed timely. A minimum of four case reviews must be performed by each district in the month in which the applicant is determined eligible in ACCESS. The five exceptions were reviewed in a subsequent month after the applicant was determined eligible. • For 16 of 40 participants selected for testing, supervisory review and verification of the applicants’ eligibility was not dated by the supervisor. Cause: The Agency’s procedures were not sufficient to ensure that eligibility case reviews were performed timely and were properly documented. Internal controls did not detect or prevent the errors. Effect The failure to perform eligibility case reviews timely resulted in an ineligible applicant receiving benefits for two months before it was detected. Questioned costs: $2,296 Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility case reviews are performed timely and are properly documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Card Security Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: The state is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation for the daily/weekly card reconciliations was incomplete. Context: The Agency of Human Services (Agency) prepares the Weekly Card Activity Reconciliation report to document the daily/weekly EBT cards produced, issued or destroyed. This report verifies that the number of cards produced agrees to the number of cards issued and destroyed during the day/week. For 1 of 40 reconciliation reports selected for testing, the count of cards destroyed was not maintained. Cause: The Agency’s internal controls were not sufficient to ensure that the reconciliation of destroyed cards was maintained. Effect Failure to maintain documentation for destroyed cards could result in unauthorized use of EBT cards that are designated for destruction. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance internal controls to ensure that it maintains documentation of the daily/weekly reconciliation of destroyed EBT cards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of five contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-007 Prior Year Finding: No Federal Agency: U.S. Department of Defense State Agency: Vermont State Military Department Federal Program: National Guard Military Operations and Maintenance (O&M) Projects Assistance Listing Number: 12.401 Award Number and Year: W912LN2421001 (10/1/2023 – 9/20/2024) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont State Military Department (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Context: One of five transactions selected for testing was incurred prior to the award’s period of performance. The expense was for a transaction incurred in the month of September 2023 but the award’s period of performance began on 10/1/2023. Cause: The Department’s procedures were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Internal controls did not prevent or detect the error. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: Below the reportable limit. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-008 Prior Year Finding: 2023-005 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC, UCFE, UCX, TRA UI393002355A50 (10/2022-9/30/2023), TRA 24A55UT000024 (10/1/2023-9/30/2024), RESEA UI380102260A50 (1/1/2022-9/30/2024) RESEA 23A60UR000010 (1/1/2023-9/30/2025), Admin UI393532355A50 (10/1/2022-12/31/2025), Admin 24A55UI000063 (10/1/2023-12/31/2026), ARPA Fraud UI370952155A50 (9/1/2021-8/31/2025), ARPA Equity UI370952155A50 (10/1/2022-10/31/2025), CARES UI347462055A50 (4/1/2021-6/30/2025), DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Status Report, UI Programs – This report is used to report program and administrative expenditures. All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Additional information on OMB Number 1205-0461 can be accessed at http://www.dol.gov/agencies/eta/grants/management and scroll down to the section on Financial Reporting. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UI Projects (administration and benefits). ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) – Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that it had submitted required financial, performance, and special reports had been reviewed and approved by an authorized State official prior to submission, and the Department was unable to provide supporting documentation that agreed with the data included in the submitted financial reports. Context: We reviewed a sample of the financial and performance reports filed during fiscal year 2024. The following exceptions were noted: ETA 9130: Supporting documentation was insufficient to support the data reported in 2 of 2 quarters reviewed. Support could not be provided that 2 of 2 quarters reviewed had been reviewed and approved prior to submission. ETA 191: Support could not be provided that 2 of 2 reports reviewed had been reviewed and approved prior to submission. ETA 9050: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9055: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports were accurate, agreed with supporting documentation, and were reviewed and approved prior to submission. Effect: Auditors were unable to verify the accuracy of the financial reports submitted by the Department. A lack of review and approval of financial and performance reports could allow incorrect data to be reported for the program which could misrepresent the State’s financial and programmatic performance in the program. Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all financial and performance reports are accurate, agree with supporting documentation, and are reviewed by an authorized State official prior to submission. We also recommend that supporting documentation and evidence of supervisory review is maintained and available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-009 Prior Year Finding: 2023-007 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without supporting documentation and documentation of supervisory review and approval. Context: Sixty transactions were selected for testing and the following exceptions were noted: • For six of sixty transactions selected for testing, the Department was unable to provide documentation to support the transactions totaling $510. • For six of sixty transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment. Cause: The Department’s procedures were not sufficient to ensure that payments were supported, reviewed, and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not supported and reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: $510 which represents the total unsupported expenditures. Recommendation: We recommend the Department reviews and enhances its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are supported and reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-010 Prior Year Finding: 2023-008 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: Admin 24A55UI000063 (10/1/2023-12/31/2026), DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Context: Sixty transactions were selected for testing and the following exceptions were noted: • Five of sixty transactions were charged to the award before the allowable period of performance. The grant award start date was October 1, 2023, but costs were incurred in July, August, and September 2023. Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: $2,980, which represents the total incurred before the allowable period of performance. Recommendation: We recommend the Department review and enhance its procedures and controls to ensure that prior to charging costs to the program, they are incurred within an award’s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-008 Prior Year Finding: 2023-005 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC, UCFE, UCX, TRA UI393002355A50 (10/2022-9/30/2023), TRA 24A55UT000024 (10/1/2023-9/30/2024), RESEA UI380102260A50 (1/1/2022-9/30/2024) RESEA 23A60UR000010 (1/1/2023-9/30/2025), Admin UI393532355A50 (10/1/2022-12/31/2025), Admin 24A55UI000063 (10/1/2023-12/31/2026), ARPA Fraud UI370952155A50 (9/1/2021-8/31/2025), ARPA Equity UI370952155A50 (10/1/2022-10/31/2025), CARES UI347462055A50 (4/1/2021-6/30/2025), DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Status Report, UI Programs – This report is used to report program and administrative expenditures. All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Additional information on OMB Number 1205-0461 can be accessed at http://www.dol.gov/agencies/eta/grants/management and scroll down to the section on Financial Reporting. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UI Projects (administration and benefits). ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) – Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that it had submitted required financial, performance, and special reports had been reviewed and approved by an authorized State official prior to submission, and the Department was unable to provide supporting documentation that agreed with the data included in the submitted financial reports. Context: We reviewed a sample of the financial and performance reports filed during fiscal year 2024. The following exceptions were noted: ETA 9130: Supporting documentation was insufficient to support the data reported in 2 of 2 quarters reviewed. Support could not be provided that 2 of 2 quarters reviewed had been reviewed and approved prior to submission. ETA 191: Support could not be provided that 2 of 2 reports reviewed had been reviewed and approved prior to submission. ETA 9050: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9055: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports were accurate, agreed with supporting documentation, and were reviewed and approved prior to submission. Effect: Auditors were unable to verify the accuracy of the financial reports submitted by the Department. A lack of review and approval of financial and performance reports could allow incorrect data to be reported for the program which could misrepresent the State’s financial and programmatic performance in the program. Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all financial and performance reports are accurate, agree with supporting documentation, and are reviewed by an authorized State official prior to submission. We also recommend that supporting documentation and evidence of supervisory review is maintained and available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-009 Prior Year Finding: 2023-007 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without supporting documentation and documentation of supervisory review and approval. Context: Sixty transactions were selected for testing and the following exceptions were noted: • For six of sixty transactions selected for testing, the Department was unable to provide documentation to support the transactions totaling $510. • For six of sixty transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment. Cause: The Department’s procedures were not sufficient to ensure that payments were supported, reviewed, and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not supported and reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: $510 which represents the total unsupported expenditures. Recommendation: We recommend the Department reviews and enhances its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are supported and reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-010 Prior Year Finding: 2023-008 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: Admin 24A55UI000063 (10/1/2023-12/31/2026), DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Context: Sixty transactions were selected for testing and the following exceptions were noted: • Five of sixty transactions were charged to the award before the allowable period of performance. The grant award start date was October 1, 2023, but costs were incurred in July, August, and September 2023. Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: $2,980, which represents the total incurred before the allowable period of performance. Recommendation: We recommend the Department review and enhance its procedures and controls to ensure that prior to charging costs to the program, they are incurred within an award’s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Highway Planning and Construction Assistance Listing Number: 20.205 Award Number and Year: FFY2023 – FFY2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) omitted required federal award information from subawards it issued in the program and did not adequately monitor subrecipients. Context: Nineteen subawards were selected for testing and the following exceptions were noted: • For 16 of 19 subawards selected for testing, the federal award date was not included on the subaward agreement. • For 1 of 19 subawards selected for testing, the last on-site subrecipient monitoring visit was performed in FY 2019 and the next on-site monitoring did not take place until FY 2024. Per the VTrans subrecipient monitoring plan, on-site monitoring must be performed no less than every three years. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required federal information. Although VTrans subsequently modified its subaward issuance process, controls in effect during the audit period were not sufficient to ensure that subawards included all required information. Procedures and internal controls were also not sufficient to ensure that timely on-site monitoring visits were performed in accordance with its monitoring plan. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Failure to conduct adequate subrecipient monitoring may result in a failure of VTrans to detect that subawards are used for unauthorized purposes, are managed in violation of the terms and conditions of the subawards, or that subaward performance goals are not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by VTrans personnel on a timely basis. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-012 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Highway Planning and Construction Assistance Listing Number: 20.205 Award Number and Year: FFY2023 – FFY2024 Compliance Requirement: Special Tests and Provisions – Wage Rate Requirements Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – All laborers and mechanics employed by contractors or subcontractors to work on construction contracts in excess of $2,000 financed by federal assistance funds must be paid wages not less than those established for the locality of the project (prevailing wage rates) by the Department of Labor (DOL) (40 USC 3141–3144, 3146, and 3147.) Per 29 CFR Part 5 – Labor Standards Provisions Applicable to Contacts Governing Federally Financed and Assisted Construction, nonfederal entities shall include in their construction contracts subject to the Wage Rate Requirements a provision that the contractor or subcontractor comply with those requirements and the DOL regulations. This includes a requirement for the contractor or subcontractor to submit to the nonfederal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls). Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) did not receive weekly certified payrolls from all contractors. Context: Ten contracts were selected for testing, which included forty weekly certified payrolls tested. One of forty weekly certified payrolls was not received by VTrans. Cause: Procedures were not sufficient to ensure that VTrans obtained all required weekly certified payrolls. Internal controls did not detect or prevent the error. Effect: Failure to obtain weekly payrolls could prevent VTrans from detecting if a contractor pays less than the prevailing wage. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance procedures and internal controls to ensure that it obtains weekly certified payrolls from all contractors. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-013 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Federal Transit Cluster Assistance Listing Number: 20.500, 20.507, 20.526 Award Number and Year: VT-04-0021-01 (3/14/2013 – 6/30/2016) Compliance Requirement: Cash Management, Period of Performance Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.343(b) requires nonfederal entities to liquidate all obligations incurred under the federal award no later than 90 calendar days after the end date of the period of performance as specified in the terms and conditions of the federal award unless the federal awarding agency or pass-through entity authorizes an extension. Per the U.S. Department of Transportation, Federal Transit Administration (FTA), circular FTA C 5010.1E Chapter 3, the recipient is responsible to initiate closeout of the Award, within 90 days after the end of the period of performance, or after all approved activities are completed and/or the applicable federal assistance has been expended for all eligible costs. Any deviation from the approved Award must be documented in the closeout amendment. US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Per 31 CFR Part 205 Subpart B, a State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Transportation (VTrans) drew down federal funds against an award for which the period of performance had expired. An award period extension was not authorized by FTA, nor had the award been closed out timely. Context: VTrans drew down $12,671 from a grant award for which the period of performance ended on June 30, 2016. An extension for the award was not authorized by FTA, nor did FTA authorize VTrans to reopen or modify the grant award. VTrans did not initiate closure of the award until after completion of the drawdown. Cause: The procedures used by VTrans were not sufficient to ensure that it closed out a grant award timely, nor were they sufficient to prevent the drawdown of funds against an expired grant award. Internal controls did not prevent or detect the errors. Effect: VTrans drew down funds against a grant award after the end of its period of performance. Questioned costs: $12,671, the amount of funds drawn down against the expired grant award. Recommendation: We recommend that VTrans review and enhance grant closeout procedures and internal controls to ensure that grants are closed out timely. We further recommend that VTrans review and enhance procedures and internal controls over cash management to ensure that cash draws are performed only against grants for which the period of performance has not expired. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-013 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Federal Transit Cluster Assistance Listing Number: 20.500, 20.507, 20.526 Award Number and Year: VT-04-0021-01 (3/14/2013 – 6/30/2016) Compliance Requirement: Cash Management, Period of Performance Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.343(b) requires nonfederal entities to liquidate all obligations incurred under the federal award no later than 90 calendar days after the end date of the period of performance as specified in the terms and conditions of the federal award unless the federal awarding agency or pass-through entity authorizes an extension. Per the U.S. Department of Transportation, Federal Transit Administration (FTA), circular FTA C 5010.1E Chapter 3, the recipient is responsible to initiate closeout of the Award, within 90 days after the end of the period of performance, or after all approved activities are completed and/or the applicable federal assistance has been expended for all eligible costs. Any deviation from the approved Award must be documented in the closeout amendment. US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Per 31 CFR Part 205 Subpart B, a State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Transportation (VTrans) drew down federal funds against an award for which the period of performance had expired. An award period extension was not authorized by FTA, nor had the award been closed out timely. Context: VTrans drew down $12,671 from a grant award for which the period of performance ended on June 30, 2016. An extension for the award was not authorized by FTA, nor did FTA authorize VTrans to reopen or modify the grant award. VTrans did not initiate closure of the award until after completion of the drawdown. Cause: The procedures used by VTrans were not sufficient to ensure that it closed out a grant award timely, nor were they sufficient to prevent the drawdown of funds against an expired grant award. Internal controls did not prevent or detect the errors. Effect: VTrans drew down funds against a grant award after the end of its period of performance. Questioned costs: $12,671, the amount of funds drawn down against the expired grant award. Recommendation: We recommend that VTrans review and enhance grant closeout procedures and internal controls to ensure that grants are closed out timely. We further recommend that VTrans review and enhance procedures and internal controls over cash management to ensure that cash draws are performed only against grants for which the period of performance has not expired. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-013 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Federal Transit Cluster Assistance Listing Number: 20.500, 20.507, 20.526 Award Number and Year: VT-04-0021-01 (3/14/2013 – 6/30/2016) Compliance Requirement: Cash Management, Period of Performance Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.343(b) requires nonfederal entities to liquidate all obligations incurred under the federal award no later than 90 calendar days after the end date of the period of performance as specified in the terms and conditions of the federal award unless the federal awarding agency or pass-through entity authorizes an extension. Per the U.S. Department of Transportation, Federal Transit Administration (FTA), circular FTA C 5010.1E Chapter 3, the recipient is responsible to initiate closeout of the Award, within 90 days after the end of the period of performance, or after all approved activities are completed and/or the applicable federal assistance has been expended for all eligible costs. Any deviation from the approved Award must be documented in the closeout amendment. US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Per 31 CFR Part 205 Subpart B, a State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Transportation (VTrans) drew down federal funds against an award for which the period of performance had expired. An award period extension was not authorized by FTA, nor had the award been closed out timely. Context: VTrans drew down $12,671 from a grant award for which the period of performance ended on June 30, 2016. An extension for the award was not authorized by FTA, nor did FTA authorize VTrans to reopen or modify the grant award. VTrans did not initiate closure of the award until after completion of the drawdown. Cause: The procedures used by VTrans were not sufficient to ensure that it closed out a grant award timely, nor were they sufficient to prevent the drawdown of funds against an expired grant award. Internal controls did not prevent or detect the errors. Effect: VTrans drew down funds against a grant award after the end of its period of performance. Questioned costs: $12,671, the amount of funds drawn down against the expired grant award. Recommendation: We recommend that VTrans review and enhance grant closeout procedures and internal controls to ensure that grants are closed out timely. We further recommend that VTrans review and enhance procedures and internal controls over cash management to ensure that cash draws are performed only against grants for which the period of performance has not expired. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-014 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP4407 (3/3/2021 – 12/31/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Administration (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of seven contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. The contract was procured in June 2020 in an initial amount of $5,000,000. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-015 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Student Support and Academic Enrichment Grants Assistance Listing Number: 84.424 Award Number and Year: S424A220047 (7/1/2022 – 9/30/2024) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Grantees draw funds via the G5 System. Grantees request funds by (1) creating a payment request using the G5 System through the Internet; (2) calling the Payee Hotline; or (3) if the grantee is placed on the reimbursement or cash monitoring payment method, submitting a Form 270, Request for Title IV Reimbursement or Heightened Cash Monitoring 2 (HCM2), (OMB No. 1845-0089), to an ED program or regional office. When creating a payment request in G5, the grantee enters the drawdown amounts, by award, directly into G5. Grantees can redistribute drawn amounts between grant awards by making adjustments in G5 to reflect actual disbursements for each award, as long as the net amount of the adjustments is zero. When requesting funds using the other two methods, grantees provide drawdown information to the hotline operator or on the Form 270, as applicable. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was unable to provide evidence of proper segregation of duties including a lack of review and approval of drawdown requests. Context: The Agency’s procedures and controls require that the Deputy Chief Fiscal Officer (CFO) prepares drawdowns and the Financial Director reviews and submits them in the G5 System. For 2 of 12 drawdown requests selected for testing, the Deputy CFO both compiled the drawdown information and reviewed and approved them in G5. Cause: The Agency did not follow its drawdown procedures and was unable to provide evidence of review and approval of drawdown requests. Internal controls did not detect or prevent the errors. Effect: There is an increased risk of undetected drawdown errors. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance its internal controls to ensure that drawdowns are reviewed and approved in accordance with the Agency’s policies and procedures. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-018 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) COVID-19 - American Rescue Plan – Elementary and Secondary School Emergency Relief –Homeless Children and Youth Assistance Listing Number: 84.425C, 84.425D, 84.425R, 84.425U, 84.425W Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425R210033 (2/23/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) S425W210047 (4/23/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards were not reported timely and accurately to FSRS. Context: Fifty-eight subawards were selected for testing which included twenty-three original subawards and thirty-four subaward amendments. Sixteen of fifty-eight transactions tested (28%) were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 3 of 58 subawards were not reported accurately to FSRS. • 13 of 58 subawards were not reported timely to FSRS. The subawards were reported from 3 months to more than two years late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency has not fully implemented its corrective action plan from the prior audit. Its procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its corrective action plan from the prior audit. It should review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-018 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) COVID-19 - American Rescue Plan – Elementary and Secondary School Emergency Relief –Homeless Children and Youth Assistance Listing Number: 84.425C, 84.425D, 84.425R, 84.425U, 84.425W Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425R210033 (2/23/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) S425W210047 (4/23/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards were not reported timely and accurately to FSRS. Context: Fifty-eight subawards were selected for testing which included twenty-three original subawards and thirty-four subaward amendments. Sixteen of fifty-eight transactions tested (28%) were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 3 of 58 subawards were not reported accurately to FSRS. • 13 of 58 subawards were not reported timely to FSRS. The subawards were reported from 3 months to more than two years late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency has not fully implemented its corrective action plan from the prior audit. Its procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its corrective action plan from the prior audit. It should review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-018 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) COVID-19 - American Rescue Plan – Elementary and Secondary School Emergency Relief –Homeless Children and Youth Assistance Listing Number: 84.425C, 84.425D, 84.425R, 84.425U, 84.425W Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425R210033 (2/23/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) S425W210047 (4/23/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards were not reported timely and accurately to FSRS. Context: Fifty-eight subawards were selected for testing which included twenty-three original subawards and thirty-four subaward amendments. Sixteen of fifty-eight transactions tested (28%) were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 3 of 58 subawards were not reported accurately to FSRS. • 13 of 58 subawards were not reported timely to FSRS. The subawards were reported from 3 months to more than two years late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency has not fully implemented its corrective action plan from the prior audit. Its procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its corrective action plan from the prior audit. It should review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-018 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) COVID-19 - American Rescue Plan – Elementary and Secondary School Emergency Relief –Homeless Children and Youth Assistance Listing Number: 84.425C, 84.425D, 84.425R, 84.425U, 84.425W Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425R210033 (2/23/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) S425W210047 (4/23/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards were not reported timely and accurately to FSRS. Context: Fifty-eight subawards were selected for testing which included twenty-three original subawards and thirty-four subaward amendments. Sixteen of fifty-eight transactions tested (28%) were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 3 of 58 subawards were not reported accurately to FSRS. • 13 of 58 subawards were not reported timely to FSRS. The subawards were reported from 3 months to more than two years late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency has not fully implemented its corrective action plan from the prior audit. Its procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its corrective action plan from the prior audit. It should review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-017 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2026) Compliance Requirement: Reporting – Performance Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Recipients must submit quarterly and final performance/progress reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide supporting documentation that agreed with the data included in the submitted reports. Context: For two of two quarterly performance reports selected for testing, supporting documentation provided by the Agency was insufficient to support the data reported. Cause: The Agency’s procedures and controls were not sufficient to ensure that performance reports were accurate and agreed with supporting documentation. Effect: Auditors were unable to verify the accuracy of performance reports submitted by the Agency. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that performance reports are accurate, agree with supporting documentation, and that supporting documentation is maintained and available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-018 Prior Year Finding: 2023-024 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards were not reported to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Three of fourteen subawards selected for testing were not reported to FSRS in accordance with FFATA requirements. Specifically, we noted the following exceptions: • Three of fourteen subawards were not reported to FSRS until after auditors requested samples for testing. The subawards were issued between 9/16/2022 and 9/6/2023 but were not reported to FSRS until 10/18/2024. As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely and to review previously issued subawards to ensure that all subawards were reported. The subaward exceptions noted were issued prior to the full implementation of the CAP. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements and that all previously issued subawards are reported. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-019 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – ACF-199 Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Work Participation Rates – State agencies must meet or exceed their minimum annual work participation rates. The minimum work participation rates are 50 percent for the overall rate and 90 percent for the two-parent rate. A state’s minimum work participation rate may be reduced by its caseload reduction credit. The Department of Health and Human Services (HHS) may penalize the state by an amount of up to 21 percent of the State Family Assistance Grant (SFAG) for violation of this provision. Penalty for Failure to Comply with Work Verification Plan – The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the state by an amount not less than 1 percent and not more than 5 percent of the SFAG for violation of this provision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Exceptions were noted regarding the reporting of work participation rates in the ACF-199 report by the Agency of Human Services (Agency) and errors were also noted in the documentation supporting the ACF-199 reports. Context: Forty participants were selected for testing and auditors noted several instances where work participation rates reported on the ACF-199 report did not agree with supporting documentation and that supporting documentation contained errors or was incomplete. Specifically, we noted the following: • For two of forty participants selected for testing, the participants’ wages/hours reported did not match supporting documentation. The error was due to a data system programming error that automatically limits a participant’s actual hours worked to forty when their actual hours exceed forty hours. • One of forty participants selected for testing did not have proper documentation of a change in circumstance. This resulted in two months in which the participant was not documented as engaged in work but had documented hours reported in the ACF-199 report. • For one of forty participants selected for testing, their average hours of work participation were not rereviewed within the six-month window required under the state plan. • For one of forty participants selected for testing, the amount reported did not agree with supporting documentation. The discrepancy was due to rounding errors. • For one of forty participants selected for testing, the employment verification form was not signed by a supervisor. Cause: The Agency’s procedures were not sufficient to ensure that work participation rates reported in the ACF-199 report were accurate, tied to supporting documentation, and that supporting documentation was accurate. Internal controls did not detect or prevent the errors. Effect Work Participation rates reported on the ACF-199 contained errors and did not tie to supporting documentation. HHS may penalize the Agency for its failure to ensure the accuracy of the data used when calculating work participation rates. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it maintains adequate documentation, verification, and internal control procedures to ensure the accuracy of work participation rates reported in the ACF-199 reports. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-019 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – ACF-199 Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Work Participation Rates – State agencies must meet or exceed their minimum annual work participation rates. The minimum work participation rates are 50 percent for the overall rate and 90 percent for the two-parent rate. A state’s minimum work participation rate may be reduced by its caseload reduction credit. The Department of Health and Human Services (HHS) may penalize the state by an amount of up to 21 percent of the State Family Assistance Grant (SFAG) for violation of this provision. Penalty for Failure to Comply with Work Verification Plan – The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the state by an amount not less than 1 percent and not more than 5 percent of the SFAG for violation of this provision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Exceptions were noted regarding the reporting of work participation rates in the ACF-199 report by the Agency of Human Services (Agency) and errors were also noted in the documentation supporting the ACF-199 reports. Context: Forty participants were selected for testing and auditors noted several instances where work participation rates reported on the ACF-199 report did not agree with supporting documentation and that supporting documentation contained errors or was incomplete. Specifically, we noted the following: • For two of forty participants selected for testing, the participants’ wages/hours reported did not match supporting documentation. The error was due to a data system programming error that automatically limits a participant’s actual hours worked to forty when their actual hours exceed forty hours. • One of forty participants selected for testing did not have proper documentation of a change in circumstance. This resulted in two months in which the participant was not documented as engaged in work but had documented hours reported in the ACF-199 report. • For one of forty participants selected for testing, their average hours of work participation were not rereviewed within the six-month window required under the state plan. • For one of forty participants selected for testing, the amount reported did not agree with supporting documentation. The discrepancy was due to rounding errors. • For one of forty participants selected for testing, the employment verification form was not signed by a supervisor. Cause: The Agency’s procedures were not sufficient to ensure that work participation rates reported in the ACF-199 report were accurate, tied to supporting documentation, and that supporting documentation was accurate. Internal controls did not detect or prevent the errors. Effect Work Participation rates reported on the ACF-199 contained errors and did not tie to supporting documentation. HHS may penalize the Agency for its failure to ensure the accuracy of the data used when calculating work participation rates. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it maintains adequate documentation, verification, and internal control procedures to ensure the accuracy of work participation rates reported in the ACF-199 reports. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address eleven specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Per 45 CFR 98.44(b), a Lead Agency must describe in the State Plan its established requirements for pre-service or orientation (to be completed within three months) and ongoing professional development for caregivers, teachers, and directors of child care providers of services for which assistance is provided under the CCDF that, to the extent practicable, align with the State framework. Accessible pre-service or orientation training in health and safety standards appropriate to the setting and age of children served addresses: (i) Each of the requirements relating to matters described in §98.41(a)(1)(i) through (xi) and specifying critical health and safety training that must be completed before caregivers, teachers, and directors are allowed to care for children unsupervised; (ii) At the Lead Agency option, matters described in § 98.41(a)(1)(xii); and (iii) Child development, including the major domains (cognitive, social, emotional, physical development and approaches to learning); Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not ensure that all providers completed required annual training nor that training in health and safety standards addresses the required eleven elements per 45 CFR sections 98.41 and 98.44(b)(1). Context: Forty child care providers were selected for testing and the following exceptions were noted: • For 4 of 40 child care providers selected for testing, the Agency was unable to provide documentation that it ensured the providers completed the required 15 hours of annual training or that a supervisor had documented approval of the training hours. • For 40 of 40 child care providers selected for testing, the Agency’s provider training did not include all 11 of the required health and safety topics. During a monitoring site visit conducted in November 2023 by the HHS Administration for Children & Families, Office of Child Care (OCC), the monitoring team did not find evidence that the Agency’s provider training content included all 11 health and safety topics. Therefore, OCC’s monitoring report identified noncompliance with this training requirement. Cause: The Agency’s procedures were not sufficient to ensure that its monitoring documentation of child care provider training was complete. When developing provider health and safety training content, the Agency did not ensure that it included all 11 health and safety topics required by 45 CFR section 98.44(b)(1). Internal controls did not detect or prevent these errors. Effect Deficiencies in the content and monitoring of provider health and safety training could result in inadequately trained child care providers which may create a risk to the health and safety of children receiving subsidies under the program. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance training monitoring procedures and controls to ensure that all child care providers complete required health and safety training. We further recommend that the Agency update its training content to ensure that it includes all required elements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Lead Agencies must have procedures in place for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each Lead Agency in its approved plan. A Lead Agency is the designated state, territorial, or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Procedures for documenting and verifying eligibility may be performed directly by the lead agency or other agencies engaged in the administration of CCDF. Per 45 CFR Section 98.20(c) - A Child's Eligibility for Child Care Services, for purposes of implementing the citizenship eligibility verification requirements mandated by title IV of the Personal Responsibility and Work Opportunity Reconciliation Act, 8 U.S.C. 1601 et seq., only the citizenship and immigration status of the child, who is the primary beneficiary of the CCDF benefit, is relevant. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to perform verification of U.S. citizenship for participants who were otherwise eligible under the program because they were in need of or receiving protective services. Context: For three of forty participants selected for testing, U.S. citizenship was not verified. Auditors noted that the Agency pooled funding for multiple federal programs with CCDF, which made eligibility for the other funding sources subject to CCDF rules. The Administration for Children and Families (ACF) performed a monitoring visit in November 2023 which identified an exception for U.S. citizenship verification. Through the Agency’s corrective action plan resulting from ACF’s monitoring visit, citizenship was verified back to 10/1/2023 (for FFY2024), however the Agency did not verify citizenship for participants receiving benefits prior to this date. Cause: The Agency’s procedures and controls were not sufficient to ensure that U.S. citizenship was verified for participants who were otherwise eligible under the program because they were in need of or receiving protective services. When the exception was noted by ACF, the Agency verified citizenship for FFY2024, but did not verify citizenship for participants receiving benefits prior to this date. Effect Failure to verify U.S. citizenship for participants could result in ineligible participants receiving benefits under the program. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it verifies U.S. citizenship for all participants and confirm that only eligible participants receive benefits under the program. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address eleven specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Per 45 CFR 98.44(b), a Lead Agency must describe in the State Plan its established requirements for pre-service or orientation (to be completed within three months) and ongoing professional development for caregivers, teachers, and directors of child care providers of services for which assistance is provided under the CCDF that, to the extent practicable, align with the State framework. Accessible pre-service or orientation training in health and safety standards appropriate to the setting and age of children served addresses: (i) Each of the requirements relating to matters described in §98.41(a)(1)(i) through (xi) and specifying critical health and safety training that must be completed before caregivers, teachers, and directors are allowed to care for children unsupervised; (ii) At the Lead Agency option, matters described in § 98.41(a)(1)(xii); and (iii) Child development, including the major domains (cognitive, social, emotional, physical development and approaches to learning); Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not ensure that all providers completed required annual training nor that training in health and safety standards addresses the required eleven elements per 45 CFR sections 98.41 and 98.44(b)(1). Context: Forty child care providers were selected for testing and the following exceptions were noted: • For 4 of 40 child care providers selected for testing, the Agency was unable to provide documentation that it ensured the providers completed the required 15 hours of annual training or that a supervisor had documented approval of the training hours. • For 40 of 40 child care providers selected for testing, the Agency’s provider training did not include all 11 of the required health and safety topics. During a monitoring site visit conducted in November 2023 by the HHS Administration for Children & Families, Office of Child Care (OCC), the monitoring team did not find evidence that the Agency’s provider training content included all 11 health and safety topics. Therefore, OCC’s monitoring report identified noncompliance with this training requirement. Cause: The Agency’s procedures were not sufficient to ensure that its monitoring documentation of child care provider training was complete. When developing provider health and safety training content, the Agency did not ensure that it included all 11 health and safety topics required by 45 CFR section 98.44(b)(1). Internal controls did not detect or prevent these errors. Effect Deficiencies in the content and monitoring of provider health and safety training could result in inadequately trained child care providers which may create a risk to the health and safety of children receiving subsidies under the program. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance training monitoring procedures and controls to ensure that all child care providers complete required health and safety training. We further recommend that the Agency update its training content to ensure that it includes all required elements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Lead Agencies must have procedures in place for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each Lead Agency in its approved plan. A Lead Agency is the designated state, territorial, or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Procedures for documenting and verifying eligibility may be performed directly by the lead agency or other agencies engaged in the administration of CCDF. Per 45 CFR Section 98.20(c) - A Child's Eligibility for Child Care Services, for purposes of implementing the citizenship eligibility verification requirements mandated by title IV of the Personal Responsibility and Work Opportunity Reconciliation Act, 8 U.S.C. 1601 et seq., only the citizenship and immigration status of the child, who is the primary beneficiary of the CCDF benefit, is relevant. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to perform verification of U.S. citizenship for participants who were otherwise eligible under the program because they were in need of or receiving protective services. Context: For three of forty participants selected for testing, U.S. citizenship was not verified. Auditors noted that the Agency pooled funding for multiple federal programs with CCDF, which made eligibility for the other funding sources subject to CCDF rules. The Administration for Children and Families (ACF) performed a monitoring visit in November 2023 which identified an exception for U.S. citizenship verification. Through the Agency’s corrective action plan resulting from ACF’s monitoring visit, citizenship was verified back to 10/1/2023 (for FFY2024), however the Agency did not verify citizenship for participants receiving benefits prior to this date. Cause: The Agency’s procedures and controls were not sufficient to ensure that U.S. citizenship was verified for participants who were otherwise eligible under the program because they were in need of or receiving protective services. When the exception was noted by ACF, the Agency verified citizenship for FFY2024, but did not verify citizenship for participants receiving benefits prior to this date. Effect Failure to verify U.S. citizenship for participants could result in ineligible participants receiving benefits under the program. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it verifies U.S. citizenship for all participants and confirm that only eligible participants receive benefits under the program. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address eleven specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Per 45 CFR 98.44(b), a Lead Agency must describe in the State Plan its established requirements for pre-service or orientation (to be completed within three months) and ongoing professional development for caregivers, teachers, and directors of child care providers of services for which assistance is provided under the CCDF that, to the extent practicable, align with the State framework. Accessible pre-service or orientation training in health and safety standards appropriate to the setting and age of children served addresses: (i) Each of the requirements relating to matters described in §98.41(a)(1)(i) through (xi) and specifying critical health and safety training that must be completed before caregivers, teachers, and directors are allowed to care for children unsupervised; (ii) At the Lead Agency option, matters described in § 98.41(a)(1)(xii); and (iii) Child development, including the major domains (cognitive, social, emotional, physical development and approaches to learning); Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not ensure that all providers completed required annual training nor that training in health and safety standards addresses the required eleven elements per 45 CFR sections 98.41 and 98.44(b)(1). Context: Forty child care providers were selected for testing and the following exceptions were noted: • For 4 of 40 child care providers selected for testing, the Agency was unable to provide documentation that it ensured the providers completed the required 15 hours of annual training or that a supervisor had documented approval of the training hours. • For 40 of 40 child care providers selected for testing, the Agency’s provider training did not include all 11 of the required health and safety topics. During a monitoring site visit conducted in November 2023 by the HHS Administration for Children & Families, Office of Child Care (OCC), the monitoring team did not find evidence that the Agency’s provider training content included all 11 health and safety topics. Therefore, OCC’s monitoring report identified noncompliance with this training requirement. Cause: The Agency’s procedures were not sufficient to ensure that its monitoring documentation of child care provider training was complete. When developing provider health and safety training content, the Agency did not ensure that it included all 11 health and safety topics required by 45 CFR section 98.44(b)(1). Internal controls did not detect or prevent these errors. Effect Deficiencies in the content and monitoring of provider health and safety training could result in inadequately trained child care providers which may create a risk to the health and safety of children receiving subsidies under the program. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance training monitoring procedures and controls to ensure that all child care providers complete required health and safety training. We further recommend that the Agency update its training content to ensure that it includes all required elements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Lead Agencies must have procedures in place for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each Lead Agency in its approved plan. A Lead Agency is the designated state, territorial, or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Procedures for documenting and verifying eligibility may be performed directly by the lead agency or other agencies engaged in the administration of CCDF. Per 45 CFR Section 98.20(c) - A Child's Eligibility for Child Care Services, for purposes of implementing the citizenship eligibility verification requirements mandated by title IV of the Personal Responsibility and Work Opportunity Reconciliation Act, 8 U.S.C. 1601 et seq., only the citizenship and immigration status of the child, who is the primary beneficiary of the CCDF benefit, is relevant. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to perform verification of U.S. citizenship for participants who were otherwise eligible under the program because they were in need of or receiving protective services. Context: For three of forty participants selected for testing, U.S. citizenship was not verified. Auditors noted that the Agency pooled funding for multiple federal programs with CCDF, which made eligibility for the other funding sources subject to CCDF rules. The Administration for Children and Families (ACF) performed a monitoring visit in November 2023 which identified an exception for U.S. citizenship verification. Through the Agency’s corrective action plan resulting from ACF’s monitoring visit, citizenship was verified back to 10/1/2023 (for FFY2024), however the Agency did not verify citizenship for participants receiving benefits prior to this date. Cause: The Agency’s procedures and controls were not sufficient to ensure that U.S. citizenship was verified for participants who were otherwise eligible under the program because they were in need of or receiving protective services. When the exception was noted by ACF, the Agency verified citizenship for FFY2024, but did not verify citizenship for participants receiving benefits prior to this date. Effect Failure to verify U.S. citizenship for participants could result in ineligible participants receiving benefits under the program. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it verifies U.S. citizenship for all participants and confirm that only eligible participants receive benefits under the program. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility by checking electronic data sources in accordance with federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). Per 42 CFR §435.915(b) and the Vermont State Plan, eligibility for Medicaid is effective on the first day of a month if an individual was eligible at any time during that month. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) incorrectly discontinued benefits for a Medicaid participant during the month in which eligibility was renewed. Context: For one of sixty participants selected for testing, the Agency performed a renewal of Medicaid benefits during the month of October and discontinued benefits for that month instead of backdating the claim to the beginning of the month. Cause: The Agency did not adequately follow procedures regarding eligibility renewals in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect A participant’s benefits were improperly discontinued for one month. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid eligibility renewals to ensure that benefits for eligible participants are not discontinued. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-023 Prior Year Finding: 2023-030 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: A subaward was not reported to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Thirty subawards totaling $6,709,156 were selected for testing, including twenty-eight initial subawards and two subaward amendments. We noted the following exception: • One of thirty subawards was not reported. The subaward was issued 9/26/2023 but it was not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exception noted occurred prior to the full implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-024 Prior Year Finding: 2023-031 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2025) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support a provider’s compliance with the prescribed health and safety standards. The provider health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Context: For one of sixty providers selected for testing, documentation was incomplete to support that the provider was in good tax standing. The provider’s tax standing was verified by the Agency, but the letter was not signed by the Vermont Tax Department Commissioner and uploaded to the PMM as required. As part of a prior year Corrective Action Plan (CAP), a process was developed to require letters of good standing be uploaded to the provider file in the PMM but when this provider’s tax standing was verified, the CAP had not been fully implemented. Cause: The Agency’s 3rd-Party provider did not consistently maintain verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been fully implemented. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency fully implement its CAP to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Utilization Control Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to properly document closure of a case referred to the Medicaid Fraud and Residential Abuse Unit (MFRAU) by the Special Investigations Unit (SIU). Context: For one of twenty-eight cases selected for testing, the SIU opened the case in FY2016, marked it as a high priority, and referred it to the MFRAU. The MFRAU closed the case in FY2018, however, the closure was not properly documented nor communicated. In FY2024 the case was classified by the SIU as administratively closed due to its age, but the results of the review and closure were not documented. Cause: The Agency did not adequately follow procedures regarding utilization control case review and closure in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect Failure to properly document and promptly close cases could allow unnecessary utilization of care and services to continue undetected and result in unnecessary or inappropriate use of Medicaid services. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid utilization control to ensure that cases are closed timely and that documentation of the results of reviews are maintained and communicated. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility by checking electronic data sources in accordance with federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). Per 42 CFR §435.915(b) and the Vermont State Plan, eligibility for Medicaid is effective on the first day of a month if an individual was eligible at any time during that month. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) incorrectly discontinued benefits for a Medicaid participant during the month in which eligibility was renewed. Context: For one of sixty participants selected for testing, the Agency performed a renewal of Medicaid benefits during the month of October and discontinued benefits for that month instead of backdating the claim to the beginning of the month. Cause: The Agency did not adequately follow procedures regarding eligibility renewals in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect A participant’s benefits were improperly discontinued for one month. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid eligibility renewals to ensure that benefits for eligible participants are not discontinued. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-023 Prior Year Finding: 2023-030 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: A subaward was not reported to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Thirty subawards totaling $6,709,156 were selected for testing, including twenty-eight initial subawards and two subaward amendments. We noted the following exception: • One of thirty subawards was not reported. The subaward was issued 9/26/2023 but it was not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exception noted occurred prior to the full implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-024 Prior Year Finding: 2023-031 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2025) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support a provider’s compliance with the prescribed health and safety standards. The provider health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Context: For one of sixty providers selected for testing, documentation was incomplete to support that the provider was in good tax standing. The provider’s tax standing was verified by the Agency, but the letter was not signed by the Vermont Tax Department Commissioner and uploaded to the PMM as required. As part of a prior year Corrective Action Plan (CAP), a process was developed to require letters of good standing be uploaded to the provider file in the PMM but when this provider’s tax standing was verified, the CAP had not been fully implemented. Cause: The Agency’s 3rd-Party provider did not consistently maintain verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been fully implemented. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency fully implement its CAP to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Utilization Control Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to properly document closure of a case referred to the Medicaid Fraud and Residential Abuse Unit (MFRAU) by the Special Investigations Unit (SIU). Context: For one of twenty-eight cases selected for testing, the SIU opened the case in FY2016, marked it as a high priority, and referred it to the MFRAU. The MFRAU closed the case in FY2018, however, the closure was not properly documented nor communicated. In FY2024 the case was classified by the SIU as administratively closed due to its age, but the results of the review and closure were not documented. Cause: The Agency did not adequately follow procedures regarding utilization control case review and closure in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect Failure to properly document and promptly close cases could allow unnecessary utilization of care and services to continue undetected and result in unnecessary or inappropriate use of Medicaid services. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid utilization control to ensure that cases are closed timely and that documentation of the results of reviews are maintained and communicated. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility by checking electronic data sources in accordance with federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). Per 42 CFR §435.915(b) and the Vermont State Plan, eligibility for Medicaid is effective on the first day of a month if an individual was eligible at any time during that month. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) incorrectly discontinued benefits for a Medicaid participant during the month in which eligibility was renewed. Context: For one of sixty participants selected for testing, the Agency performed a renewal of Medicaid benefits during the month of October and discontinued benefits for that month instead of backdating the claim to the beginning of the month. Cause: The Agency did not adequately follow procedures regarding eligibility renewals in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect A participant’s benefits were improperly discontinued for one month. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid eligibility renewals to ensure that benefits for eligible participants are not discontinued. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-023 Prior Year Finding: 2023-030 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: A subaward was not reported to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Thirty subawards totaling $6,709,156 were selected for testing, including twenty-eight initial subawards and two subaward amendments. We noted the following exception: • One of thirty subawards was not reported. The subaward was issued 9/26/2023 but it was not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exception noted occurred prior to the full implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-024 Prior Year Finding: 2023-031 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2025) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support a provider’s compliance with the prescribed health and safety standards. The provider health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Context: For one of sixty providers selected for testing, documentation was incomplete to support that the provider was in good tax standing. The provider’s tax standing was verified by the Agency, but the letter was not signed by the Vermont Tax Department Commissioner and uploaded to the PMM as required. As part of a prior year Corrective Action Plan (CAP), a process was developed to require letters of good standing be uploaded to the provider file in the PMM but when this provider’s tax standing was verified, the CAP had not been fully implemented. Cause: The Agency’s 3rd-Party provider did not consistently maintain verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been fully implemented. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency fully implement its CAP to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Utilization Control Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to properly document closure of a case referred to the Medicaid Fraud and Residential Abuse Unit (MFRAU) by the Special Investigations Unit (SIU). Context: For one of twenty-eight cases selected for testing, the SIU opened the case in FY2016, marked it as a high priority, and referred it to the MFRAU. The MFRAU closed the case in FY2018, however, the closure was not properly documented nor communicated. In FY2024 the case was classified by the SIU as administratively closed due to its age, but the results of the review and closure were not documented. Cause: The Agency did not adequately follow procedures regarding utilization control case review and closure in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect Failure to properly document and promptly close cases could allow unnecessary utilization of care and services to continue undetected and result in unnecessary or inappropriate use of Medicaid services. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid utilization control to ensure that cases are closed timely and that documentation of the results of reviews are maintained and communicated. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-028 Prior Year Finding: 2023-034 Federal Agency: U.S. Department of Homeland Security State Agency: Department of Public Safety Federal Program: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4474-DR-VT (2020), FEMA-4532-DR-VT (2020), FEMA-4621-DR-VT (2021), FEMA-4695-DR-VT (2023), FEMA-4720-DR-VT (2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Safety (Department) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: This is a repeat finding from the prior year and auditors note that progress has been made, though the corrective action plan from the prior year has not been fully implemented. Ninety-six subawards were selected for testing, including thirty-two which were issued in a prior year and sixty-four which were issued during FY2024. The following exceptions were noted: • 24 of 96 subawards were not reported to FSRS, totaling $17,306,440. o Of the exceptions noted, FY2024 subawards not reported were 13 of 64 and totaling $7,627,387 of $17,741,626. • 5 of 96 subawards were not reported timely to FSRS, totaling $10,937,684. o Of the exceptions noted, FY2024 subawards reported late were 4 of 64 and totaling $9,609,432 of $17,741,626. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subawards were reported timely or accurately to FSRS. Internal controls did not prevent or detect the errors. The corrective action plan from the prior year has not been fully implemented. Effect: The Department’s subaward reporting to FSRS was incomplete and inaccurate. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should continue to improve its procedures and internal controls to ensure that all required subawards and subaward modifications are reported accurately and timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: Management agrees with the finding.