Audit 352774

Reference Number: 2023-002 Category of Finding: Procurement and Suspension and Debarment Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 10.557 Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Federal Award Numbers and Years: 202222W100347, 2022 202221W100347, 2022 202222W100647, 2022 202221W100647, 2022 202222W100247, 2022 202323W100247, 2023 202322W100347, 2023 202323W100347, 2023 202322W100647, 2023 202323W100647, 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Government-Wide Guidance for Grants and Agreements. Part 180 – OMB Guidelines to Agencies on Government-Wide Debarment and Suspension (Non-procurement). Subpart C – Responsibilities of Participants Regarding Transactions Doing Business With Other Persons §180.300 (2 CFR 180.300): When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You may do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or a condition to the covered transactions with that person. Condition We noted that three out of the twelve vendor contract agreements reviewed did not include a suspension and debarment certification clause indicating the contractor was not suspended or debarred from participation in federally funded contracts. There was no other documentation available to demonstrate that the verification of suspension and debarment was performed prior to entering into the covered transactions. Based on the subsequent review of the System for Award Management (SAM) exclusions, these contractors were not suspended or debarred. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The WIC program personnel responsible for administering these federal funds were not fully aware of the suspension and debarment requirements. Additionally, there were no formal procedures in place to consistently document and retain evidence of suspension and debarment status checks for vendors. Effect Failure to verify suspension and debarment results in noncompliance with 2 CFR §180.300, as well as a risk that federal funds could be used to pay vendors that are suspended or debarred. Questioned Costs No questioned costs were identified. Context The federal funds disbursed to vendors for the fiscal year ended June 30, 2023 totaled $752,214,598. Three of the twelve samples for the Special Supplemental Nutrition Program for Women, Infants, and Children program did not have evidence that verification of suspension and debarment was performed prior to entering into the covered transaction or include a clause or condition to the covered transaction in the agreement. Total disbursements made associated with these vendors to totaled $2,185,950 for the fiscal year ended June 30, 2023. Recommendation Public Health should review and strengthen its procedures for verifying the suspension and debarment status of vendors before entering into any agreement involving federal funds and ensure that the verification documentation is maintained. Alternatively, incorporate a clause in vendor contracts requiring vendors to certify their suspension or debarment status. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-003 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: Unemployment Insurance COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 22 – Social Security, Division 1 – Employment Development Department, Subdivision 1 – Director of Employment Development, Division – 1 Unemployment and Disability Compensation, Part 1 – Unemployment Compensation, Chapter 5 Unemployment Compensation Benefits, Article 1 – Eligibility and Disqualifications §1256, §1257 and §1326 Eligibility and Disqualifications, §1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Eligibility and Disqualifications, §1257 California Code of Regulations: (a) An individual is also disqualified for unemployment compensation benefits if: He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division. Continued Claim for Unemployment Benefits – Filing and Contents, §1326-6 California Code of Regulations: (c) The claimant shall, to maintain his or her eligibility to file continued claims during a continuous period of unemployment, file continued claims at intervals of not more than two weeks, or such other interval as the department shall require, unless he or she shows good cause for his or her delay in filing his or her continued claim. Condition In EDD’s administration of the Unemployment Insurance program, $198,804,488 in benefit payments were estimated by EDD to be potentially ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was based on data parameters to identify claimants who received benefits that matched ineligible criteria for identity or eligibility fraud due to misrepresented information. The Unemployment Insurance Branch of EDD reviews unemployment insurance claims of claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 138 unemployment insurance benefit payments tested, there was 1 claimant receiving benefits, whose reasons for involuntary separation indicated separation was due to misconduct, which was incorrectly categorized as eligible by EDD. Identification as a Repeat Finding Finding 2022-006 was reported in the immediate prior year. Cause EDD has acknowledged that the adjudication process for potential eligibility issues, which includes work separation, was inadequately or not timely performed due to the significant increase in claims resulting from the COVID-19 pandemic. Effect By EDD not performing timely and adequate review for potential eligibility issues, benefit payments were made to ineligible claimants. Questioned Costs Known questioned costs for the one claimant identified was paid unemployment compensation of $6,975 under Unemployment Insurance Program. Context Benefits paid to claimants under the Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $5,383,169,224. The sample was not a statistically valid sample. Recommendation EDD should enhance its adjudication process to support proper eligibility determinations and decrease improper payments to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-004 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 – Disaster Unemployment Assistance, §625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications, (b) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of § 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (e) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual’s statement of employment or self-employment preceding the individual’s unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based on the individual’s statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual’s statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately redetermine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Out of 138 PUA benefit payments tested, there were 91 claimants with verification issues (either wages, self-employment, or both). Identification as a Repeat Finding Finding 2022-005 was reported in the immediate prior year. Cause EDD did not perform timely wage and employment verifications of the claimants due to the significant increase in claims resulting from the COVID-19 pandemic. Despite ongoing efforts to address the backlog of claims, EDD was approved by the Department of Labor (DOL) on May 21, 2024 under Unemployment Insurance Program Letter No. 05-24, to discontinue pursuing claims older than one year that were not a result of fraud, misrepresentation or willful nondisclosure. Effect EDD did not have adequate oversight controls to ensure that the claimant’s wages were timely and properly reviewed and approved. Accordingly, there was an increased risk for the occurrence of overpayment in benefits being provided to individuals, which was not timely prevented or detected. Questioned Costs Known questioned costs for the 91 claimants were $1,708,094. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $306,150,759, which was offset by prior years’ ineligible benefit payments of $90,034,050 and return of funds from EDD debit cards that were not activated within 12 months of card issuance of $620,694,399. The sample was not a statistically valid sample. Recommendation EDD should ensure that proper verification procedures are in place to minimize the number of claimants with wage and/or employment verification issues. Effective and robust verification procedures should assist EDD in processing unemployment benefits only to eligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-005 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 – Disaster Unemployment Assistance, §625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary’s “Standard for Fraud and Overpayment Detection,” Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Title 15 – Commerce and Trade, Chapter 116, Coronavirus Economic (CARES Act) Subchapter II – Unemployment Insurance Provisions, §9023 Emergency Increase in Unemployment Compensation Benefits (f) Fraud and Overpayments: (1) In General – If an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact, and as a result of such false statement or representation or of such nondisclosure such individual has received an amount of Federal Pandemic Unemployment Compensation or Mixed Earner Unemployment Compensation to which such individual was not entitled, such individual— 1. shall be ineligible for further Federal Pandemic Unemployment Compensation Mixed Earner Unemployment Compensation in accordance with the provisions of the applicable State unemployment compensation law relating to fraud in connection with a claim for unemployment compensation. Condition During the fiscal year ended June 30, 2023, EDD continued its administration of the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA benefits were paid additional benefits under the Federal Pandemic Unemployment Compensation program (FPUC). In EDD’s administration of the PUA and FPUC programs, $90,034,050 in benefit payments were estimated to be ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched ineligible criteria for identity fraud or eligibility fraud for misrepresented information. Out of 138 PUA benefit payments tested, there was 1 benefit payment to a claimant determined to be ineligible whose identity was not sufficiently verified. Identification as a Repeat Finding Finding 2022-004 was reported in the immediate prior year. Cause EDD has acknowledged that there was inadequate or untimely review of claimant due to the significant increase in claims resulting from the COVID-19 pandemic. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to ineligible claimants. Accordingly, benefit payments were made to claimants who were not eligible. Questioned Costs Known questioned costs were $8,502 for PUA and $7,200 for FPUC. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $306,150,759 which was offset by prior years’ ineligible benefit payments of $90,034,050 and return of funds from EDD debit cards that were not activated within 12 months of card issuance of $620,694,399. The sample was not a statistically valid sample. Recommendation EDD should continue to strengthen controls, such as database identification cross-matches, ID.me verification, partnerships with law enforcement and Thompson Reuters, as well as system enhancements to mitigate the potential of further employment benefit fraud. Such improvements in internal controls should improve EDD’s ability to timely prevent and detect unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-003 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: Unemployment Insurance COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 22 – Social Security, Division 1 – Employment Development Department, Subdivision 1 – Director of Employment Development, Division – 1 Unemployment and Disability Compensation, Part 1 – Unemployment Compensation, Chapter 5 Unemployment Compensation Benefits, Article 1 – Eligibility and Disqualifications §1256, §1257 and §1326 Eligibility and Disqualifications, §1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Eligibility and Disqualifications, §1257 California Code of Regulations: (a) An individual is also disqualified for unemployment compensation benefits if: He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division. Continued Claim for Unemployment Benefits – Filing and Contents, §1326-6 California Code of Regulations: (c) The claimant shall, to maintain his or her eligibility to file continued claims during a continuous period of unemployment, file continued claims at intervals of not more than two weeks, or such other interval as the department shall require, unless he or she shows good cause for his or her delay in filing his or her continued claim. Condition In EDD’s administration of the Unemployment Insurance program, $198,804,488 in benefit payments were estimated by EDD to be potentially ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was based on data parameters to identify claimants who received benefits that matched ineligible criteria for identity or eligibility fraud due to misrepresented information. The Unemployment Insurance Branch of EDD reviews unemployment insurance claims of claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 138 unemployment insurance benefit payments tested, there was 1 claimant receiving benefits, whose reasons for involuntary separation indicated separation was due to misconduct, which was incorrectly categorized as eligible by EDD. Identification as a Repeat Finding Finding 2022-006 was reported in the immediate prior year. Cause EDD has acknowledged that the adjudication process for potential eligibility issues, which includes work separation, was inadequately or not timely performed due to the significant increase in claims resulting from the COVID-19 pandemic. Effect By EDD not performing timely and adequate review for potential eligibility issues, benefit payments were made to ineligible claimants. Questioned Costs Known questioned costs for the one claimant identified was paid unemployment compensation of $6,975 under Unemployment Insurance Program. Context Benefits paid to claimants under the Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $5,383,169,224. The sample was not a statistically valid sample. Recommendation EDD should enhance its adjudication process to support proper eligibility determinations and decrease improper payments to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-004 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 – Disaster Unemployment Assistance, §625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications, (b) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of § 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (e) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual’s statement of employment or self-employment preceding the individual’s unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based on the individual’s statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual’s statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately redetermine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Out of 138 PUA benefit payments tested, there were 91 claimants with verification issues (either wages, self-employment, or both). Identification as a Repeat Finding Finding 2022-005 was reported in the immediate prior year. Cause EDD did not perform timely wage and employment verifications of the claimants due to the significant increase in claims resulting from the COVID-19 pandemic. Despite ongoing efforts to address the backlog of claims, EDD was approved by the Department of Labor (DOL) on May 21, 2024 under Unemployment Insurance Program Letter No. 05-24, to discontinue pursuing claims older than one year that were not a result of fraud, misrepresentation or willful nondisclosure. Effect EDD did not have adequate oversight controls to ensure that the claimant’s wages were timely and properly reviewed and approved. Accordingly, there was an increased risk for the occurrence of overpayment in benefits being provided to individuals, which was not timely prevented or detected. Questioned Costs Known questioned costs for the 91 claimants were $1,708,094. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $306,150,759, which was offset by prior years’ ineligible benefit payments of $90,034,050 and return of funds from EDD debit cards that were not activated within 12 months of card issuance of $620,694,399. The sample was not a statistically valid sample. Recommendation EDD should ensure that proper verification procedures are in place to minimize the number of claimants with wage and/or employment verification issues. Effective and robust verification procedures should assist EDD in processing unemployment benefits only to eligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-005 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 – Disaster Unemployment Assistance, §625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary’s “Standard for Fraud and Overpayment Detection,” Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Title 15 – Commerce and Trade, Chapter 116, Coronavirus Economic (CARES Act) Subchapter II – Unemployment Insurance Provisions, §9023 Emergency Increase in Unemployment Compensation Benefits (f) Fraud and Overpayments: (1) In General – If an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact, and as a result of such false statement or representation or of such nondisclosure such individual has received an amount of Federal Pandemic Unemployment Compensation or Mixed Earner Unemployment Compensation to which such individual was not entitled, such individual— 1. shall be ineligible for further Federal Pandemic Unemployment Compensation Mixed Earner Unemployment Compensation in accordance with the provisions of the applicable State unemployment compensation law relating to fraud in connection with a claim for unemployment compensation. Condition During the fiscal year ended June 30, 2023, EDD continued its administration of the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA benefits were paid additional benefits under the Federal Pandemic Unemployment Compensation program (FPUC). In EDD’s administration of the PUA and FPUC programs, $90,034,050 in benefit payments were estimated to be ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched ineligible criteria for identity fraud or eligibility fraud for misrepresented information. Out of 138 PUA benefit payments tested, there was 1 benefit payment to a claimant determined to be ineligible whose identity was not sufficiently verified. Identification as a Repeat Finding Finding 2022-004 was reported in the immediate prior year. Cause EDD has acknowledged that there was inadequate or untimely review of claimant due to the significant increase in claims resulting from the COVID-19 pandemic. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to ineligible claimants. Accordingly, benefit payments were made to claimants who were not eligible. Questioned Costs Known questioned costs were $8,502 for PUA and $7,200 for FPUC. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $306,150,759 which was offset by prior years’ ineligible benefit payments of $90,034,050 and return of funds from EDD debit cards that were not activated within 12 months of card issuance of $620,694,399. The sample was not a statistically valid sample. Recommendation EDD should continue to strengthen controls, such as database identification cross-matches, ID.me verification, partnerships with law enforcement and Thompson Reuters, as well as system enhancements to mitigate the potential of further employment benefit fraud. Such improvements in internal controls should improve EDD’s ability to timely prevent and detect unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-006 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Transportation Assistance Listing Number: 20.205 Federal Program Title: Highway Planning and Construction Federal Award Numbers and Years: Q101310; 2023 Q101403; 2023 7500257; 2023 P020177; 2023 8801073; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management §200.322 Requirements for pass-through entities (2 CFR 200.332): (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: 1. Federal award identification. i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient’s unique entity identifier; Federal Award Identification Number (FAIN); iii. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; iv. Subaward Period of Performance Start and End Date; v. Subaward Budget Period Start and End Date; vi. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; vii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; viii. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; ix. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); x. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xi. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xii. Identification of whether the award is R&D; and xiii. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. 2. All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; 3. Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; 4. i. An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the pass-through entity must determine the appropriate rate in collaboration with the subrecipient, which is either: 1. The negotiated indirect cost rate between the pass-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass-through entity is not required to collect information justifying this rate, but may elect to do so; 2. The de minimis indirect cost rate. ii. The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). 5. A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient’s records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and 6. Appropriate terms and conditions concerning closeout of the subaward. (b) Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. Condition The California Department of Transportation (Caltrans) did not clearly identify subaward agreements made to subrecipients as subawards and did not include all required elements for 5 of 40 subrecipients sampled. Additionally, the monitoring of the 5 of 40 sampled subrecipients was not sufficient to detect whether the subrecipients’ expenditures were properly reported on the respective subrecipients’ schedules of expenditures of federal awards. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Due to the decentralized administration of federal-aid highway projects, not all subaward agreements are administered in a consistent manner throughout various divisions and district offices. Effect Inadequate subaward communication may result in subrecipients being unaware of all federal laws, statutes and regulations that apply to the funding received and potentially expending the funds in an unallowable manner. Additionally, subrecipients may fail to report the expenditures made pursuant to the subawards of their schedule of expenditures of federal awards. Questioned Costs No questioned costs were identified. Context Expenditures passed to subrecipients totaled $1,222,104,172. Sampled expenditures totaled $14,694,125 and $670,937 of the total sampled expenditures related to the exceptions identified. Recommendation Caltrans should develop and implement a consistent policy and process for all divisions and district offices to use in making and monitoring subawards under the highway planning and construction program to ensure that all required subaward information is communicated to subrecipients at the time of the award and the federal funds disbursed to subrecipients are adequately monitored. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-006 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Transportation Assistance Listing Number: 20.205 Federal Program Title: Highway Planning and Construction Federal Award Numbers and Years: Q101310; 2023 Q101403; 2023 7500257; 2023 P020177; 2023 8801073; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management §200.322 Requirements for pass-through entities (2 CFR 200.332): (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: 1. Federal award identification. i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient’s unique entity identifier; Federal Award Identification Number (FAIN); iii. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; iv. Subaward Period of Performance Start and End Date; v. Subaward Budget Period Start and End Date; vi. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; vii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; viii. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; ix. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); x. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xi. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xii. Identification of whether the award is R&D; and xiii. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. 2. All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; 3. Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; 4. i. An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the pass-through entity must determine the appropriate rate in collaboration with the subrecipient, which is either: 1. The negotiated indirect cost rate between the pass-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass-through entity is not required to collect information justifying this rate, but may elect to do so; 2. The de minimis indirect cost rate. ii. The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). 5. A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient’s records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and 6. Appropriate terms and conditions concerning closeout of the subaward. (b) Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. Condition The California Department of Transportation (Caltrans) did not clearly identify subaward agreements made to subrecipients as subawards and did not include all required elements for 5 of 40 subrecipients sampled. Additionally, the monitoring of the 5 of 40 sampled subrecipients was not sufficient to detect whether the subrecipients’ expenditures were properly reported on the respective subrecipients’ schedules of expenditures of federal awards. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Due to the decentralized administration of federal-aid highway projects, not all subaward agreements are administered in a consistent manner throughout various divisions and district offices. Effect Inadequate subaward communication may result in subrecipients being unaware of all federal laws, statutes and regulations that apply to the funding received and potentially expending the funds in an unallowable manner. Additionally, subrecipients may fail to report the expenditures made pursuant to the subawards of their schedule of expenditures of federal awards. Questioned Costs No questioned costs were identified. Context Expenditures passed to subrecipients totaled $1,222,104,172. Sampled expenditures totaled $14,694,125 and $670,937 of the total sampled expenditures related to the exceptions identified. Recommendation Caltrans should develop and implement a consistent policy and process for all divisions and district offices to use in making and monitoring subawards under the highway planning and construction program to ensure that all required subaward information is communicated to subrecipients at the time of the award and the federal funds disbursed to subrecipients are adequately monitored. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-007 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Community Colleges Chancellor’s Office Assistance Listing Number: 21.027 Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds Federal Award Numbers and Years: N/A; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (c) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management §200.322 Requirements for pass-through entities (2 CFR 200.332): (d) Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. Condition The California Community Colleges Chancellor’s Office (Chancellor’s Office) did not assess each subrecipients’ risk of potential noncompliance with the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) subaward federal statutes, regulations and terms and conditions and did not adequately monitor its subrecipients (community colleges) to ensure that the community colleges complied with federal statutes, regulations, and terms and conditions of the SLFRF subaward. The SLFRF subawards included specific requirements for eligibility of students receiving SLFRF-funded emergency financial aid, which included a requirement to request eligibility certifications from students, determine if any students that received emergency financial aid were ineligible and instructions to make necessary general ledger entries to ensure any ineligible students’ financial aid was removed from the SLFRF specific funding and assigned to a nonfederal source. The Chancellor’s Office did not request or inspect any documentation from the community colleges to verify that required eligibility certifications and/or necessary general ledger entries were made by the community colleges. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The Chancellor’s Office did not establish sufficient procedures to assess each community college’s risk, conduct reviews of those community colleges that would be higher risk and validate that the community college expended the SLFRF subaward in accordance with federal statutes, regulations and terms and conditions. Effect Inadequate monitoring of subrecipients may result in funds being expended for ineligible purposes, which may not be detected and corrected in a timely manner. Questioned Costs No questioned costs were identified. Context Expenditures passed to subrecipients totaled $1,218,447,467, of which $150,000,000 was passed through by the Chancellor’s Office. Recommendation The Chancellor’s Office should develop and implement detailed subrecipient monitoring procedures, to include assessing each community college’s risk of noncompliance; conducting a review of supporting documents for those community colleges identified by the risk assessment to be at risk of noncompliance as defined by the Chancellor’s Office’s monitoring procedures; and ensuring corrective action is taken for any deficiencies identified. Regular follow-ups and documented communication efforts should be part of this process to ensure effective oversight of the SLFRF subawards. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-008 Category of Finding: Procurement and Suspension and Debarment Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.323 Federal Program Title: Epidemiology and Laboratory Capacity for Program Infectious Diseases (ELC) Federal Award Numbers and Years: NU50CK000539; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Government-Wide Guidance for Grants and Agreements. Part 180 – OMB Guidelines to Agencies on Government-Wide Debarment and Suspension (Non-procurement). Subpart C – Responsibilities of Participants Regarding Transactions Doing Business With Other Persons §180.300 (2 CFR 180.300): When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You may do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or a condition to the covered transactions with that person. Condition We noted that ten out of the ten vendor contract agreements reviewed did not include a suspension and debarment certification clause indicating the contractor was not suspended or debarred from participation in federally funded contracts. There was no other documentation available to demonstrate that the verification of suspension and debarment was performed prior to entering into the covered transactions. Based on the subsequent review of the System for Award Management (SAM) exclusions, these contractors were not suspended or debarred. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The ELC program personnel responsible for administering these federal funds were unaware of the suspension and debarment requirements. Effect Failure to verify suspension and debarment results in noncompliance with 2 CFR §180.300, as well as a risk that federal funds could be used to pay vendors that are suspended or debarred. Questioned Costs No questioned costs were identified. Context The federal funds disbursed to vendors for the fiscal year ended June 30, 2023 totaled $11,816,380. Ten of ten samples for the Epidemiology and Laboratory Capacity for Program Infectious Diseases program did not have evidence that verification of suspension and debarment was performed prior to entering into the covered transaction or include a clause or condition to the covered transaction in the agreement. Total disbursements made associated with these vendors totaled $7,567,331 for the fiscal year ended June 30, 2023. Recommendation Public Health should review and strengthen its procedures for verifying the suspension and debarment status of vendors before entering into any agreement involving federal funds and ensure that the verification documentation is maintained. Alternatively, incorporate a clause in vendor contracts requiring vendors to certify their suspension or debarment status. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-009 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.323 Federal Program Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Federal Award Number and Year: NU50CK000539; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (e) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. §200.332 Requirements for pass-through entities (2 CFR 200.332): All pass-through entities must: (a) Verify that the subrecipient is not excluded or disqualified in accordance with §180.300. Verification methods are provided in §180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient’s unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414. (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraphs (f) of this section. When evaluating a subrecipient’s risk, a pass-through entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards: (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with Subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving cross-cutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the passthrough entity may rely on the subrecipient’s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section §200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. (g) Consider whether the results of the subrecipient’s audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. Condition Public Health did not establish a formal risk assessment process over its subrecipients of federal awards by which to determine the frequency and extent of subrecipient monitoring to be performed. While Public Health received reimbursement invoices from subrecipients, there did not appear to be other financial or programmatic monitoring to verify subrecipients complied with applicable requirements. In addition, Public Health did not obtain supporting documentation for any expenditures invoiced by the subrecipients. Follow-up monitoring for subrecipients with no single audit reports did not appear to be performed. On-site monitoring visits were not completed. Public Health was unable to provide evidence that suspension and debarment status of subrecipients was checked prior to entering into subaward. Public Health used a Department Allocation Letter (DAL) for the COVID-19 program instead of an agreement or contract for the subaward to subrecipients. Certain required information for the subaward federal award information such as Assistance Listings number and Title and Federal Award Identification Number (FAIN) were not clearly identified in the DAL. Identification as a Repeat Finding Finding 2022-011 was reported in the immediate prior year. Cause Procedures to perform the required subrecipient monitoring were not established nor did Public Health perform an appropriate level of monitoring. Effect By not properly evaluating the risk of noncompliance, Public Health may inadvertently award grant funds to subrecipients who lack the necessary mechanisms or understanding to comply with federal statutes. This increases the likelihood of noncompliance arising during the performance of the grant-funded activities. Furthermore, failure to obtain and review single audit reports increases the risk of not properly identifying subrecipient program control weaknesses, noncompliance and performing sufficient follow-up on any subrecipient corrective action. Questioned Costs No questioned costs were identified. Context Disbursements to subrecipients for the ELC totaled $282,954,398, or 49% of total reported program expenditures. Recommendation Public Health should establish and document formal procedures for conducting risk assessments of subrecipient funding, including criteria for evaluating organizational capacity, financial stability, compliance history, and programmatic capabilities. Public Health should also develop and implement procedures outlining the process for obtaining single audit reports from subrecipients. Furthermore, a monitoring mechanism should be implemented to track compliance with the single audit mandate among subrecipients, including regular follow-ups and documentation of communication efforts. Public Health should ensure every subaward includes all requirements imposed on the subrecipient so that the federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the federal award. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-015 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2305CA5021; 2023 2305CA3002; 2023 2205CA5022; 2022 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code – WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year. §14713: (b) If the department determines that a mental health plan has failed to comply with the requirements of Chapter 7 (commencing with Section 14000), Chapter 8 (commencing with Section 14200), Chapter 8.8 (commencing with Section 14600), or this chapter, the department may impose sanctions and plans of correction pursuant to Section 14197.7. Condition Eighteen of 56 contractor counties of Short-Doyle funding were tested and seventeen had not submitted their cost reports by the December 31 due date. Five of the seventeen contractor counties have not submitted their cost reports for fiscal year 2021-22 (more than 12 months late) and thirteen of the seventeen contractor counties have subsequently submitted their cost reports for fiscal year 2021-22. Although the Mental Health Division of Health Care Services did take the required action of notifying the eighteen contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2022-008 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Medical Assistance Program to the eighteen contractor counties totaled $1,943,410,893, the seventeen noncompliant contractor counties totaled $1,871,058,835, and all 58 contractor counties totaled $2,338,031,915. For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven contractor counties totaled $94,521,685, the six noncompliant contractor counties totaled $88,716,942, and all 58 contractor counties totaled $191,348,628. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-015 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2305CA5021; 2023 2305CA3002; 2023 2205CA5022; 2022 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code – WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year. §14713: (b) If the department determines that a mental health plan has failed to comply with the requirements of Chapter 7 (commencing with Section 14000), Chapter 8 (commencing with Section 14200), Chapter 8.8 (commencing with Section 14600), or this chapter, the department may impose sanctions and plans of correction pursuant to Section 14197.7. Condition Eighteen of 56 contractor counties of Short-Doyle funding were tested and seventeen had not submitted their cost reports by the December 31 due date. Five of the seventeen contractor counties have not submitted their cost reports for fiscal year 2021-22 (more than 12 months late) and thirteen of the seventeen contractor counties have subsequently submitted their cost reports for fiscal year 2021-22. Although the Mental Health Division of Health Care Services did take the required action of notifying the eighteen contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2022-008 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Medical Assistance Program to the eighteen contractor counties totaled $1,943,410,893, the seventeen noncompliant contractor counties totaled $1,871,058,835, and all 58 contractor counties totaled $2,338,031,915. For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven contractor counties totaled $94,521,685, the six noncompliant contractor counties totaled $88,716,942, and all 58 contractor counties totaled $191,348,628. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-017 Category of Finding: Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.917 Federal Program Title: HIV Care Formula Grants COVID-19 HIV Care Formula Grants Federal Award Numbers and Years: 2 X07HA12778-14-00; 2022 6 X07HA12778-14-01; 2022 6 X07HA12778-14-02; 2023 6 X07HA12778-14-03; 2023 6 X07HA12778-14-04; 2023 6 X07HA12778-14-05; 2023 5 X07HA12778-15-00; 2023 6 X07HA12778-15-01; 2023 6 X07HA12778-15-02; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – The Public Health and Welfare. Chapter 6A – Public Health Service. Subchapter XXIV – HIV Health Care Services Program. Part B – Care Grant Program. Subpart I – General Grant Provisions. Section 300ff-26 – Provision of Treatments: (a) In general A State shall use a portion of the amounts provided under a grant awarded under section 300ff–21 of this title to establish a program under section 300ff–22(b)(3)(B) of this title to provide therapeutics to treat HIV/AIDS or prevent the serious deterioration of health arising from HIV/AIDS in eligible individuals, including measures for the prevention and treatment of opportunistic infections. (b) Eligible individual To be eligible to receive assistance from a State under this section an individual shall: (1) Have a medical diagnosis of HIV/AIDS; and (2) Be a low-income individual, as defined by the State. California State AIDS Drug Assistance Program Guidelines January 2022: (1.1) AIDS Drug Assistance Program (ADAP) Eligibility Criteria: To be eligible for the ADAP program, a client must: • Have a positive HIV/AIDS diagnosis. • Be at least 18 years old. • Be a resident of California. • Have an annual Modified Adjusted Gross Income (MAGI) that does not exceed 500 percent Federal Poverty Level (FPL) based on household size and income. • Not be fully covered by Medi-Cal or any other third-party payers (an entity that reimburses and manages health care expenses such as private insurance or governmental agencies, employers, etc.). Health Resources and Services Administration, Policy Clarification Notice 15-04 (Revised 1/11/2019): The Ryan White HIV/AIDS Program (RWHAP) legislation requires that rebates collected on ADAP medication purchases be applied to the RWHAP Part B Program with a priority, but not a requirement, that the rebates be placed back into ADAP. Although ADAP rebates are neither program income nor refunds, they are subject to the same regulatory provision regarding expenditure. These rebates must be used for the statutorily permitted purposes under the RWHAP Part B Program, which are limited to core medical services including ADAP, support services, clinical quality management, and administrative expenses (including planning and evaluation) as part of a comprehensive system of care for low-income individuals living with HIV. Condition All applications must be reviewed internally by ADAP staff via an electronic secondary review process to confirm eligibility; however, one of sixty applications was not reviewed by ADAP staff. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause There was a backlog in the secondary review of applications due to staffing issues in the ADAP Branch. Effect Public Health did not have appropriate oversight controls to ensure that the applicant’s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals that may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable because benefit costs were not tracked by individual participants. Context Pharmacy benefits management services are provided by a contractor who received administrative fees and reimbursements for prescription drug costs to program participants. Payments to the contractor totaled $106,505,302 for approximately 24,000 program participants for the fiscal year ended June 30, 2023. The sample was not a statistically valid sample. Recommendation The ADAP Branch should continue to monitor compliance with its policies to ensure secondary reviews of ADAP applications follow the established guidelines. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-017 Category of Finding: Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.917 Federal Program Title: HIV Care Formula Grants COVID-19 HIV Care Formula Grants Federal Award Numbers and Years: 2 X07HA12778-14-00; 2022 6 X07HA12778-14-01; 2022 6 X07HA12778-14-02; 2023 6 X07HA12778-14-03; 2023 6 X07HA12778-14-04; 2023 6 X07HA12778-14-05; 2023 5 X07HA12778-15-00; 2023 6 X07HA12778-15-01; 2023 6 X07HA12778-15-02; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – The Public Health and Welfare. Chapter 6A – Public Health Service. Subchapter XXIV – HIV Health Care Services Program. Part B – Care Grant Program. Subpart I – General Grant Provisions. Section 300ff-26 – Provision of Treatments: (a) In general A State shall use a portion of the amounts provided under a grant awarded under section 300ff–21 of this title to establish a program under section 300ff–22(b)(3)(B) of this title to provide therapeutics to treat HIV/AIDS or prevent the serious deterioration of health arising from HIV/AIDS in eligible individuals, including measures for the prevention and treatment of opportunistic infections. (b) Eligible individual To be eligible to receive assistance from a State under this section an individual shall: (1) Have a medical diagnosis of HIV/AIDS; and (2) Be a low-income individual, as defined by the State. California State AIDS Drug Assistance Program Guidelines January 2022: (1.1) AIDS Drug Assistance Program (ADAP) Eligibility Criteria: To be eligible for the ADAP program, a client must: • Have a positive HIV/AIDS diagnosis. • Be at least 18 years old. • Be a resident of California. • Have an annual Modified Adjusted Gross Income (MAGI) that does not exceed 500 percent Federal Poverty Level (FPL) based on household size and income. • Not be fully covered by Medi-Cal or any other third-party payers (an entity that reimburses and manages health care expenses such as private insurance or governmental agencies, employers, etc.). Health Resources and Services Administration, Policy Clarification Notice 15-04 (Revised 1/11/2019): The Ryan White HIV/AIDS Program (RWHAP) legislation requires that rebates collected on ADAP medication purchases be applied to the RWHAP Part B Program with a priority, but not a requirement, that the rebates be placed back into ADAP. Although ADAP rebates are neither program income nor refunds, they are subject to the same regulatory provision regarding expenditure. These rebates must be used for the statutorily permitted purposes under the RWHAP Part B Program, which are limited to core medical services including ADAP, support services, clinical quality management, and administrative expenses (including planning and evaluation) as part of a comprehensive system of care for low-income individuals living with HIV. Condition All applications must be reviewed internally by ADAP staff via an electronic secondary review process to confirm eligibility; however, one of sixty applications was not reviewed by ADAP staff. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause There was a backlog in the secondary review of applications due to staffing issues in the ADAP Branch. Effect Public Health did not have appropriate oversight controls to ensure that the applicant’s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals that may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable because benefit costs were not tracked by individual participants. Context Pharmacy benefits management services are provided by a contractor who received administrative fees and reimbursements for prescription drug costs to program participants. Payments to the contractor totaled $106,505,302 for approximately 24,000 program participants for the fiscal year ended June 30, 2023. The sample was not a statistically valid sample. Recommendation The ADAP Branch should continue to monitor compliance with its policies to ensure secondary reviews of ADAP applications follow the established guidelines. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-018 Category of Finding: Activities Allowed or Unallowed Type of Finding: Significant Deficiency State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.959 Federal Program Title: Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 1B08TI084632-01; 2022 6B08TI084632-01M001; 2022 6B08TI084632-01M002; 2022 1B08TI083437-01; 2021 6B08TI083437-01M002; 2021 6B08TI083437-01M003; 2021 6B08TI083437-01M004; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our testing of 60 employee timesheets, the Department of Health Care Services (DHCS) did not have documentation of the approval for time charged to the Prevention and Treatment of Substance Abuse (SAPT) program for 1 of the samples tested. Identification as a Repeat Finding This is not a repeat finding from the immediate prior year. Cause Due to staffing and organizational changes, DHCS has been unable to locate the requested documentation of timesheet approval. Effect Nonadherence to the internal controls over the documentation of employee timesheets can result in the risk of noncompliance with established policies and procedures. Furthermore, the integrity of the time charged to the program can be compromised when proper documentation of approval is not readily available. Questioned Costs No questioned costs were identified. Context Expenditures related to payroll costs charged to the SAPT program for the fiscal year ended June 30, 2023 totaled $12,743,522. The sample was not a statistically valid sample. Recommendation DHCS should adhere to its processes and controls in place to ensure all timesheets are reviewed and approved by a manager or supervisor. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-018 Category of Finding: Activities Allowed or Unallowed Type of Finding: Significant Deficiency State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.959 Federal Program Title: Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 1B08TI084632-01; 2022 6B08TI084632-01M001; 2022 6B08TI084632-01M002; 2022 1B08TI083437-01; 2021 6B08TI083437-01M002; 2021 6B08TI083437-01M003; 2021 6B08TI083437-01M004; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our testing of 60 employee timesheets, the Department of Health Care Services (DHCS) did not have documentation of the approval for time charged to the Prevention and Treatment of Substance Abuse (SAPT) program for 1 of the samples tested. Identification as a Repeat Finding This is not a repeat finding from the immediate prior year. Cause Due to staffing and organizational changes, DHCS has been unable to locate the requested documentation of timesheet approval. Effect Nonadherence to the internal controls over the documentation of employee timesheets can result in the risk of noncompliance with established policies and procedures. Furthermore, the integrity of the time charged to the program can be compromised when proper documentation of approval is not readily available. Questioned Costs No questioned costs were identified. Context Expenditures related to payroll costs charged to the SAPT program for the fiscal year ended June 30, 2023 totaled $12,743,522. The sample was not a statistically valid sample. Recommendation DHCS should adhere to its processes and controls in place to ensure all timesheets are reviewed and approved by a manager or supervisor. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-010 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575 Federal Program Title: Child Care and Development Block Grant (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2234CACCDD; 2022 2334CACCDD; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Government-Wide Guidance for Federal Financial Assistance. Part 170 – Reporting Subaward and Executive Compensation Information. Subpart A – General. § 170.100 Purpose of this part This part provides guidance to Federal agencies on establishing requirements for recipients of Federal awards to report information on subawards and executive total compensation, as required by the Federal Funding Accountability and Transparency Act of 2006 (Pub. L. 109-282), as amended by the Digital Accountability and Transparency Act of 2014 (Pub. L. 113-101) and other Public Laws, hereafter referred to as the “Transparency Act.” § 170.105 Applicability. (a) Applicability in general. This part applies to a Federal agency’s Federal financial assistance as defined in § 170.300. This part applies to all recipients and subrecipients of Federal awards who meet the reporting requirements of paragraph (c) of this section, unless exempt under Federal statute or by paragraph (d) of this section. (b) Non-applicability to individuals. This part does not apply to an individual who applies for or receives Federal financial assistance as a natural person (that is, unrelated to any business or nonprofit organization an individual owns or operates). (c) Reporting Requirements. (1) The names and total compensation of an entity’s five most highly compensated executives must be reported if: (i) In the entity’s preceding fiscal year, it received: (A) 80 percent or more of its annual gross revenue in Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and (B) $25,000,000 or more in annual gross revenue from Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and (ii) The public does not have access to information about the compensation of senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986. Appendix A to Part 170 — Award Term. I. Reporting Subawards and Executive Compensation (2 CFR 170): (a)(2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. (b)(2) Reporting Requirements. (i) As part of the recipient’s registration profile at https://www.sam.gov. (ii) No later than the month following the month in which this Federal award is made, and annually after that. Condition CDSS did not submit its Federal Funding Accountability and Transparency Act (FFATA) reports timely for the fiscal years ended June 30, 2023 and 2022. Grant Award Year FAIN Obligation Date FAIN Submission Due Date Submitted 2022 2234CACCDD 11/2/2021 Not Available 12/30/2021 11/15/2022 2023 2334CACCDF 10/28/2022 2334CACCDF 11/30/2022 12/8/2023 Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause CDSS has had turnover in positions responsible for filing the required FFATA reports. In addition, when CDSS assumed responsibilities over the CCDF Cluster, this function and responsibility was not clearly identified. Effect CDSS is not in compliance with 2 CFR Part 170. Questioned Costs Not applicable. Context CDSS is responsible for filing an annual FFATA report for pass-throughs to subrecipients greater than $30,000. We selected both FFATA reports that were submitted during and for the audit period. The sample was not a statistically valid sample. Recommendation We recommend that CDSS compile a report tracking process and identify all fiscal and compliance reports to be submitted with clear position responsibilities and workflow to ensure reports include accurate information and are timely prepared. CDSS should have a centralized tracking mechanism and assign and document a responsible position instead of a responsible individual person, which will reduce the risk of reports not being filed if turnover occurs. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-011 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2001CACCDF; 2020 2101CACCDF; 2021 2234CACCDF; 2022 2334CACCDF; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (b) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 45 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart G – Financial Management. § 98.65 Audits and financial reporting. (45 CFR 98.65) (d) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended.   OMB #0970-0510 – Instructions for Completion of Form ACF-696 Financial Reporting Form for the Child Care and Development Fund (CCDF) State & Territory Lead Agencies Pursuant to CCDF regulations at 45 CFR 98.65(g), and as part of the terms and conditions of the grant award, States and Territories are required to complete and submit a quarterly financial status report (ACF-696) in accordance with these instructions on behalf of the CCDF Lead Agency. Condition For the fiscal year ended June 30, 2023, $2,183,002,451 was reported on the schedule of expenditures of federal awards (Schedule) for the CCDF Cluster; however, CDSS is unable to reconcile the ACF-696 reports submitted to the amount reported on the Schedule. The Schedule is $53,163,387 greater than the cumulative quarterly reports which totaled $2,129,839,064 for the fiscal year ended June 30, 2023. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The expenditures tracked and recorded by CDSS and CDE are reported together on the ACF-696 quarterly reports. CDSS, the department responsible for filing the reports for the fiscal year ended June 30, 2023, cannot identify the expenditures at the department level and therefore is unable to reconcile the discrepancy. Effect CCDF Cluster expenditures were not accurately reported in the quarterly ACF-696 reports submitted. Questioned Costs Not applicable. Context CDSS does not have an adequate data capture and reconciliation process to support the preparation of the ACF-696 reports, which should include a year-end reconciliation to the amount reported in the Schedule. We did not sample the ACF-696 reports. We reviewed the 1st and 4th quarter reports for each open grant year and recalculated the cumulative total for the fiscal year ended June 30, 2023, and compared the result to the Schedule. Recommendation We recommend that CDSS review its procedures for capturing and reporting quarterly information in the AC-696 reports to ensure information is complete and accurate and maintain documentation supporting the amounts reported. Furthermore, we recommend that CDSS perform a year-end reconciliation of the ACF-696 reports to the amount reported in the Schedule. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-012 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACCDF; 2021 2101CACCC5; 2021 2234CACCDF; 2022 2234CACCDD; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (c) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management. §200.332 Requirements for pass-through entities (2 CFR 200.332): A pass-through entity must: (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a pass-through entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section §200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. California Code of Regulations. Title 5 Education. § 18023. Compliance Reviews of Contractors. (b) At least once every three (3) years and as resources permit, the California Department of Education shall conduct reviews at the contractor's office(s) and operating facility(ies) to determine the contractor's compliance with applicable laws, regulations or contractual provisions. Child Care and Development Fund (CCDF) Plan for State/Territory California FFY 2022-24, Amendment 4. Chapter 8 Ensure Grantee Program Integrity and Accountability. 8.1 Internal Controls and Accountability Measures to Help Ensure Program Integrity. 8.1.1 Process to train about CCDF requirements and program integrity. States and territories are required to describe effective internal controls that are in place to ensure program integrity and accountability (98.68(a)), including processes to train child care providers and staff of the Lead Agency and other agencies engaged in the administration of CCDF about program requirements and integrity. v. Monitor and assess policy implementation on an ongoing basis. The Lead Agency conducts announced Categorical Program Monitoring (CPM)/Contract Monitoring Reviews (CMRs) for each contractor on a three- or four-year cycle for non-LEAs and LEAs respectively. The Lead Agency’s Governance and Administration Unit (GAU) conducts ongoing review of individual contractors by sampling the eligibility and need documentation in family files to estimate and reduce error rates. Additionally, the Lead Agency provides ongoing training and technical assistance to contractors in regional sessions, in one-on-one sessions, and/or in cluster with webinars or during face to-face presentations. These sessions address CCDF program administration, requirements, and integrity. Condition We selected 60 subrecipient contracts (14 local educational agency (LEA) contracts and 46 non-LEA contracts) from 50 subrecipient entities and tested compliance with subrecipient monitoring requirements. We noted the following: LEAs • 3 LEA contracts/contractors had no records for the receipt of a corrective action plan or notification of resolution for findings identified in monitoring reports. • 1 LEA contract/contractor did not have the quarterly fiscal reports available for review for the quarter selected for testing. Non-LEAs • 5 non-LEA contracts/contractors had no records available to demonstrate risk assessment of the contractor. • 4 non-LEA contracts/contractors had no record of on-site monitoring in over 5 years. • 7 non-LEA contracts/contractors had no records for the receipt of the corrective action plan or notification of resolution for findings identified in monitoring reports. • 5 non-LEA contracts/contractors did not have the quarterly fiscal reports available for review for the quarters selected for testing. The monitoring of the contractors’ single audit reports and follow-up on noted findings continued to be a shared responsibility between CDSS and the Department of Education (CDE) during fiscal year 2022-23. The transition of audit report monitoring responsibilities over LEAs receiving CCDF Cluster program funds is still in process and not yet centralized with CDSS. Furthermore, subrecipients continue to report the pass-through entity as CDE and not CDSS. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause In fiscal year 2021, the administration of the CCDF Cluster program was transitioned from the California Department of Education (CDE) to CDSS. CDSS has been in the process of revising certain policies and procedures, including contractor monitoring. In addition, certain records related to CDE monitoring activities for the contracts selected were unavailable for review. Effect CDSS is at risk for contractor noncompliance if monitoring procedures are not properly designed or executed, and/or documents demonstrating monitoring are not maintained. Questioned Costs $175,631,433 of $332,931,906 sampled contract expenditures for fiscal year ended June 30, 2023. Context CDSS contractors may have multiple contracts with varying contract requirements. We selected one or more contracts from 50 different contractors for a total of 60 unique contracts representing $332,931,906 of expenditures incurred during the fiscal year ended June 30, 2023. The exceptions noted above represented 32 different contracts administered by 28 contractors and represented $175,613,433 or 52.7% of the total sampled contract expenditures. The sample was not a statistically valid sample. Recommendation To enhance the effectiveness of the annual risk assessment process, we recommend a thorough evaluation that focuses on the identification and inclusion of all subrecipients and defined risk criteria as mandated in 2 CFR 200.332. Furthermore, it is crucial to establish and document a transparent basis for risk profiling that directly correlates such profiles with compliance monitoring activities across fiscal, program, and single audit requirements. Furthermore, we recommend CDSS perform a comprehensive post-transition review to ensure all monitoring responsibilities transferred from CDE have been fully identified and assigned. This review should validate robust mechanisms are in place for the accurate documentation and proper retention of records. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-013 Category of Finding: Special Tests and Provisions – Child Care Provider Eligibility for ARP Act Stabilization Funds Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575 Federal Program Title: Child Care and Development Block Grant (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACSC6; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (d) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Assembly Bill (AB) 179 and AB 110 provided designated American Rescue Plan Act (ARPA) funding to provide supplemental rate payments and stipends to eligible child care providers. As prescribed by ARPA, to qualify for this funding a child care provider must apply and meet the following criteria: On the date of application for the award must either be: (1) open and available to provide child care services, or (2) closed due to public health, financial hardship, or other reasons relating to the COVID-19 public health emergency. In addition, the child care provider must either: (1) be eligible to serve children who receive CCDF subsidies at the time of application for stabilization funds, or (2) be licensed, regulated, or registered in the state, territory, or tribe as of March 11, 2021, and meet applicable state and local health and safety requirements at the time of application for stabilization funds. In their application for stabilization funds, a child care provider must certify: a. That the provider will, when open and providing services, implement policies in line with guidance and orders from corresponding state, territorial, tribal, and local authorities and, to the greatest extent possible, implement policies in line with guidance from the CDC. b. For each employee, the provider must pay at least the same amount in weekly wages and maintain the same benefits for the duration of the stabilization funding. c. The provider will provide relief from copayments and tuition payments for the families enrolled in the provider’s program, to the extent possible, and prioritize such relief for families struggling to make either type of payment. Condition CDSS uses a third-party service provider to administer payments to child care contractors and assist with the coordination and collection of certain information required to be eligible to receive state and federal child care funding. The third-party service provider is considered a fiduciary and not a subrecipient, thus CDSS is responsible for monitoring eligibility compliance related to the ARPA Stabilization funding. Of the 25 samples we selected for testing eligibility criteria related to the ARPA Stabilization funding, 22 contractors were determined eligible by the third-party service provider; however, the CDSS did not monitor that the third-party service provider appropriately discharged its duties and correctly determined that recipients were eligible. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause CDSS did not appropriately determine its responsibility for eligibility of ARPA Stabilization recipients and relied on the determinations of the third-party service provider without oversight. Effect CDSS did not fulfill its responsibilities for determining eligibility of ARPA Stabilization recipients. Questioned Costs $232,082,456 Context The third-party service provider used CDSS’ survey portal to capture and review information of the recipients it determined eligible. During the fiscal year ended June 30, 2023, CDSS paid the third-party service provider $232,082,456 to disburse to eligible contractors. The third-party service provider does not qualify as a subrecipient and thus is not subject to the Uniform Guidance requiring a single audit. Recommendation We recommend that CDSS review its contract with the third-party service provider and identify compliance requirements delegated to the provider and develop a monitoring program to ensure the third-party service provider is accurately fulfilling its responsibilities in determining compliance of contractors. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-014 Category of Finding: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services (CDSS) Assistance Listing Number: 93.575 Federal Program Title: Child Care and Development Block Grant (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACCDF; 2021 2101CACCC5; 2021 2101CACDC6; 2021 2234CACCDD; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (e) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart E – Program Operations (Child Care Services)—Lead Agency and Provider Requirements. §98.41 Health and safety requirements: (a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to §98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (i) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, [et. al.] (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man-caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of biocontaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and (xii) May include requirements relating to: (A) Nutrition (including age-appropriate feeding); (B) Access to physical activity; (C) Caring for children with special needs; or (D) Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children’s health and safety. (2) Include minimum health and safety training on the topics above, as described in §98.44. Condition The CDSS has not established health and safety monitoring procedures to ensure licensed-exempt providers serving children who receive subsidies comply with all applicable health and safety requirements. Accordingly, no monitoring procedures were performed on licensed-exempt providers during the fiscal year ended June 30, 2023. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Although CDSS is in process of developing a health and safety monitoring process for licensed-exempt contractors, finalization and implementation is subject to statutory and budget actions which delay the process. Effect The CDSS is not in compliance with 45 CFR §98.41. Questioned Costs No questioned costs were identified. Context CDSS was not able to isolate a complete list of subrecipient expenditures related to contractors receiving CCDF Cluster program funding that were subject to health and safety compliance for the fiscal year ended June 30, 2023; therefore, the magnitude of impact to the program cannot be determined. CDSS is in process of developing its health and safety monitoring program in collaboration with the Federal Administration of Children and Families and the State legislature. Recommendation We recommend CDSS complete its development and implementation of a monitoring process over the health and safety standards and develop a mechanism to identify and track all contracts requiring health and safety compliance monitoring. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-011 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2001CACCDF; 2020 2101CACCDF; 2021 2234CACCDF; 2022 2334CACCDF; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (b) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 45 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart G – Financial Management. § 98.65 Audits and financial reporting. (45 CFR 98.65) (d) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended.   OMB #0970-0510 – Instructions for Completion of Form ACF-696 Financial Reporting Form for the Child Care and Development Fund (CCDF) State & Territory Lead Agencies Pursuant to CCDF regulations at 45 CFR 98.65(g), and as part of the terms and conditions of the grant award, States and Territories are required to complete and submit a quarterly financial status report (ACF-696) in accordance with these instructions on behalf of the CCDF Lead Agency. Condition For the fiscal year ended June 30, 2023, $2,183,002,451 was reported on the schedule of expenditures of federal awards (Schedule) for the CCDF Cluster; however, CDSS is unable to reconcile the ACF-696 reports submitted to the amount reported on the Schedule. The Schedule is $53,163,387 greater than the cumulative quarterly reports which totaled $2,129,839,064 for the fiscal year ended June 30, 2023. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The expenditures tracked and recorded by CDSS and CDE are reported together on the ACF-696 quarterly reports. CDSS, the department responsible for filing the reports for the fiscal year ended June 30, 2023, cannot identify the expenditures at the department level and therefore is unable to reconcile the discrepancy. Effect CCDF Cluster expenditures were not accurately reported in the quarterly ACF-696 reports submitted. Questioned Costs Not applicable. Context CDSS does not have an adequate data capture and reconciliation process to support the preparation of the ACF-696 reports, which should include a year-end reconciliation to the amount reported in the Schedule. We did not sample the ACF-696 reports. We reviewed the 1st and 4th quarter reports for each open grant year and recalculated the cumulative total for the fiscal year ended June 30, 2023, and compared the result to the Schedule. Recommendation We recommend that CDSS review its procedures for capturing and reporting quarterly information in the AC-696 reports to ensure information is complete and accurate and maintain documentation supporting the amounts reported. Furthermore, we recommend that CDSS perform a year-end reconciliation of the ACF-696 reports to the amount reported in the Schedule. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-012 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACCDF; 2021 2101CACCC5; 2021 2234CACCDF; 2022 2234CACCDD; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (c) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management. §200.332 Requirements for pass-through entities (2 CFR 200.332): A pass-through entity must: (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a pass-through entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section §200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. California Code of Regulations. Title 5 Education. § 18023. Compliance Reviews of Contractors. (b) At least once every three (3) years and as resources permit, the California Department of Education shall conduct reviews at the contractor's office(s) and operating facility(ies) to determine the contractor's compliance with applicable laws, regulations or contractual provisions. Child Care and Development Fund (CCDF) Plan for State/Territory California FFY 2022-24, Amendment 4. Chapter 8 Ensure Grantee Program Integrity and Accountability. 8.1 Internal Controls and Accountability Measures to Help Ensure Program Integrity. 8.1.1 Process to train about CCDF requirements and program integrity. States and territories are required to describe effective internal controls that are in place to ensure program integrity and accountability (98.68(a)), including processes to train child care providers and staff of the Lead Agency and other agencies engaged in the administration of CCDF about program requirements and integrity. v. Monitor and assess policy implementation on an ongoing basis. The Lead Agency conducts announced Categorical Program Monitoring (CPM)/Contract Monitoring Reviews (CMRs) for each contractor on a three- or four-year cycle for non-LEAs and LEAs respectively. The Lead Agency’s Governance and Administration Unit (GAU) conducts ongoing review of individual contractors by sampling the eligibility and need documentation in family files to estimate and reduce error rates. Additionally, the Lead Agency provides ongoing training and technical assistance to contractors in regional sessions, in one-on-one sessions, and/or in cluster with webinars or during face to-face presentations. These sessions address CCDF program administration, requirements, and integrity. Condition We selected 60 subrecipient contracts (14 local educational agency (LEA) contracts and 46 non-LEA contracts) from 50 subrecipient entities and tested compliance with subrecipient monitoring requirements. We noted the following: LEAs • 3 LEA contracts/contractors had no records for the receipt of a corrective action plan or notification of resolution for findings identified in monitoring reports. • 1 LEA contract/contractor did not have the quarterly fiscal reports available for review for the quarter selected for testing. Non-LEAs • 5 non-LEA contracts/contractors had no records available to demonstrate risk assessment of the contractor. • 4 non-LEA contracts/contractors had no record of on-site monitoring in over 5 years. • 7 non-LEA contracts/contractors had no records for the receipt of the corrective action plan or notification of resolution for findings identified in monitoring reports. • 5 non-LEA contracts/contractors did not have the quarterly fiscal reports available for review for the quarters selected for testing. The monitoring of the contractors’ single audit reports and follow-up on noted findings continued to be a shared responsibility between CDSS and the Department of Education (CDE) during fiscal year 2022-23. The transition of audit report monitoring responsibilities over LEAs receiving CCDF Cluster program funds is still in process and not yet centralized with CDSS. Furthermore, subrecipients continue to report the pass-through entity as CDE and not CDSS. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause In fiscal year 2021, the administration of the CCDF Cluster program was transitioned from the California Department of Education (CDE) to CDSS. CDSS has been in the process of revising certain policies and procedures, including contractor monitoring. In addition, certain records related to CDE monitoring activities for the contracts selected were unavailable for review. Effect CDSS is at risk for contractor noncompliance if monitoring procedures are not properly designed or executed, and/or documents demonstrating monitoring are not maintained. Questioned Costs $175,631,433 of $332,931,906 sampled contract expenditures for fiscal year ended June 30, 2023. Context CDSS contractors may have multiple contracts with varying contract requirements. We selected one or more contracts from 50 different contractors for a total of 60 unique contracts representing $332,931,906 of expenditures incurred during the fiscal year ended June 30, 2023. The exceptions noted above represented 32 different contracts administered by 28 contractors and represented $175,613,433 or 52.7% of the total sampled contract expenditures. The sample was not a statistically valid sample. Recommendation To enhance the effectiveness of the annual risk assessment process, we recommend a thorough evaluation that focuses on the identification and inclusion of all subrecipients and defined risk criteria as mandated in 2 CFR 200.332. Furthermore, it is crucial to establish and document a transparent basis for risk profiling that directly correlates such profiles with compliance monitoring activities across fiscal, program, and single audit requirements. Furthermore, we recommend CDSS perform a comprehensive post-transition review to ensure all monitoring responsibilities transferred from CDE have been fully identified and assigned. This review should validate robust mechanisms are in place for the accurate documentation and proper retention of records. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-014 Category of Finding: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services (CDSS) Assistance Listing Number: 93.575 Federal Program Title: Child Care and Development Block Grant (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACCDF; 2021 2101CACCC5; 2021 2101CACDC6; 2021 2234CACCDD; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (e) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart E – Program Operations (Child Care Services)—Lead Agency and Provider Requirements. §98.41 Health and safety requirements: (a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to §98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (i) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, [et. al.] (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man-caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of biocontaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and (xii) May include requirements relating to: (A) Nutrition (including age-appropriate feeding); (B) Access to physical activity; (C) Caring for children with special needs; or (D) Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children’s health and safety. (2) Include minimum health and safety training on the topics above, as described in §98.44. Condition The CDSS has not established health and safety monitoring procedures to ensure licensed-exempt providers serving children who receive subsidies comply with all applicable health and safety requirements. Accordingly, no monitoring procedures were performed on licensed-exempt providers during the fiscal year ended June 30, 2023. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Although CDSS is in process of developing a health and safety monitoring process for licensed-exempt contractors, finalization and implementation is subject to statutory and budget actions which delay the process. Effect The CDSS is not in compliance with 45 CFR §98.41. Questioned Costs No questioned costs were identified. Context CDSS was not able to isolate a complete list of subrecipient expenditures related to contractors receiving CCDF Cluster program funding that were subject to health and safety compliance for the fiscal year ended June 30, 2023; therefore, the magnitude of impact to the program cannot be determined. CDSS is in process of developing its health and safety monitoring program in collaboration with the Federal Administration of Children and Families and the State legislature. Recommendation We recommend CDSS complete its development and implementation of a monitoring process over the health and safety standards and develop a mechanism to identify and track all contracts requiring health and safety compliance monitoring. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-011 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2001CACCDF; 2020 2101CACCDF; 2021 2234CACCDF; 2022 2334CACCDF; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (b) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 45 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart G – Financial Management. § 98.65 Audits and financial reporting. (45 CFR 98.65) (d) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended.   OMB #0970-0510 – Instructions for Completion of Form ACF-696 Financial Reporting Form for the Child Care and Development Fund (CCDF) State & Territory Lead Agencies Pursuant to CCDF regulations at 45 CFR 98.65(g), and as part of the terms and conditions of the grant award, States and Territories are required to complete and submit a quarterly financial status report (ACF-696) in accordance with these instructions on behalf of the CCDF Lead Agency. Condition For the fiscal year ended June 30, 2023, $2,183,002,451 was reported on the schedule of expenditures of federal awards (Schedule) for the CCDF Cluster; however, CDSS is unable to reconcile the ACF-696 reports submitted to the amount reported on the Schedule. The Schedule is $53,163,387 greater than the cumulative quarterly reports which totaled $2,129,839,064 for the fiscal year ended June 30, 2023. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The expenditures tracked and recorded by CDSS and CDE are reported together on the ACF-696 quarterly reports. CDSS, the department responsible for filing the reports for the fiscal year ended June 30, 2023, cannot identify the expenditures at the department level and therefore is unable to reconcile the discrepancy. Effect CCDF Cluster expenditures were not accurately reported in the quarterly ACF-696 reports submitted. Questioned Costs Not applicable. Context CDSS does not have an adequate data capture and reconciliation process to support the preparation of the ACF-696 reports, which should include a year-end reconciliation to the amount reported in the Schedule. We did not sample the ACF-696 reports. We reviewed the 1st and 4th quarter reports for each open grant year and recalculated the cumulative total for the fiscal year ended June 30, 2023, and compared the result to the Schedule. Recommendation We recommend that CDSS review its procedures for capturing and reporting quarterly information in the AC-696 reports to ensure information is complete and accurate and maintain documentation supporting the amounts reported. Furthermore, we recommend that CDSS perform a year-end reconciliation of the ACF-696 reports to the amount reported in the Schedule. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-012 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACCDF; 2021 2101CACCC5; 2021 2234CACCDF; 2022 2234CACCDD; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (c) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management. §200.332 Requirements for pass-through entities (2 CFR 200.332): A pass-through entity must: (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a pass-through entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section §200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. California Code of Regulations. Title 5 Education. § 18023. Compliance Reviews of Contractors. (b) At least once every three (3) years and as resources permit, the California Department of Education shall conduct reviews at the contractor's office(s) and operating facility(ies) to determine the contractor's compliance with applicable laws, regulations or contractual provisions. Child Care and Development Fund (CCDF) Plan for State/Territory California FFY 2022-24, Amendment 4. Chapter 8 Ensure Grantee Program Integrity and Accountability. 8.1 Internal Controls and Accountability Measures to Help Ensure Program Integrity. 8.1.1 Process to train about CCDF requirements and program integrity. States and territories are required to describe effective internal controls that are in place to ensure program integrity and accountability (98.68(a)), including processes to train child care providers and staff of the Lead Agency and other agencies engaged in the administration of CCDF about program requirements and integrity. v. Monitor and assess policy implementation on an ongoing basis. The Lead Agency conducts announced Categorical Program Monitoring (CPM)/Contract Monitoring Reviews (CMRs) for each contractor on a three- or four-year cycle for non-LEAs and LEAs respectively. The Lead Agency’s Governance and Administration Unit (GAU) conducts ongoing review of individual contractors by sampling the eligibility and need documentation in family files to estimate and reduce error rates. Additionally, the Lead Agency provides ongoing training and technical assistance to contractors in regional sessions, in one-on-one sessions, and/or in cluster with webinars or during face to-face presentations. These sessions address CCDF program administration, requirements, and integrity. Condition We selected 60 subrecipient contracts (14 local educational agency (LEA) contracts and 46 non-LEA contracts) from 50 subrecipient entities and tested compliance with subrecipient monitoring requirements. We noted the following: LEAs • 3 LEA contracts/contractors had no records for the receipt of a corrective action plan or notification of resolution for findings identified in monitoring reports. • 1 LEA contract/contractor did not have the quarterly fiscal reports available for review for the quarter selected for testing. Non-LEAs • 5 non-LEA contracts/contractors had no records available to demonstrate risk assessment of the contractor. • 4 non-LEA contracts/contractors had no record of on-site monitoring in over 5 years. • 7 non-LEA contracts/contractors had no records for the receipt of the corrective action plan or notification of resolution for findings identified in monitoring reports. • 5 non-LEA contracts/contractors did not have the quarterly fiscal reports available for review for the quarters selected for testing. The monitoring of the contractors’ single audit reports and follow-up on noted findings continued to be a shared responsibility between CDSS and the Department of Education (CDE) during fiscal year 2022-23. The transition of audit report monitoring responsibilities over LEAs receiving CCDF Cluster program funds is still in process and not yet centralized with CDSS. Furthermore, subrecipients continue to report the pass-through entity as CDE and not CDSS. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause In fiscal year 2021, the administration of the CCDF Cluster program was transitioned from the California Department of Education (CDE) to CDSS. CDSS has been in the process of revising certain policies and procedures, including contractor monitoring. In addition, certain records related to CDE monitoring activities for the contracts selected were unavailable for review. Effect CDSS is at risk for contractor noncompliance if monitoring procedures are not properly designed or executed, and/or documents demonstrating monitoring are not maintained. Questioned Costs $175,631,433 of $332,931,906 sampled contract expenditures for fiscal year ended June 30, 2023. Context CDSS contractors may have multiple contracts with varying contract requirements. We selected one or more contracts from 50 different contractors for a total of 60 unique contracts representing $332,931,906 of expenditures incurred during the fiscal year ended June 30, 2023. The exceptions noted above represented 32 different contracts administered by 28 contractors and represented $175,613,433 or 52.7% of the total sampled contract expenditures. The sample was not a statistically valid sample. Recommendation To enhance the effectiveness of the annual risk assessment process, we recommend a thorough evaluation that focuses on the identification and inclusion of all subrecipients and defined risk criteria as mandated in 2 CFR 200.332. Furthermore, it is crucial to establish and document a transparent basis for risk profiling that directly correlates such profiles with compliance monitoring activities across fiscal, program, and single audit requirements. Furthermore, we recommend CDSS perform a comprehensive post-transition review to ensure all monitoring responsibilities transferred from CDE have been fully identified and assigned. This review should validate robust mechanisms are in place for the accurate documentation and proper retention of records. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-015 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2305CA5021; 2023 2305CA3002; 2023 2205CA5022; 2022 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code – WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year. §14713: (b) If the department determines that a mental health plan has failed to comply with the requirements of Chapter 7 (commencing with Section 14000), Chapter 8 (commencing with Section 14200), Chapter 8.8 (commencing with Section 14600), or this chapter, the department may impose sanctions and plans of correction pursuant to Section 14197.7. Condition Eighteen of 56 contractor counties of Short-Doyle funding were tested and seventeen had not submitted their cost reports by the December 31 due date. Five of the seventeen contractor counties have not submitted their cost reports for fiscal year 2021-22 (more than 12 months late) and thirteen of the seventeen contractor counties have subsequently submitted their cost reports for fiscal year 2021-22. Although the Mental Health Division of Health Care Services did take the required action of notifying the eighteen contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2022-008 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Medical Assistance Program to the eighteen contractor counties totaled $1,943,410,893, the seventeen noncompliant contractor counties totaled $1,871,058,835, and all 58 contractor counties totaled $2,338,031,915. For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven contractor counties totaled $94,521,685, the six noncompliant contractor counties totaled $88,716,942, and all 58 contractor counties totaled $191,348,628. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-016 Category of Finding: Special Tests and Provisions – Provider Health and Safety Standards Type of Finding: Material Weakness State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition There was no evidence of surveyor signature or supervisor review and approval on Form CMS 1539 for all 40 surveys of providers tested. Identification as a Repeat Finding Finding 2022-012 was reported in the immediate prior year. Cause California Department of Public Health (Public Health) did not adhere to their documented controls due to continued turnover of staff members within Public Health. Effect Nonadherence to internal controls over the review and approval process of the Form CMS-1539 can result in the risk of statewide noncompliance as providers may not meet the prescribed health and safety standards. Further, the integrity of the surveys can be compromised as they are being conducted with no documented oversight. Questioned Costs No questioned costs were identified. Context A total of 461 surveys were included in the population, which consisted of all surveys completed by Public Health for Hospitals, Intermediate Care Facilities and Individuals with Intellectual Disabilities and Nursing Facilities during the fiscal year ended June 30, 2023. The sample was not a statistically valid sample. Recommendation Public Health should update its processes and controls in place to ensure timely review and approval of the Form CMS-1539, including for situations when staff are on leave and/or have left the department. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-015 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2305CA5021; 2023 2305CA3002; 2023 2205CA5022; 2022 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code – WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year. §14713: (b) If the department determines that a mental health plan has failed to comply with the requirements of Chapter 7 (commencing with Section 14000), Chapter 8 (commencing with Section 14200), Chapter 8.8 (commencing with Section 14600), or this chapter, the department may impose sanctions and plans of correction pursuant to Section 14197.7. Condition Eighteen of 56 contractor counties of Short-Doyle funding were tested and seventeen had not submitted their cost reports by the December 31 due date. Five of the seventeen contractor counties have not submitted their cost reports for fiscal year 2021-22 (more than 12 months late) and thirteen of the seventeen contractor counties have subsequently submitted their cost reports for fiscal year 2021-22. Although the Mental Health Division of Health Care Services did take the required action of notifying the eighteen contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2022-008 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Medical Assistance Program to the eighteen contractor counties totaled $1,943,410,893, the seventeen noncompliant contractor counties totaled $1,871,058,835, and all 58 contractor counties totaled $2,338,031,915. For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven contractor counties totaled $94,521,685, the six noncompliant contractor counties totaled $88,716,942, and all 58 contractor counties totaled $191,348,628. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-016 Category of Finding: Special Tests and Provisions – Provider Health and Safety Standards Type of Finding: Material Weakness State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition There was no evidence of surveyor signature or supervisor review and approval on Form CMS 1539 for all 40 surveys of providers tested. Identification as a Repeat Finding Finding 2022-012 was reported in the immediate prior year. Cause California Department of Public Health (Public Health) did not adhere to their documented controls due to continued turnover of staff members within Public Health. Effect Nonadherence to internal controls over the review and approval process of the Form CMS-1539 can result in the risk of statewide noncompliance as providers may not meet the prescribed health and safety standards. Further, the integrity of the surveys can be compromised as they are being conducted with no documented oversight. Questioned Costs No questioned costs were identified. Context A total of 461 surveys were included in the population, which consisted of all surveys completed by Public Health for Hospitals, Intermediate Care Facilities and Individuals with Intellectual Disabilities and Nursing Facilities during the fiscal year ended June 30, 2023. The sample was not a statistically valid sample. Recommendation Public Health should update its processes and controls in place to ensure timely review and approval of the Form CMS-1539, including for situations when staff are on leave and/or have left the department. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-019 Category of Finding: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Social Services (CDSS) Assistance Listing Numbers: 96.001 Federal Program Title: Disability Insurance/SSI Cluster: Social Security Disability Insurance Federal Award Number and Year: 04-2204CADI00; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart E – Cost Principles. §200.403 Factors affecting allowability of costs. Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (g) Be adequately documented. See §200.300 through §200.309.   Condition The documentation for one of forty samples selected for testing did not agree to the payment disbursed to a provider for medical evidence of record (MER) services. The provider was overpaid by $5. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause CDSS has represented that the cause was an input error in the Midas subledger when processing the vendor payment. Effect CDSS did not have appropriate oversight controls to ensure that the data entry was accurate. Accordingly, there is an increased risk for data entry directly affecting the amount reported on the schedule of expenditures of federal awards to be inaccurate. Questioned Costs Questioned costs are projected to be $54,398. Context The total MER expenditures for the fiscal year ended June 30, 2023, were $4,432,781, which represents 1.8% of the total program expenditures of the Disability Insurance/SSI Cluster of $242,946,482. The sample was not a statistically valid sample. Recommendation CDSS should strengthen its controls over the review for accuracy of the provider invoice amounts input into Midas. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-002 Category of Finding: Procurement and Suspension and Debarment Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 10.557 Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Federal Award Numbers and Years: 202222W100347, 2022 202221W100347, 2022 202222W100647, 2022 202221W100647, 2022 202222W100247, 2022 202323W100247, 2023 202322W100347, 2023 202323W100347, 2023 202322W100647, 2023 202323W100647, 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Government-Wide Guidance for Grants and Agreements. Part 180 – OMB Guidelines to Agencies on Government-Wide Debarment and Suspension (Non-procurement). Subpart C – Responsibilities of Participants Regarding Transactions Doing Business With Other Persons §180.300 (2 CFR 180.300): When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You may do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or a condition to the covered transactions with that person. Condition We noted that three out of the twelve vendor contract agreements reviewed did not include a suspension and debarment certification clause indicating the contractor was not suspended or debarred from participation in federally funded contracts. There was no other documentation available to demonstrate that the verification of suspension and debarment was performed prior to entering into the covered transactions. Based on the subsequent review of the System for Award Management (SAM) exclusions, these contractors were not suspended or debarred. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The WIC program personnel responsible for administering these federal funds were not fully aware of the suspension and debarment requirements. Additionally, there were no formal procedures in place to consistently document and retain evidence of suspension and debarment status checks for vendors. Effect Failure to verify suspension and debarment results in noncompliance with 2 CFR §180.300, as well as a risk that federal funds could be used to pay vendors that are suspended or debarred. Questioned Costs No questioned costs were identified. Context The federal funds disbursed to vendors for the fiscal year ended June 30, 2023 totaled $752,214,598. Three of the twelve samples for the Special Supplemental Nutrition Program for Women, Infants, and Children program did not have evidence that verification of suspension and debarment was performed prior to entering into the covered transaction or include a clause or condition to the covered transaction in the agreement. Total disbursements made associated with these vendors to totaled $2,185,950 for the fiscal year ended June 30, 2023. Recommendation Public Health should review and strengthen its procedures for verifying the suspension and debarment status of vendors before entering into any agreement involving federal funds and ensure that the verification documentation is maintained. Alternatively, incorporate a clause in vendor contracts requiring vendors to certify their suspension or debarment status. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-003 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: Unemployment Insurance COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 22 – Social Security, Division 1 – Employment Development Department, Subdivision 1 – Director of Employment Development, Division – 1 Unemployment and Disability Compensation, Part 1 – Unemployment Compensation, Chapter 5 Unemployment Compensation Benefits, Article 1 – Eligibility and Disqualifications §1256, §1257 and §1326 Eligibility and Disqualifications, §1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Eligibility and Disqualifications, §1257 California Code of Regulations: (a) An individual is also disqualified for unemployment compensation benefits if: He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division. Continued Claim for Unemployment Benefits – Filing and Contents, §1326-6 California Code of Regulations: (c) The claimant shall, to maintain his or her eligibility to file continued claims during a continuous period of unemployment, file continued claims at intervals of not more than two weeks, or such other interval as the department shall require, unless he or she shows good cause for his or her delay in filing his or her continued claim. Condition In EDD’s administration of the Unemployment Insurance program, $198,804,488 in benefit payments were estimated by EDD to be potentially ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was based on data parameters to identify claimants who received benefits that matched ineligible criteria for identity or eligibility fraud due to misrepresented information. The Unemployment Insurance Branch of EDD reviews unemployment insurance claims of claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 138 unemployment insurance benefit payments tested, there was 1 claimant receiving benefits, whose reasons for involuntary separation indicated separation was due to misconduct, which was incorrectly categorized as eligible by EDD. Identification as a Repeat Finding Finding 2022-006 was reported in the immediate prior year. Cause EDD has acknowledged that the adjudication process for potential eligibility issues, which includes work separation, was inadequately or not timely performed due to the significant increase in claims resulting from the COVID-19 pandemic. Effect By EDD not performing timely and adequate review for potential eligibility issues, benefit payments were made to ineligible claimants. Questioned Costs Known questioned costs for the one claimant identified was paid unemployment compensation of $6,975 under Unemployment Insurance Program. Context Benefits paid to claimants under the Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $5,383,169,224. The sample was not a statistically valid sample. Recommendation EDD should enhance its adjudication process to support proper eligibility determinations and decrease improper payments to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-004 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 – Disaster Unemployment Assistance, §625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications, (b) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of § 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (e) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual’s statement of employment or self-employment preceding the individual’s unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based on the individual’s statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual’s statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately redetermine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Out of 138 PUA benefit payments tested, there were 91 claimants with verification issues (either wages, self-employment, or both). Identification as a Repeat Finding Finding 2022-005 was reported in the immediate prior year. Cause EDD did not perform timely wage and employment verifications of the claimants due to the significant increase in claims resulting from the COVID-19 pandemic. Despite ongoing efforts to address the backlog of claims, EDD was approved by the Department of Labor (DOL) on May 21, 2024 under Unemployment Insurance Program Letter No. 05-24, to discontinue pursuing claims older than one year that were not a result of fraud, misrepresentation or willful nondisclosure. Effect EDD did not have adequate oversight controls to ensure that the claimant’s wages were timely and properly reviewed and approved. Accordingly, there was an increased risk for the occurrence of overpayment in benefits being provided to individuals, which was not timely prevented or detected. Questioned Costs Known questioned costs for the 91 claimants were $1,708,094. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $306,150,759, which was offset by prior years’ ineligible benefit payments of $90,034,050 and return of funds from EDD debit cards that were not activated within 12 months of card issuance of $620,694,399. The sample was not a statistically valid sample. Recommendation EDD should ensure that proper verification procedures are in place to minimize the number of claimants with wage and/or employment verification issues. Effective and robust verification procedures should assist EDD in processing unemployment benefits only to eligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-005 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 – Disaster Unemployment Assistance, §625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary’s “Standard for Fraud and Overpayment Detection,” Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Title 15 – Commerce and Trade, Chapter 116, Coronavirus Economic (CARES Act) Subchapter II – Unemployment Insurance Provisions, §9023 Emergency Increase in Unemployment Compensation Benefits (f) Fraud and Overpayments: (1) In General – If an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact, and as a result of such false statement or representation or of such nondisclosure such individual has received an amount of Federal Pandemic Unemployment Compensation or Mixed Earner Unemployment Compensation to which such individual was not entitled, such individual— 1. shall be ineligible for further Federal Pandemic Unemployment Compensation Mixed Earner Unemployment Compensation in accordance with the provisions of the applicable State unemployment compensation law relating to fraud in connection with a claim for unemployment compensation. Condition During the fiscal year ended June 30, 2023, EDD continued its administration of the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA benefits were paid additional benefits under the Federal Pandemic Unemployment Compensation program (FPUC). In EDD’s administration of the PUA and FPUC programs, $90,034,050 in benefit payments were estimated to be ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched ineligible criteria for identity fraud or eligibility fraud for misrepresented information. Out of 138 PUA benefit payments tested, there was 1 benefit payment to a claimant determined to be ineligible whose identity was not sufficiently verified. Identification as a Repeat Finding Finding 2022-004 was reported in the immediate prior year. Cause EDD has acknowledged that there was inadequate or untimely review of claimant due to the significant increase in claims resulting from the COVID-19 pandemic. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to ineligible claimants. Accordingly, benefit payments were made to claimants who were not eligible. Questioned Costs Known questioned costs were $8,502 for PUA and $7,200 for FPUC. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $306,150,759 which was offset by prior years’ ineligible benefit payments of $90,034,050 and return of funds from EDD debit cards that were not activated within 12 months of card issuance of $620,694,399. The sample was not a statistically valid sample. Recommendation EDD should continue to strengthen controls, such as database identification cross-matches, ID.me verification, partnerships with law enforcement and Thompson Reuters, as well as system enhancements to mitigate the potential of further employment benefit fraud. Such improvements in internal controls should improve EDD’s ability to timely prevent and detect unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-003 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: Unemployment Insurance COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 22 – Social Security, Division 1 – Employment Development Department, Subdivision 1 – Director of Employment Development, Division – 1 Unemployment and Disability Compensation, Part 1 – Unemployment Compensation, Chapter 5 Unemployment Compensation Benefits, Article 1 – Eligibility and Disqualifications §1256, §1257 and §1326 Eligibility and Disqualifications, §1256 California Code of Regulations: (a) An individual is disqualified for unemployment compensation benefits if the director finds that he or she left his or her most recent work voluntarily without good cause or that he or she has been discharged for misconduct connected with his or her most recent work. Eligibility and Disqualifications, §1257 California Code of Regulations: (a) An individual is also disqualified for unemployment compensation benefits if: He or she willfully, for the purpose of obtaining unemployment compensation benefits, either made a false statement or representation, including, but not limited to, using a false name, false social security number, or other false identification, with actual knowledge of the falsity thereof, or withheld a material fact in order to obtain any unemployment compensation benefits under this division. Continued Claim for Unemployment Benefits – Filing and Contents, §1326-6 California Code of Regulations: (c) The claimant shall, to maintain his or her eligibility to file continued claims during a continuous period of unemployment, file continued claims at intervals of not more than two weeks, or such other interval as the department shall require, unless he or she shows good cause for his or her delay in filing his or her continued claim. Condition In EDD’s administration of the Unemployment Insurance program, $198,804,488 in benefit payments were estimated by EDD to be potentially ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was based on data parameters to identify claimants who received benefits that matched ineligible criteria for identity or eligibility fraud due to misrepresented information. The Unemployment Insurance Branch of EDD reviews unemployment insurance claims of claimants for involuntary separation to ensure separations were for valid reasons under the Unemployment Insurance Code. Out of 138 unemployment insurance benefit payments tested, there was 1 claimant receiving benefits, whose reasons for involuntary separation indicated separation was due to misconduct, which was incorrectly categorized as eligible by EDD. Identification as a Repeat Finding Finding 2022-006 was reported in the immediate prior year. Cause EDD has acknowledged that the adjudication process for potential eligibility issues, which includes work separation, was inadequately or not timely performed due to the significant increase in claims resulting from the COVID-19 pandemic. Effect By EDD not performing timely and adequate review for potential eligibility issues, benefit payments were made to ineligible claimants. Questioned Costs Known questioned costs for the one claimant identified was paid unemployment compensation of $6,975 under Unemployment Insurance Program. Context Benefits paid to claimants under the Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $5,383,169,224. The sample was not a statistically valid sample. Recommendation EDD should enhance its adjudication process to support proper eligibility determinations and decrease improper payments to ineligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-004 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 – Disaster Unemployment Assistance, §625.6 Weekly amount; jurisdictions; reductions Eligibility and Disqualifications, (b) If the weekly amount computed under paragraph (a) of this section is less than 50 percent of the average weekly payment of regular compensation in the State, as provided quarterly by the Department, or, if the individual has insufficient wages from employment or insufficient or no net income from self-employment (which includes individuals falling within paragraphs (a)(3) and (b)(3) of § 625.5) in the applicable base period to compute a weekly amount under paragraph (a) of this section, the individual shall be determined entitled to a weekly amount equal to 50 percent of the average weekly payment of regular compensation in the State. (e) The State agency shall immediately determine, upon the filing of an initial application for DUA, a weekly amount under the provisions of paragraphs (a) through (d) of this section, as the case may be, based on the individual’s statement of employment or self-employment preceding the individual’s unemployment that was a direct result of the major disaster, and wages earned or paid for such employment or self-employment. An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. An immediate determination shall also be made based on the individual’s statement or in conjunction with the submittal of documentation in those cases where the individual was to commence employment or self-employment on or after the date the major disaster began but was prevented from doing so as a direct result of the disaster. (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual’s statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (3) For purposes of a computation of a weekly amount under paragraph (a) of this section, if an individual submits documentation to substantiate employment or self-employment in accordance with paragraph (e)(1), but not documentation of wages earned or paid during the base period set forth in paragraph (a)(2) of this section, including those cases where the individual has not filed a tax return for the most recent tax year that has ended, the State agency shall immediately redetermine the weekly amount of DUA payable to the individual in accordance with paragraph (b) of this section. Condition During the fiscal year ended June 30, 2020, EDD implemented the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. The amount of PUA payable to an unemployed or unemployed self-employed individual for a week of total unemployment shall be the weekly amount of compensation the individual would have been paid as regular compensation, as computed under the provisions of the applicable State law for a week of total unemployment. The weekly amount determination is calculated using the wages reported by the claimant. Upon receipt of a PUA claim, EDD would verify wages reported to ensure accurate weekly benefit amounts under PUA. Out of 138 PUA benefit payments tested, there were 91 claimants with verification issues (either wages, self-employment, or both). Identification as a Repeat Finding Finding 2022-005 was reported in the immediate prior year. Cause EDD did not perform timely wage and employment verifications of the claimants due to the significant increase in claims resulting from the COVID-19 pandemic. Despite ongoing efforts to address the backlog of claims, EDD was approved by the Department of Labor (DOL) on May 21, 2024 under Unemployment Insurance Program Letter No. 05-24, to discontinue pursuing claims older than one year that were not a result of fraud, misrepresentation or willful nondisclosure. Effect EDD did not have adequate oversight controls to ensure that the claimant’s wages were timely and properly reviewed and approved. Accordingly, there was an increased risk for the occurrence of overpayment in benefits being provided to individuals, which was not timely prevented or detected. Questioned Costs Known questioned costs for the 91 claimants were $1,708,094. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $306,150,759, which was offset by prior years’ ineligible benefit payments of $90,034,050 and return of funds from EDD debit cards that were not activated within 12 months of card issuance of $620,694,399. The sample was not a statistically valid sample. Recommendation EDD should ensure that proper verification procedures are in place to minimize the number of claimants with wage and/or employment verification issues. Effective and robust verification procedures should assist EDD in processing unemployment benefits only to eligible claimants. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-005 Category of Finding: Activities Allowed or Unallowed Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Employment Development Department (EDD) Assistance Listing Number: 17.225 Federal Program Title: COVID-19 Unemployment Insurance Federal Award Number and Year: UI-34702-20-55-A-6; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits, Chapter V, Employment and Training Administration, Department of Labor, Part 625 – Disaster Unemployment Assistance, §625.14 Overpayments; disqualification for fraud: (h) Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary’s “Standard for Fraud and Overpayment Detection,” Employment Security Manual, part V, sections 7510 et seq. (Appendix C of this part). (i) Any individual who, with respect to a major disaster, makes or causes another to make a false statement or misrepresentation of a material fact, knowing it to be false, or knowingly fails or causes another to fail to disclose a material fact, in order to obtain for the individual or any other person a payment of DUA to which the individual or any other person is not entitled, shall be disqualified as follows: (1) If the false statement, misrepresentation, or nondisclosure pertains to an initial application for DUA – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of any DUA with respect to that major disaster; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of any DUA with respect to that major disaster; and (2) If the false statement, misrepresentation, or nondisclosure pertains to a week for which application for a payment of DUA is made – i. The individual making the false statement, misrepresentation, or nondisclosure shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA; and ii. If the false statement, misrepresentation, or nondisclosure was made on behalf of another individual, and was known to such other individual to be a false statement, misrepresentation, or nondisclosure, such other individual shall be disqualified from the receipt of DUA for that week and the first two compensable weeks in the Disaster Assistance Period that immediately follow that week, with respect to which the individual is otherwise entitled to a payment of DUA. Title 15 – Commerce and Trade, Chapter 116, Coronavirus Economic (CARES Act) Subchapter II – Unemployment Insurance Provisions, §9023 Emergency Increase in Unemployment Compensation Benefits (f) Fraud and Overpayments: (1) In General – If an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact, and as a result of such false statement or representation or of such nondisclosure such individual has received an amount of Federal Pandemic Unemployment Compensation or Mixed Earner Unemployment Compensation to which such individual was not entitled, such individual— 1. shall be ineligible for further Federal Pandemic Unemployment Compensation Mixed Earner Unemployment Compensation in accordance with the provisions of the applicable State unemployment compensation law relating to fraud in connection with a claim for unemployment compensation. Condition During the fiscal year ended June 30, 2023, EDD continued its administration of the Pandemic Unemployment Assistance (PUA) program, under the Coronavirus Aid, Relief, and Economic Security (CARES) Act for COVID-19 relief in unemployment compensation. Under the CARES Act, the PUA program was to be administered in accordance with the Disaster Unemployment Assistance (DUA) program under section 625 of Title 20, Code of Federal Regulations. Claimants eligible for PUA benefits were paid additional benefits under the Federal Pandemic Unemployment Compensation program (FPUC). In EDD’s administration of the PUA and FPUC programs, $90,034,050 in benefit payments were estimated to be ineligible payments and have not been reported in the schedule of expenditures of federal awards. The estimate was made by the Unemployment Insurance Branch and was based on data parameters to identify claimants that received benefits that matched ineligible criteria for identity fraud or eligibility fraud for misrepresented information. Out of 138 PUA benefit payments tested, there was 1 benefit payment to a claimant determined to be ineligible whose identity was not sufficiently verified. Identification as a Repeat Finding Finding 2022-004 was reported in the immediate prior year. Cause EDD has acknowledged that there was inadequate or untimely review of claimant due to the significant increase in claims resulting from the COVID-19 pandemic. Effect EDD did not have adequate oversight controls to ensure that benefit payments were not being made to ineligible claimants. Accordingly, benefit payments were made to claimants who were not eligible. Questioned Costs Known questioned costs were $8,502 for PUA and $7,200 for FPUC. Context Benefits paid to claimants under the COVID-19 Unemployment Insurance program for the fiscal year ended June 30, 2023, totaled $306,150,759 which was offset by prior years’ ineligible benefit payments of $90,034,050 and return of funds from EDD debit cards that were not activated within 12 months of card issuance of $620,694,399. The sample was not a statistically valid sample. Recommendation EDD should continue to strengthen controls, such as database identification cross-matches, ID.me verification, partnerships with law enforcement and Thompson Reuters, as well as system enhancements to mitigate the potential of further employment benefit fraud. Such improvements in internal controls should improve EDD’s ability to timely prevent and detect unemployment benefit fraud. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-006 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Transportation Assistance Listing Number: 20.205 Federal Program Title: Highway Planning and Construction Federal Award Numbers and Years: Q101310; 2023 Q101403; 2023 7500257; 2023 P020177; 2023 8801073; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management §200.322 Requirements for pass-through entities (2 CFR 200.332): (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: 1. Federal award identification. i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient’s unique entity identifier; Federal Award Identification Number (FAIN); iii. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; iv. Subaward Period of Performance Start and End Date; v. Subaward Budget Period Start and End Date; vi. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; vii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; viii. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; ix. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); x. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xi. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xii. Identification of whether the award is R&D; and xiii. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. 2. All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; 3. Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; 4. i. An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the pass-through entity must determine the appropriate rate in collaboration with the subrecipient, which is either: 1. The negotiated indirect cost rate between the pass-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass-through entity is not required to collect information justifying this rate, but may elect to do so; 2. The de minimis indirect cost rate. ii. The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). 5. A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient’s records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and 6. Appropriate terms and conditions concerning closeout of the subaward. (b) Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. Condition The California Department of Transportation (Caltrans) did not clearly identify subaward agreements made to subrecipients as subawards and did not include all required elements for 5 of 40 subrecipients sampled. Additionally, the monitoring of the 5 of 40 sampled subrecipients was not sufficient to detect whether the subrecipients’ expenditures were properly reported on the respective subrecipients’ schedules of expenditures of federal awards. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Due to the decentralized administration of federal-aid highway projects, not all subaward agreements are administered in a consistent manner throughout various divisions and district offices. Effect Inadequate subaward communication may result in subrecipients being unaware of all federal laws, statutes and regulations that apply to the funding received and potentially expending the funds in an unallowable manner. Additionally, subrecipients may fail to report the expenditures made pursuant to the subawards of their schedule of expenditures of federal awards. Questioned Costs No questioned costs were identified. Context Expenditures passed to subrecipients totaled $1,222,104,172. Sampled expenditures totaled $14,694,125 and $670,937 of the total sampled expenditures related to the exceptions identified. Recommendation Caltrans should develop and implement a consistent policy and process for all divisions and district offices to use in making and monitoring subawards under the highway planning and construction program to ensure that all required subaward information is communicated to subrecipients at the time of the award and the federal funds disbursed to subrecipients are adequately monitored. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-006 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Transportation Assistance Listing Number: 20.205 Federal Program Title: Highway Planning and Construction Federal Award Numbers and Years: Q101310; 2023 Q101403; 2023 7500257; 2023 P020177; 2023 8801073; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management §200.322 Requirements for pass-through entities (2 CFR 200.332): (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: 1. Federal award identification. i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient’s unique entity identifier; Federal Award Identification Number (FAIN); iii. Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; iv. Subaward Period of Performance Start and End Date; v. Subaward Budget Period Start and End Date; vi. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; vii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; viii. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; ix. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); x. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xi. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xii. Identification of whether the award is R&D; and xiii. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. 2. All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; 3. Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports; 4. i. An approved federally recognized indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, the pass-through entity must determine the appropriate rate in collaboration with the subrecipient, which is either: 1. The negotiated indirect cost rate between the pass-through entity and the subrecipient; which can be based on a prior negotiated rate between a different PTE and the same subrecipient. If basing the rate on a previously negotiated rate, the pass-through entity is not required to collect information justifying this rate, but may elect to do so; 2. The de minimis indirect cost rate. ii. The pass-through entity must not require use of a de minimis indirect cost rate if the subrecipient has a Federally approved rate. Subrecipients can elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d). 5. A requirement that the subrecipient permit the pass-through entity and auditors to have access to the subrecipient’s records and financial statements as necessary for the pass-through entity to meet the requirements of this part; and 6. Appropriate terms and conditions concerning closeout of the subaward. (b) Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. Condition The California Department of Transportation (Caltrans) did not clearly identify subaward agreements made to subrecipients as subawards and did not include all required elements for 5 of 40 subrecipients sampled. Additionally, the monitoring of the 5 of 40 sampled subrecipients was not sufficient to detect whether the subrecipients’ expenditures were properly reported on the respective subrecipients’ schedules of expenditures of federal awards. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Due to the decentralized administration of federal-aid highway projects, not all subaward agreements are administered in a consistent manner throughout various divisions and district offices. Effect Inadequate subaward communication may result in subrecipients being unaware of all federal laws, statutes and regulations that apply to the funding received and potentially expending the funds in an unallowable manner. Additionally, subrecipients may fail to report the expenditures made pursuant to the subawards of their schedule of expenditures of federal awards. Questioned Costs No questioned costs were identified. Context Expenditures passed to subrecipients totaled $1,222,104,172. Sampled expenditures totaled $14,694,125 and $670,937 of the total sampled expenditures related to the exceptions identified. Recommendation Caltrans should develop and implement a consistent policy and process for all divisions and district offices to use in making and monitoring subawards under the highway planning and construction program to ensure that all required subaward information is communicated to subrecipients at the time of the award and the federal funds disbursed to subrecipients are adequately monitored. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-007 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Community Colleges Chancellor’s Office Assistance Listing Number: 21.027 Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds Federal Award Numbers and Years: N/A; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (c) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management §200.322 Requirements for pass-through entities (2 CFR 200.332): (d) Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. Condition The California Community Colleges Chancellor’s Office (Chancellor’s Office) did not assess each subrecipients’ risk of potential noncompliance with the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) subaward federal statutes, regulations and terms and conditions and did not adequately monitor its subrecipients (community colleges) to ensure that the community colleges complied with federal statutes, regulations, and terms and conditions of the SLFRF subaward. The SLFRF subawards included specific requirements for eligibility of students receiving SLFRF-funded emergency financial aid, which included a requirement to request eligibility certifications from students, determine if any students that received emergency financial aid were ineligible and instructions to make necessary general ledger entries to ensure any ineligible students’ financial aid was removed from the SLFRF specific funding and assigned to a nonfederal source. The Chancellor’s Office did not request or inspect any documentation from the community colleges to verify that required eligibility certifications and/or necessary general ledger entries were made by the community colleges. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The Chancellor’s Office did not establish sufficient procedures to assess each community college’s risk, conduct reviews of those community colleges that would be higher risk and validate that the community college expended the SLFRF subaward in accordance with federal statutes, regulations and terms and conditions. Effect Inadequate monitoring of subrecipients may result in funds being expended for ineligible purposes, which may not be detected and corrected in a timely manner. Questioned Costs No questioned costs were identified. Context Expenditures passed to subrecipients totaled $1,218,447,467, of which $150,000,000 was passed through by the Chancellor’s Office. Recommendation The Chancellor’s Office should develop and implement detailed subrecipient monitoring procedures, to include assessing each community college’s risk of noncompliance; conducting a review of supporting documents for those community colleges identified by the risk assessment to be at risk of noncompliance as defined by the Chancellor’s Office’s monitoring procedures; and ensuring corrective action is taken for any deficiencies identified. Regular follow-ups and documented communication efforts should be part of this process to ensure effective oversight of the SLFRF subawards. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-008 Category of Finding: Procurement and Suspension and Debarment Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.323 Federal Program Title: Epidemiology and Laboratory Capacity for Program Infectious Diseases (ELC) Federal Award Numbers and Years: NU50CK000539; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Government-Wide Guidance for Grants and Agreements. Part 180 – OMB Guidelines to Agencies on Government-Wide Debarment and Suspension (Non-procurement). Subpart C – Responsibilities of Participants Regarding Transactions Doing Business With Other Persons §180.300 (2 CFR 180.300): When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You may do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or a condition to the covered transactions with that person. Condition We noted that ten out of the ten vendor contract agreements reviewed did not include a suspension and debarment certification clause indicating the contractor was not suspended or debarred from participation in federally funded contracts. There was no other documentation available to demonstrate that the verification of suspension and debarment was performed prior to entering into the covered transactions. Based on the subsequent review of the System for Award Management (SAM) exclusions, these contractors were not suspended or debarred. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The ELC program personnel responsible for administering these federal funds were unaware of the suspension and debarment requirements. Effect Failure to verify suspension and debarment results in noncompliance with 2 CFR §180.300, as well as a risk that federal funds could be used to pay vendors that are suspended or debarred. Questioned Costs No questioned costs were identified. Context The federal funds disbursed to vendors for the fiscal year ended June 30, 2023 totaled $11,816,380. Ten of ten samples for the Epidemiology and Laboratory Capacity for Program Infectious Diseases program did not have evidence that verification of suspension and debarment was performed prior to entering into the covered transaction or include a clause or condition to the covered transaction in the agreement. Total disbursements made associated with these vendors totaled $7,567,331 for the fiscal year ended June 30, 2023. Recommendation Public Health should review and strengthen its procedures for verifying the suspension and debarment status of vendors before entering into any agreement involving federal funds and ensure that the verification documentation is maintained. Alternatively, incorporate a clause in vendor contracts requiring vendors to certify their suspension or debarment status. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-009 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.323 Federal Program Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Federal Award Number and Year: NU50CK000539; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (e) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. §200.332 Requirements for pass-through entities (2 CFR 200.332): All pass-through entities must: (a) Verify that the subrecipient is not excluded or disqualified in accordance with §180.300. Verification methods are provided in §180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient’s unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414. (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraphs (f) of this section. When evaluating a subrecipient’s risk, a pass-through entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards: (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with Subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving cross-cutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the passthrough entity may rely on the subrecipient’s cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section §200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. (g) Consider whether the results of the subrecipient’s audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity’s own records. Condition Public Health did not establish a formal risk assessment process over its subrecipients of federal awards by which to determine the frequency and extent of subrecipient monitoring to be performed. While Public Health received reimbursement invoices from subrecipients, there did not appear to be other financial or programmatic monitoring to verify subrecipients complied with applicable requirements. In addition, Public Health did not obtain supporting documentation for any expenditures invoiced by the subrecipients. Follow-up monitoring for subrecipients with no single audit reports did not appear to be performed. On-site monitoring visits were not completed. Public Health was unable to provide evidence that suspension and debarment status of subrecipients was checked prior to entering into subaward. Public Health used a Department Allocation Letter (DAL) for the COVID-19 program instead of an agreement or contract for the subaward to subrecipients. Certain required information for the subaward federal award information such as Assistance Listings number and Title and Federal Award Identification Number (FAIN) were not clearly identified in the DAL. Identification as a Repeat Finding Finding 2022-011 was reported in the immediate prior year. Cause Procedures to perform the required subrecipient monitoring were not established nor did Public Health perform an appropriate level of monitoring. Effect By not properly evaluating the risk of noncompliance, Public Health may inadvertently award grant funds to subrecipients who lack the necessary mechanisms or understanding to comply with federal statutes. This increases the likelihood of noncompliance arising during the performance of the grant-funded activities. Furthermore, failure to obtain and review single audit reports increases the risk of not properly identifying subrecipient program control weaknesses, noncompliance and performing sufficient follow-up on any subrecipient corrective action. Questioned Costs No questioned costs were identified. Context Disbursements to subrecipients for the ELC totaled $282,954,398, or 49% of total reported program expenditures. Recommendation Public Health should establish and document formal procedures for conducting risk assessments of subrecipient funding, including criteria for evaluating organizational capacity, financial stability, compliance history, and programmatic capabilities. Public Health should also develop and implement procedures outlining the process for obtaining single audit reports from subrecipients. Furthermore, a monitoring mechanism should be implemented to track compliance with the single audit mandate among subrecipients, including regular follow-ups and documentation of communication efforts. Public Health should ensure every subaward includes all requirements imposed on the subrecipient so that the federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the federal award. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-015 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2305CA5021; 2023 2305CA3002; 2023 2205CA5022; 2022 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code – WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year. §14713: (b) If the department determines that a mental health plan has failed to comply with the requirements of Chapter 7 (commencing with Section 14000), Chapter 8 (commencing with Section 14200), Chapter 8.8 (commencing with Section 14600), or this chapter, the department may impose sanctions and plans of correction pursuant to Section 14197.7. Condition Eighteen of 56 contractor counties of Short-Doyle funding were tested and seventeen had not submitted their cost reports by the December 31 due date. Five of the seventeen contractor counties have not submitted their cost reports for fiscal year 2021-22 (more than 12 months late) and thirteen of the seventeen contractor counties have subsequently submitted their cost reports for fiscal year 2021-22. Although the Mental Health Division of Health Care Services did take the required action of notifying the eighteen contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2022-008 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Medical Assistance Program to the eighteen contractor counties totaled $1,943,410,893, the seventeen noncompliant contractor counties totaled $1,871,058,835, and all 58 contractor counties totaled $2,338,031,915. For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven contractor counties totaled $94,521,685, the six noncompliant contractor counties totaled $88,716,942, and all 58 contractor counties totaled $191,348,628. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-015 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2305CA5021; 2023 2305CA3002; 2023 2205CA5022; 2022 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code – WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year. §14713: (b) If the department determines that a mental health plan has failed to comply with the requirements of Chapter 7 (commencing with Section 14000), Chapter 8 (commencing with Section 14200), Chapter 8.8 (commencing with Section 14600), or this chapter, the department may impose sanctions and plans of correction pursuant to Section 14197.7. Condition Eighteen of 56 contractor counties of Short-Doyle funding were tested and seventeen had not submitted their cost reports by the December 31 due date. Five of the seventeen contractor counties have not submitted their cost reports for fiscal year 2021-22 (more than 12 months late) and thirteen of the seventeen contractor counties have subsequently submitted their cost reports for fiscal year 2021-22. Although the Mental Health Division of Health Care Services did take the required action of notifying the eighteen contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2022-008 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Medical Assistance Program to the eighteen contractor counties totaled $1,943,410,893, the seventeen noncompliant contractor counties totaled $1,871,058,835, and all 58 contractor counties totaled $2,338,031,915. For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven contractor counties totaled $94,521,685, the six noncompliant contractor counties totaled $88,716,942, and all 58 contractor counties totaled $191,348,628. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-017 Category of Finding: Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.917 Federal Program Title: HIV Care Formula Grants COVID-19 HIV Care Formula Grants Federal Award Numbers and Years: 2 X07HA12778-14-00; 2022 6 X07HA12778-14-01; 2022 6 X07HA12778-14-02; 2023 6 X07HA12778-14-03; 2023 6 X07HA12778-14-04; 2023 6 X07HA12778-14-05; 2023 5 X07HA12778-15-00; 2023 6 X07HA12778-15-01; 2023 6 X07HA12778-15-02; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – The Public Health and Welfare. Chapter 6A – Public Health Service. Subchapter XXIV – HIV Health Care Services Program. Part B – Care Grant Program. Subpart I – General Grant Provisions. Section 300ff-26 – Provision of Treatments: (a) In general A State shall use a portion of the amounts provided under a grant awarded under section 300ff–21 of this title to establish a program under section 300ff–22(b)(3)(B) of this title to provide therapeutics to treat HIV/AIDS or prevent the serious deterioration of health arising from HIV/AIDS in eligible individuals, including measures for the prevention and treatment of opportunistic infections. (b) Eligible individual To be eligible to receive assistance from a State under this section an individual shall: (1) Have a medical diagnosis of HIV/AIDS; and (2) Be a low-income individual, as defined by the State. California State AIDS Drug Assistance Program Guidelines January 2022: (1.1) AIDS Drug Assistance Program (ADAP) Eligibility Criteria: To be eligible for the ADAP program, a client must: • Have a positive HIV/AIDS diagnosis. • Be at least 18 years old. • Be a resident of California. • Have an annual Modified Adjusted Gross Income (MAGI) that does not exceed 500 percent Federal Poverty Level (FPL) based on household size and income. • Not be fully covered by Medi-Cal or any other third-party payers (an entity that reimburses and manages health care expenses such as private insurance or governmental agencies, employers, etc.). Health Resources and Services Administration, Policy Clarification Notice 15-04 (Revised 1/11/2019): The Ryan White HIV/AIDS Program (RWHAP) legislation requires that rebates collected on ADAP medication purchases be applied to the RWHAP Part B Program with a priority, but not a requirement, that the rebates be placed back into ADAP. Although ADAP rebates are neither program income nor refunds, they are subject to the same regulatory provision regarding expenditure. These rebates must be used for the statutorily permitted purposes under the RWHAP Part B Program, which are limited to core medical services including ADAP, support services, clinical quality management, and administrative expenses (including planning and evaluation) as part of a comprehensive system of care for low-income individuals living with HIV. Condition All applications must be reviewed internally by ADAP staff via an electronic secondary review process to confirm eligibility; however, one of sixty applications was not reviewed by ADAP staff. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause There was a backlog in the secondary review of applications due to staffing issues in the ADAP Branch. Effect Public Health did not have appropriate oversight controls to ensure that the applicant’s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals that may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable because benefit costs were not tracked by individual participants. Context Pharmacy benefits management services are provided by a contractor who received administrative fees and reimbursements for prescription drug costs to program participants. Payments to the contractor totaled $106,505,302 for approximately 24,000 program participants for the fiscal year ended June 30, 2023. The sample was not a statistically valid sample. Recommendation The ADAP Branch should continue to monitor compliance with its policies to ensure secondary reviews of ADAP applications follow the established guidelines. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-017 Category of Finding: Eligibility Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.917 Federal Program Title: HIV Care Formula Grants COVID-19 HIV Care Formula Grants Federal Award Numbers and Years: 2 X07HA12778-14-00; 2022 6 X07HA12778-14-01; 2022 6 X07HA12778-14-02; 2023 6 X07HA12778-14-03; 2023 6 X07HA12778-14-04; 2023 6 X07HA12778-14-05; 2023 5 X07HA12778-15-00; 2023 6 X07HA12778-15-01; 2023 6 X07HA12778-15-02; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – The Public Health and Welfare. Chapter 6A – Public Health Service. Subchapter XXIV – HIV Health Care Services Program. Part B – Care Grant Program. Subpart I – General Grant Provisions. Section 300ff-26 – Provision of Treatments: (a) In general A State shall use a portion of the amounts provided under a grant awarded under section 300ff–21 of this title to establish a program under section 300ff–22(b)(3)(B) of this title to provide therapeutics to treat HIV/AIDS or prevent the serious deterioration of health arising from HIV/AIDS in eligible individuals, including measures for the prevention and treatment of opportunistic infections. (b) Eligible individual To be eligible to receive assistance from a State under this section an individual shall: (1) Have a medical diagnosis of HIV/AIDS; and (2) Be a low-income individual, as defined by the State. California State AIDS Drug Assistance Program Guidelines January 2022: (1.1) AIDS Drug Assistance Program (ADAP) Eligibility Criteria: To be eligible for the ADAP program, a client must: • Have a positive HIV/AIDS diagnosis. • Be at least 18 years old. • Be a resident of California. • Have an annual Modified Adjusted Gross Income (MAGI) that does not exceed 500 percent Federal Poverty Level (FPL) based on household size and income. • Not be fully covered by Medi-Cal or any other third-party payers (an entity that reimburses and manages health care expenses such as private insurance or governmental agencies, employers, etc.). Health Resources and Services Administration, Policy Clarification Notice 15-04 (Revised 1/11/2019): The Ryan White HIV/AIDS Program (RWHAP) legislation requires that rebates collected on ADAP medication purchases be applied to the RWHAP Part B Program with a priority, but not a requirement, that the rebates be placed back into ADAP. Although ADAP rebates are neither program income nor refunds, they are subject to the same regulatory provision regarding expenditure. These rebates must be used for the statutorily permitted purposes under the RWHAP Part B Program, which are limited to core medical services including ADAP, support services, clinical quality management, and administrative expenses (including planning and evaluation) as part of a comprehensive system of care for low-income individuals living with HIV. Condition All applications must be reviewed internally by ADAP staff via an electronic secondary review process to confirm eligibility; however, one of sixty applications was not reviewed by ADAP staff. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause There was a backlog in the secondary review of applications due to staffing issues in the ADAP Branch. Effect Public Health did not have appropriate oversight controls to ensure that the applicant’s eligibility was properly reviewed and approved. Accordingly, there is an increased risk for the occurrence of benefits being provided to ineligible individuals that may not be prevented or detected in a timely manner. Questioned Costs Questioned costs were not determinable because benefit costs were not tracked by individual participants. Context Pharmacy benefits management services are provided by a contractor who received administrative fees and reimbursements for prescription drug costs to program participants. Payments to the contractor totaled $106,505,302 for approximately 24,000 program participants for the fiscal year ended June 30, 2023. The sample was not a statistically valid sample. Recommendation The ADAP Branch should continue to monitor compliance with its policies to ensure secondary reviews of ADAP applications follow the established guidelines. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-018 Category of Finding: Activities Allowed or Unallowed Type of Finding: Significant Deficiency State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.959 Federal Program Title: Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 1B08TI084632-01; 2022 6B08TI084632-01M001; 2022 6B08TI084632-01M002; 2022 1B08TI083437-01; 2021 6B08TI083437-01M002; 2021 6B08TI083437-01M003; 2021 6B08TI083437-01M004; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our testing of 60 employee timesheets, the Department of Health Care Services (DHCS) did not have documentation of the approval for time charged to the Prevention and Treatment of Substance Abuse (SAPT) program for 1 of the samples tested. Identification as a Repeat Finding This is not a repeat finding from the immediate prior year. Cause Due to staffing and organizational changes, DHCS has been unable to locate the requested documentation of timesheet approval. Effect Nonadherence to the internal controls over the documentation of employee timesheets can result in the risk of noncompliance with established policies and procedures. Furthermore, the integrity of the time charged to the program can be compromised when proper documentation of approval is not readily available. Questioned Costs No questioned costs were identified. Context Expenditures related to payroll costs charged to the SAPT program for the fiscal year ended June 30, 2023 totaled $12,743,522. The sample was not a statistically valid sample. Recommendation DHCS should adhere to its processes and controls in place to ensure all timesheets are reviewed and approved by a manager or supervisor. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-018 Category of Finding: Activities Allowed or Unallowed Type of Finding: Significant Deficiency State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.959 Federal Program Title: Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers and Years: 1B08TI084632-01; 2022 6B08TI084632-01M001; 2022 6B08TI084632-01M002; 2022 1B08TI083437-01; 2021 6B08TI083437-01M002; 2021 6B08TI083437-01M003; 2021 6B08TI083437-01M004; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition During our testing of 60 employee timesheets, the Department of Health Care Services (DHCS) did not have documentation of the approval for time charged to the Prevention and Treatment of Substance Abuse (SAPT) program for 1 of the samples tested. Identification as a Repeat Finding This is not a repeat finding from the immediate prior year. Cause Due to staffing and organizational changes, DHCS has been unable to locate the requested documentation of timesheet approval. Effect Nonadherence to the internal controls over the documentation of employee timesheets can result in the risk of noncompliance with established policies and procedures. Furthermore, the integrity of the time charged to the program can be compromised when proper documentation of approval is not readily available. Questioned Costs No questioned costs were identified. Context Expenditures related to payroll costs charged to the SAPT program for the fiscal year ended June 30, 2023 totaled $12,743,522. The sample was not a statistically valid sample. Recommendation DHCS should adhere to its processes and controls in place to ensure all timesheets are reviewed and approved by a manager or supervisor. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-010 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575 Federal Program Title: Child Care and Development Block Grant (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2234CACCDD; 2022 2334CACCDD; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Government-Wide Guidance for Federal Financial Assistance. Part 170 – Reporting Subaward and Executive Compensation Information. Subpart A – General. § 170.100 Purpose of this part This part provides guidance to Federal agencies on establishing requirements for recipients of Federal awards to report information on subawards and executive total compensation, as required by the Federal Funding Accountability and Transparency Act of 2006 (Pub. L. 109-282), as amended by the Digital Accountability and Transparency Act of 2014 (Pub. L. 113-101) and other Public Laws, hereafter referred to as the “Transparency Act.” § 170.105 Applicability. (a) Applicability in general. This part applies to a Federal agency’s Federal financial assistance as defined in § 170.300. This part applies to all recipients and subrecipients of Federal awards who meet the reporting requirements of paragraph (c) of this section, unless exempt under Federal statute or by paragraph (d) of this section. (b) Non-applicability to individuals. This part does not apply to an individual who applies for or receives Federal financial assistance as a natural person (that is, unrelated to any business or nonprofit organization an individual owns or operates). (c) Reporting Requirements. (1) The names and total compensation of an entity’s five most highly compensated executives must be reported if: (i) In the entity’s preceding fiscal year, it received: (A) 80 percent or more of its annual gross revenue in Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and (B) $25,000,000 or more in annual gross revenue from Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and (ii) The public does not have access to information about the compensation of senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986. Appendix A to Part 170 — Award Term. I. Reporting Subawards and Executive Compensation (2 CFR 170): (a)(2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. (b)(2) Reporting Requirements. (i) As part of the recipient’s registration profile at https://www.sam.gov. (ii) No later than the month following the month in which this Federal award is made, and annually after that. Condition CDSS did not submit its Federal Funding Accountability and Transparency Act (FFATA) reports timely for the fiscal years ended June 30, 2023 and 2022. Grant Award Year FAIN Obligation Date FAIN Submission Due Date Submitted 2022 2234CACCDD 11/2/2021 Not Available 12/30/2021 11/15/2022 2023 2334CACCDF 10/28/2022 2334CACCDF 11/30/2022 12/8/2023 Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause CDSS has had turnover in positions responsible for filing the required FFATA reports. In addition, when CDSS assumed responsibilities over the CCDF Cluster, this function and responsibility was not clearly identified. Effect CDSS is not in compliance with 2 CFR Part 170. Questioned Costs Not applicable. Context CDSS is responsible for filing an annual FFATA report for pass-throughs to subrecipients greater than $30,000. We selected both FFATA reports that were submitted during and for the audit period. The sample was not a statistically valid sample. Recommendation We recommend that CDSS compile a report tracking process and identify all fiscal and compliance reports to be submitted with clear position responsibilities and workflow to ensure reports include accurate information and are timely prepared. CDSS should have a centralized tracking mechanism and assign and document a responsible position instead of a responsible individual person, which will reduce the risk of reports not being filed if turnover occurs. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-011 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2001CACCDF; 2020 2101CACCDF; 2021 2234CACCDF; 2022 2334CACCDF; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (b) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 45 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart G – Financial Management. § 98.65 Audits and financial reporting. (45 CFR 98.65) (d) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended.   OMB #0970-0510 – Instructions for Completion of Form ACF-696 Financial Reporting Form for the Child Care and Development Fund (CCDF) State & Territory Lead Agencies Pursuant to CCDF regulations at 45 CFR 98.65(g), and as part of the terms and conditions of the grant award, States and Territories are required to complete and submit a quarterly financial status report (ACF-696) in accordance with these instructions on behalf of the CCDF Lead Agency. Condition For the fiscal year ended June 30, 2023, $2,183,002,451 was reported on the schedule of expenditures of federal awards (Schedule) for the CCDF Cluster; however, CDSS is unable to reconcile the ACF-696 reports submitted to the amount reported on the Schedule. The Schedule is $53,163,387 greater than the cumulative quarterly reports which totaled $2,129,839,064 for the fiscal year ended June 30, 2023. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The expenditures tracked and recorded by CDSS and CDE are reported together on the ACF-696 quarterly reports. CDSS, the department responsible for filing the reports for the fiscal year ended June 30, 2023, cannot identify the expenditures at the department level and therefore is unable to reconcile the discrepancy. Effect CCDF Cluster expenditures were not accurately reported in the quarterly ACF-696 reports submitted. Questioned Costs Not applicable. Context CDSS does not have an adequate data capture and reconciliation process to support the preparation of the ACF-696 reports, which should include a year-end reconciliation to the amount reported in the Schedule. We did not sample the ACF-696 reports. We reviewed the 1st and 4th quarter reports for each open grant year and recalculated the cumulative total for the fiscal year ended June 30, 2023, and compared the result to the Schedule. Recommendation We recommend that CDSS review its procedures for capturing and reporting quarterly information in the AC-696 reports to ensure information is complete and accurate and maintain documentation supporting the amounts reported. Furthermore, we recommend that CDSS perform a year-end reconciliation of the ACF-696 reports to the amount reported in the Schedule. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-012 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACCDF; 2021 2101CACCC5; 2021 2234CACCDF; 2022 2234CACCDD; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (c) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management. §200.332 Requirements for pass-through entities (2 CFR 200.332): A pass-through entity must: (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a pass-through entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section §200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. California Code of Regulations. Title 5 Education. § 18023. Compliance Reviews of Contractors. (b) At least once every three (3) years and as resources permit, the California Department of Education shall conduct reviews at the contractor's office(s) and operating facility(ies) to determine the contractor's compliance with applicable laws, regulations or contractual provisions. Child Care and Development Fund (CCDF) Plan for State/Territory California FFY 2022-24, Amendment 4. Chapter 8 Ensure Grantee Program Integrity and Accountability. 8.1 Internal Controls and Accountability Measures to Help Ensure Program Integrity. 8.1.1 Process to train about CCDF requirements and program integrity. States and territories are required to describe effective internal controls that are in place to ensure program integrity and accountability (98.68(a)), including processes to train child care providers and staff of the Lead Agency and other agencies engaged in the administration of CCDF about program requirements and integrity. v. Monitor and assess policy implementation on an ongoing basis. The Lead Agency conducts announced Categorical Program Monitoring (CPM)/Contract Monitoring Reviews (CMRs) for each contractor on a three- or four-year cycle for non-LEAs and LEAs respectively. The Lead Agency’s Governance and Administration Unit (GAU) conducts ongoing review of individual contractors by sampling the eligibility and need documentation in family files to estimate and reduce error rates. Additionally, the Lead Agency provides ongoing training and technical assistance to contractors in regional sessions, in one-on-one sessions, and/or in cluster with webinars or during face to-face presentations. These sessions address CCDF program administration, requirements, and integrity. Condition We selected 60 subrecipient contracts (14 local educational agency (LEA) contracts and 46 non-LEA contracts) from 50 subrecipient entities and tested compliance with subrecipient monitoring requirements. We noted the following: LEAs • 3 LEA contracts/contractors had no records for the receipt of a corrective action plan or notification of resolution for findings identified in monitoring reports. • 1 LEA contract/contractor did not have the quarterly fiscal reports available for review for the quarter selected for testing. Non-LEAs • 5 non-LEA contracts/contractors had no records available to demonstrate risk assessment of the contractor. • 4 non-LEA contracts/contractors had no record of on-site monitoring in over 5 years. • 7 non-LEA contracts/contractors had no records for the receipt of the corrective action plan or notification of resolution for findings identified in monitoring reports. • 5 non-LEA contracts/contractors did not have the quarterly fiscal reports available for review for the quarters selected for testing. The monitoring of the contractors’ single audit reports and follow-up on noted findings continued to be a shared responsibility between CDSS and the Department of Education (CDE) during fiscal year 2022-23. The transition of audit report monitoring responsibilities over LEAs receiving CCDF Cluster program funds is still in process and not yet centralized with CDSS. Furthermore, subrecipients continue to report the pass-through entity as CDE and not CDSS. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause In fiscal year 2021, the administration of the CCDF Cluster program was transitioned from the California Department of Education (CDE) to CDSS. CDSS has been in the process of revising certain policies and procedures, including contractor monitoring. In addition, certain records related to CDE monitoring activities for the contracts selected were unavailable for review. Effect CDSS is at risk for contractor noncompliance if monitoring procedures are not properly designed or executed, and/or documents demonstrating monitoring are not maintained. Questioned Costs $175,631,433 of $332,931,906 sampled contract expenditures for fiscal year ended June 30, 2023. Context CDSS contractors may have multiple contracts with varying contract requirements. We selected one or more contracts from 50 different contractors for a total of 60 unique contracts representing $332,931,906 of expenditures incurred during the fiscal year ended June 30, 2023. The exceptions noted above represented 32 different contracts administered by 28 contractors and represented $175,613,433 or 52.7% of the total sampled contract expenditures. The sample was not a statistically valid sample. Recommendation To enhance the effectiveness of the annual risk assessment process, we recommend a thorough evaluation that focuses on the identification and inclusion of all subrecipients and defined risk criteria as mandated in 2 CFR 200.332. Furthermore, it is crucial to establish and document a transparent basis for risk profiling that directly correlates such profiles with compliance monitoring activities across fiscal, program, and single audit requirements. Furthermore, we recommend CDSS perform a comprehensive post-transition review to ensure all monitoring responsibilities transferred from CDE have been fully identified and assigned. This review should validate robust mechanisms are in place for the accurate documentation and proper retention of records. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-013 Category of Finding: Special Tests and Provisions – Child Care Provider Eligibility for ARP Act Stabilization Funds Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575 Federal Program Title: Child Care and Development Block Grant (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACSC6; 2021 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (d) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Assembly Bill (AB) 179 and AB 110 provided designated American Rescue Plan Act (ARPA) funding to provide supplemental rate payments and stipends to eligible child care providers. As prescribed by ARPA, to qualify for this funding a child care provider must apply and meet the following criteria: On the date of application for the award must either be: (1) open and available to provide child care services, or (2) closed due to public health, financial hardship, or other reasons relating to the COVID-19 public health emergency. In addition, the child care provider must either: (1) be eligible to serve children who receive CCDF subsidies at the time of application for stabilization funds, or (2) be licensed, regulated, or registered in the state, territory, or tribe as of March 11, 2021, and meet applicable state and local health and safety requirements at the time of application for stabilization funds. In their application for stabilization funds, a child care provider must certify: a. That the provider will, when open and providing services, implement policies in line with guidance and orders from corresponding state, territorial, tribal, and local authorities and, to the greatest extent possible, implement policies in line with guidance from the CDC. b. For each employee, the provider must pay at least the same amount in weekly wages and maintain the same benefits for the duration of the stabilization funding. c. The provider will provide relief from copayments and tuition payments for the families enrolled in the provider’s program, to the extent possible, and prioritize such relief for families struggling to make either type of payment. Condition CDSS uses a third-party service provider to administer payments to child care contractors and assist with the coordination and collection of certain information required to be eligible to receive state and federal child care funding. The third-party service provider is considered a fiduciary and not a subrecipient, thus CDSS is responsible for monitoring eligibility compliance related to the ARPA Stabilization funding. Of the 25 samples we selected for testing eligibility criteria related to the ARPA Stabilization funding, 22 contractors were determined eligible by the third-party service provider; however, the CDSS did not monitor that the third-party service provider appropriately discharged its duties and correctly determined that recipients were eligible. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause CDSS did not appropriately determine its responsibility for eligibility of ARPA Stabilization recipients and relied on the determinations of the third-party service provider without oversight. Effect CDSS did not fulfill its responsibilities for determining eligibility of ARPA Stabilization recipients. Questioned Costs $232,082,456 Context The third-party service provider used CDSS’ survey portal to capture and review information of the recipients it determined eligible. During the fiscal year ended June 30, 2023, CDSS paid the third-party service provider $232,082,456 to disburse to eligible contractors. The third-party service provider does not qualify as a subrecipient and thus is not subject to the Uniform Guidance requiring a single audit. Recommendation We recommend that CDSS review its contract with the third-party service provider and identify compliance requirements delegated to the provider and develop a monitoring program to ensure the third-party service provider is accurately fulfilling its responsibilities in determining compliance of contractors. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-014 Category of Finding: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services (CDSS) Assistance Listing Number: 93.575 Federal Program Title: Child Care and Development Block Grant (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACCDF; 2021 2101CACCC5; 2021 2101CACDC6; 2021 2234CACCDD; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (e) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart E – Program Operations (Child Care Services)—Lead Agency and Provider Requirements. §98.41 Health and safety requirements: (a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to §98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (i) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, [et. al.] (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man-caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of biocontaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and (xii) May include requirements relating to: (A) Nutrition (including age-appropriate feeding); (B) Access to physical activity; (C) Caring for children with special needs; or (D) Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children’s health and safety. (2) Include minimum health and safety training on the topics above, as described in §98.44. Condition The CDSS has not established health and safety monitoring procedures to ensure licensed-exempt providers serving children who receive subsidies comply with all applicable health and safety requirements. Accordingly, no monitoring procedures were performed on licensed-exempt providers during the fiscal year ended June 30, 2023. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Although CDSS is in process of developing a health and safety monitoring process for licensed-exempt contractors, finalization and implementation is subject to statutory and budget actions which delay the process. Effect The CDSS is not in compliance with 45 CFR §98.41. Questioned Costs No questioned costs were identified. Context CDSS was not able to isolate a complete list of subrecipient expenditures related to contractors receiving CCDF Cluster program funding that were subject to health and safety compliance for the fiscal year ended June 30, 2023; therefore, the magnitude of impact to the program cannot be determined. CDSS is in process of developing its health and safety monitoring program in collaboration with the Federal Administration of Children and Families and the State legislature. Recommendation We recommend CDSS complete its development and implementation of a monitoring process over the health and safety standards and develop a mechanism to identify and track all contracts requiring health and safety compliance monitoring. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-011 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2001CACCDF; 2020 2101CACCDF; 2021 2234CACCDF; 2022 2334CACCDF; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (b) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 45 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart G – Financial Management. § 98.65 Audits and financial reporting. (45 CFR 98.65) (d) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended.   OMB #0970-0510 – Instructions for Completion of Form ACF-696 Financial Reporting Form for the Child Care and Development Fund (CCDF) State & Territory Lead Agencies Pursuant to CCDF regulations at 45 CFR 98.65(g), and as part of the terms and conditions of the grant award, States and Territories are required to complete and submit a quarterly financial status report (ACF-696) in accordance with these instructions on behalf of the CCDF Lead Agency. Condition For the fiscal year ended June 30, 2023, $2,183,002,451 was reported on the schedule of expenditures of federal awards (Schedule) for the CCDF Cluster; however, CDSS is unable to reconcile the ACF-696 reports submitted to the amount reported on the Schedule. The Schedule is $53,163,387 greater than the cumulative quarterly reports which totaled $2,129,839,064 for the fiscal year ended June 30, 2023. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The expenditures tracked and recorded by CDSS and CDE are reported together on the ACF-696 quarterly reports. CDSS, the department responsible for filing the reports for the fiscal year ended June 30, 2023, cannot identify the expenditures at the department level and therefore is unable to reconcile the discrepancy. Effect CCDF Cluster expenditures were not accurately reported in the quarterly ACF-696 reports submitted. Questioned Costs Not applicable. Context CDSS does not have an adequate data capture and reconciliation process to support the preparation of the ACF-696 reports, which should include a year-end reconciliation to the amount reported in the Schedule. We did not sample the ACF-696 reports. We reviewed the 1st and 4th quarter reports for each open grant year and recalculated the cumulative total for the fiscal year ended June 30, 2023, and compared the result to the Schedule. Recommendation We recommend that CDSS review its procedures for capturing and reporting quarterly information in the AC-696 reports to ensure information is complete and accurate and maintain documentation supporting the amounts reported. Furthermore, we recommend that CDSS perform a year-end reconciliation of the ACF-696 reports to the amount reported in the Schedule. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-012 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACCDF; 2021 2101CACCC5; 2021 2234CACCDF; 2022 2234CACCDD; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (c) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management. §200.332 Requirements for pass-through entities (2 CFR 200.332): A pass-through entity must: (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a pass-through entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section §200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. California Code of Regulations. Title 5 Education. § 18023. Compliance Reviews of Contractors. (b) At least once every three (3) years and as resources permit, the California Department of Education shall conduct reviews at the contractor's office(s) and operating facility(ies) to determine the contractor's compliance with applicable laws, regulations or contractual provisions. Child Care and Development Fund (CCDF) Plan for State/Territory California FFY 2022-24, Amendment 4. Chapter 8 Ensure Grantee Program Integrity and Accountability. 8.1 Internal Controls and Accountability Measures to Help Ensure Program Integrity. 8.1.1 Process to train about CCDF requirements and program integrity. States and territories are required to describe effective internal controls that are in place to ensure program integrity and accountability (98.68(a)), including processes to train child care providers and staff of the Lead Agency and other agencies engaged in the administration of CCDF about program requirements and integrity. v. Monitor and assess policy implementation on an ongoing basis. The Lead Agency conducts announced Categorical Program Monitoring (CPM)/Contract Monitoring Reviews (CMRs) for each contractor on a three- or four-year cycle for non-LEAs and LEAs respectively. The Lead Agency’s Governance and Administration Unit (GAU) conducts ongoing review of individual contractors by sampling the eligibility and need documentation in family files to estimate and reduce error rates. Additionally, the Lead Agency provides ongoing training and technical assistance to contractors in regional sessions, in one-on-one sessions, and/or in cluster with webinars or during face to-face presentations. These sessions address CCDF program administration, requirements, and integrity. Condition We selected 60 subrecipient contracts (14 local educational agency (LEA) contracts and 46 non-LEA contracts) from 50 subrecipient entities and tested compliance with subrecipient monitoring requirements. We noted the following: LEAs • 3 LEA contracts/contractors had no records for the receipt of a corrective action plan or notification of resolution for findings identified in monitoring reports. • 1 LEA contract/contractor did not have the quarterly fiscal reports available for review for the quarter selected for testing. Non-LEAs • 5 non-LEA contracts/contractors had no records available to demonstrate risk assessment of the contractor. • 4 non-LEA contracts/contractors had no record of on-site monitoring in over 5 years. • 7 non-LEA contracts/contractors had no records for the receipt of the corrective action plan or notification of resolution for findings identified in monitoring reports. • 5 non-LEA contracts/contractors did not have the quarterly fiscal reports available for review for the quarters selected for testing. The monitoring of the contractors’ single audit reports and follow-up on noted findings continued to be a shared responsibility between CDSS and the Department of Education (CDE) during fiscal year 2022-23. The transition of audit report monitoring responsibilities over LEAs receiving CCDF Cluster program funds is still in process and not yet centralized with CDSS. Furthermore, subrecipients continue to report the pass-through entity as CDE and not CDSS. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause In fiscal year 2021, the administration of the CCDF Cluster program was transitioned from the California Department of Education (CDE) to CDSS. CDSS has been in the process of revising certain policies and procedures, including contractor monitoring. In addition, certain records related to CDE monitoring activities for the contracts selected were unavailable for review. Effect CDSS is at risk for contractor noncompliance if monitoring procedures are not properly designed or executed, and/or documents demonstrating monitoring are not maintained. Questioned Costs $175,631,433 of $332,931,906 sampled contract expenditures for fiscal year ended June 30, 2023. Context CDSS contractors may have multiple contracts with varying contract requirements. We selected one or more contracts from 50 different contractors for a total of 60 unique contracts representing $332,931,906 of expenditures incurred during the fiscal year ended June 30, 2023. The exceptions noted above represented 32 different contracts administered by 28 contractors and represented $175,613,433 or 52.7% of the total sampled contract expenditures. The sample was not a statistically valid sample. Recommendation To enhance the effectiveness of the annual risk assessment process, we recommend a thorough evaluation that focuses on the identification and inclusion of all subrecipients and defined risk criteria as mandated in 2 CFR 200.332. Furthermore, it is crucial to establish and document a transparent basis for risk profiling that directly correlates such profiles with compliance monitoring activities across fiscal, program, and single audit requirements. Furthermore, we recommend CDSS perform a comprehensive post-transition review to ensure all monitoring responsibilities transferred from CDE have been fully identified and assigned. This review should validate robust mechanisms are in place for the accurate documentation and proper retention of records. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-014 Category of Finding: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services (CDSS) Assistance Listing Number: 93.575 Federal Program Title: Child Care and Development Block Grant (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACCDF; 2021 2101CACCC5; 2021 2101CACDC6; 2021 2234CACCDD; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (e) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart E – Program Operations (Child Care Services)—Lead Agency and Provider Requirements. §98.41 Health and safety requirements: (a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to §98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (i) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, [et. al.] (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man-caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of biocontaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and (xii) May include requirements relating to: (A) Nutrition (including age-appropriate feeding); (B) Access to physical activity; (C) Caring for children with special needs; or (D) Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children’s health and safety. (2) Include minimum health and safety training on the topics above, as described in §98.44. Condition The CDSS has not established health and safety monitoring procedures to ensure licensed-exempt providers serving children who receive subsidies comply with all applicable health and safety requirements. Accordingly, no monitoring procedures were performed on licensed-exempt providers during the fiscal year ended June 30, 2023. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause Although CDSS is in process of developing a health and safety monitoring process for licensed-exempt contractors, finalization and implementation is subject to statutory and budget actions which delay the process. Effect The CDSS is not in compliance with 45 CFR §98.41. Questioned Costs No questioned costs were identified. Context CDSS was not able to isolate a complete list of subrecipient expenditures related to contractors receiving CCDF Cluster program funding that were subject to health and safety compliance for the fiscal year ended June 30, 2023; therefore, the magnitude of impact to the program cannot be determined. CDSS is in process of developing its health and safety monitoring program in collaboration with the Federal Administration of Children and Families and the State legislature. Recommendation We recommend CDSS complete its development and implementation of a monitoring process over the health and safety standards and develop a mechanism to identify and track all contracts requiring health and safety compliance monitoring. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-011 Category of Finding: Reporting Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2001CACCDF; 2020 2101CACCDF; 2021 2234CACCDF; 2022 2334CACCDF; 2023 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (b) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 45 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart G – Financial Management. § 98.65 Audits and financial reporting. (45 CFR 98.65) (d) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended.   OMB #0970-0510 – Instructions for Completion of Form ACF-696 Financial Reporting Form for the Child Care and Development Fund (CCDF) State & Territory Lead Agencies Pursuant to CCDF regulations at 45 CFR 98.65(g), and as part of the terms and conditions of the grant award, States and Territories are required to complete and submit a quarterly financial status report (ACF-696) in accordance with these instructions on behalf of the CCDF Lead Agency. Condition For the fiscal year ended June 30, 2023, $2,183,002,451 was reported on the schedule of expenditures of federal awards (Schedule) for the CCDF Cluster; however, CDSS is unable to reconcile the ACF-696 reports submitted to the amount reported on the Schedule. The Schedule is $53,163,387 greater than the cumulative quarterly reports which totaled $2,129,839,064 for the fiscal year ended June 30, 2023. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause The expenditures tracked and recorded by CDSS and CDE are reported together on the ACF-696 quarterly reports. CDSS, the department responsible for filing the reports for the fiscal year ended June 30, 2023, cannot identify the expenditures at the department level and therefore is unable to reconcile the discrepancy. Effect CCDF Cluster expenditures were not accurately reported in the quarterly ACF-696 reports submitted. Questioned Costs Not applicable. Context CDSS does not have an adequate data capture and reconciliation process to support the preparation of the ACF-696 reports, which should include a year-end reconciliation to the amount reported in the Schedule. We did not sample the ACF-696 reports. We reviewed the 1st and 4th quarter reports for each open grant year and recalculated the cumulative total for the fiscal year ended June 30, 2023, and compared the result to the Schedule. Recommendation We recommend that CDSS review its procedures for capturing and reporting quarterly information in the AC-696 reports to ensure information is complete and accurate and maintain documentation supporting the amounts reported. Furthermore, we recommend that CDSS perform a year-end reconciliation of the ACF-696 reports to the amount reported in the Schedule. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-012 Category of Finding: Subrecipient Monitoring Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Social Services Assistance Listing Number: 93.575, 93.596 Federal Program Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund (part of the Child Care and Development Fund Cluster) Federal Award Numbers and Years: 2101CACCDF; 2021 2101CACCC5; 2021 2234CACCDF; 2022 2234CACCDD; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (c) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management. §200.332 Requirements for pass-through entities (2 CFR 200.332): A pass-through entity must: (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a pass-through entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section §200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. California Code of Regulations. Title 5 Education. § 18023. Compliance Reviews of Contractors. (b) At least once every three (3) years and as resources permit, the California Department of Education shall conduct reviews at the contractor's office(s) and operating facility(ies) to determine the contractor's compliance with applicable laws, regulations or contractual provisions. Child Care and Development Fund (CCDF) Plan for State/Territory California FFY 2022-24, Amendment 4. Chapter 8 Ensure Grantee Program Integrity and Accountability. 8.1 Internal Controls and Accountability Measures to Help Ensure Program Integrity. 8.1.1 Process to train about CCDF requirements and program integrity. States and territories are required to describe effective internal controls that are in place to ensure program integrity and accountability (98.68(a)), including processes to train child care providers and staff of the Lead Agency and other agencies engaged in the administration of CCDF about program requirements and integrity. v. Monitor and assess policy implementation on an ongoing basis. The Lead Agency conducts announced Categorical Program Monitoring (CPM)/Contract Monitoring Reviews (CMRs) for each contractor on a three- or four-year cycle for non-LEAs and LEAs respectively. The Lead Agency’s Governance and Administration Unit (GAU) conducts ongoing review of individual contractors by sampling the eligibility and need documentation in family files to estimate and reduce error rates. Additionally, the Lead Agency provides ongoing training and technical assistance to contractors in regional sessions, in one-on-one sessions, and/or in cluster with webinars or during face to-face presentations. These sessions address CCDF program administration, requirements, and integrity. Condition We selected 60 subrecipient contracts (14 local educational agency (LEA) contracts and 46 non-LEA contracts) from 50 subrecipient entities and tested compliance with subrecipient monitoring requirements. We noted the following: LEAs • 3 LEA contracts/contractors had no records for the receipt of a corrective action plan or notification of resolution for findings identified in monitoring reports. • 1 LEA contract/contractor did not have the quarterly fiscal reports available for review for the quarter selected for testing. Non-LEAs • 5 non-LEA contracts/contractors had no records available to demonstrate risk assessment of the contractor. • 4 non-LEA contracts/contractors had no record of on-site monitoring in over 5 years. • 7 non-LEA contracts/contractors had no records for the receipt of the corrective action plan or notification of resolution for findings identified in monitoring reports. • 5 non-LEA contracts/contractors did not have the quarterly fiscal reports available for review for the quarters selected for testing. The monitoring of the contractors’ single audit reports and follow-up on noted findings continued to be a shared responsibility between CDSS and the Department of Education (CDE) during fiscal year 2022-23. The transition of audit report monitoring responsibilities over LEAs receiving CCDF Cluster program funds is still in process and not yet centralized with CDSS. Furthermore, subrecipients continue to report the pass-through entity as CDE and not CDSS. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause In fiscal year 2021, the administration of the CCDF Cluster program was transitioned from the California Department of Education (CDE) to CDSS. CDSS has been in the process of revising certain policies and procedures, including contractor monitoring. In addition, certain records related to CDE monitoring activities for the contracts selected were unavailable for review. Effect CDSS is at risk for contractor noncompliance if monitoring procedures are not properly designed or executed, and/or documents demonstrating monitoring are not maintained. Questioned Costs $175,631,433 of $332,931,906 sampled contract expenditures for fiscal year ended June 30, 2023. Context CDSS contractors may have multiple contracts with varying contract requirements. We selected one or more contracts from 50 different contractors for a total of 60 unique contracts representing $332,931,906 of expenditures incurred during the fiscal year ended June 30, 2023. The exceptions noted above represented 32 different contracts administered by 28 contractors and represented $175,613,433 or 52.7% of the total sampled contract expenditures. The sample was not a statistically valid sample. Recommendation To enhance the effectiveness of the annual risk assessment process, we recommend a thorough evaluation that focuses on the identification and inclusion of all subrecipients and defined risk criteria as mandated in 2 CFR 200.332. Furthermore, it is crucial to establish and document a transparent basis for risk profiling that directly correlates such profiles with compliance monitoring activities across fiscal, program, and single audit requirements. Furthermore, we recommend CDSS perform a comprehensive post-transition review to ensure all monitoring responsibilities transferred from CDE have been fully identified and assigned. This review should validate robust mechanisms are in place for the accurate documentation and proper retention of records. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-015 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2305CA5021; 2023 2305CA3002; 2023 2205CA5022; 2022 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code – WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year. §14713: (b) If the department determines that a mental health plan has failed to comply with the requirements of Chapter 7 (commencing with Section 14000), Chapter 8 (commencing with Section 14200), Chapter 8.8 (commencing with Section 14600), or this chapter, the department may impose sanctions and plans of correction pursuant to Section 14197.7. Condition Eighteen of 56 contractor counties of Short-Doyle funding were tested and seventeen had not submitted their cost reports by the December 31 due date. Five of the seventeen contractor counties have not submitted their cost reports for fiscal year 2021-22 (more than 12 months late) and thirteen of the seventeen contractor counties have subsequently submitted their cost reports for fiscal year 2021-22. Although the Mental Health Division of Health Care Services did take the required action of notifying the eighteen contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2022-008 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Medical Assistance Program to the eighteen contractor counties totaled $1,943,410,893, the seventeen noncompliant contractor counties totaled $1,871,058,835, and all 58 contractor counties totaled $2,338,031,915. For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven contractor counties totaled $94,521,685, the six noncompliant contractor counties totaled $88,716,942, and all 58 contractor counties totaled $191,348,628. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-016 Category of Finding: Special Tests and Provisions – Provider Health and Safety Standards Type of Finding: Material Weakness State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition There was no evidence of surveyor signature or supervisor review and approval on Form CMS 1539 for all 40 surveys of providers tested. Identification as a Repeat Finding Finding 2022-012 was reported in the immediate prior year. Cause California Department of Public Health (Public Health) did not adhere to their documented controls due to continued turnover of staff members within Public Health. Effect Nonadherence to internal controls over the review and approval process of the Form CMS-1539 can result in the risk of statewide noncompliance as providers may not meet the prescribed health and safety standards. Further, the integrity of the surveys can be compromised as they are being conducted with no documented oversight. Questioned Costs No questioned costs were identified. Context A total of 461 surveys were included in the population, which consisted of all surveys completed by Public Health for Hospitals, Intermediate Care Facilities and Individuals with Intellectual Disabilities and Nursing Facilities during the fiscal year ended June 30, 2023. The sample was not a statistically valid sample. Recommendation Public Health should update its processes and controls in place to ensure timely review and approval of the Form CMS-1539, including for situations when staff are on leave and/or have left the department. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-015 Category of Finding: Activities Allowed or Unallowed Type of Finding: Material Weakness and Material Instance of Noncompliance State Administering Department: California Department of Health Care Services (Health Care Services) Assistance Listing Number: 93.767 Federal Program Title: Children’s Health Insurance Program Federal Award Numbers and Years: 2305CA5021; 2023 2305CA3002; 2023 2205CA5022; 2022 Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). California Welfare and Institutions Code – WIC, Division 9. Public Social Services, Part 3. Aid and Medical Assistance, Chapter 8.9. Transition of Community-Based Medi-Cal Mental Health: §14705: (c) With regard to county operated facilities, clinics, or programs for which claims are submitted to the department for Medi-Cal reimbursement for specialty mental health services to Medi-Cal eligible individuals, the county shall ensure that all requirements necessary for Medi-Cal reimbursement for these services are complied with, including, but not limited to, utilization review and the submission of yearend cost reports by December 31 following the close of the fiscal year. §14713: (b) If the department determines that a mental health plan has failed to comply with the requirements of Chapter 7 (commencing with Section 14000), Chapter 8 (commencing with Section 14200), Chapter 8.8 (commencing with Section 14600), or this chapter, the department may impose sanctions and plans of correction pursuant to Section 14197.7. Condition Eighteen of 56 contractor counties of Short-Doyle funding were tested and seventeen had not submitted their cost reports by the December 31 due date. Five of the seventeen contractor counties have not submitted their cost reports for fiscal year 2021-22 (more than 12 months late) and thirteen of the seventeen contractor counties have subsequently submitted their cost reports for fiscal year 2021-22. Although the Mental Health Division of Health Care Services did take the required action of notifying the eighteen contractor counties in writing within 30 days of the noncompliance, it has not taken any additional action necessary to ensure contract and performance compliance. The cost reports are the basis for the allocation of payments made to contractor counties providing mental health services to eligible beneficiaries and serve to provide the Mental Health Division with fiscal oversight for contract and performance compliance. Identification as a Repeat Finding Finding 2022-008 was reported in the immediate prior year. Cause The Mental Health Division did not take additional action for significantly late annual cost reports because its monitoring and follow-up process does not go beyond emailing the delinquent subrecipients every 30 days. Effect Delays in reviewing cost reports do not comply with the objective of timely and effective contract monitoring. Inaccurate or untimely cost reports could result in under/over funding each contractor county and increases the risk of statewide noncompliance with contract requirements. Questioned Costs Questioned costs were not determinable. Context For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Medical Assistance Program to the eighteen contractor counties totaled $1,943,410,893, the seventeen noncompliant contractor counties totaled $1,871,058,835, and all 58 contractor counties totaled $2,338,031,915. For the fiscal year ended June 30, 2023, disbursements of Short-Doyle funding from the Children’s Health Insurance Program to the seven contractor counties totaled $94,521,685, the six noncompliant contractor counties totaled $88,716,942, and all 58 contractor counties totaled $191,348,628. The sample was not a statistically valid sample. Recommendation Health Care Services should develop and follow policies and procedures to take additional action for significantly late annual cost reports. These policies and procedures should include imposing sanctions, including, but not limited to, fines, penalties, the withholding of payments, probationary or corrective actions, or any other actions deemed necessary to promptly ensure contract and performance compliance. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-016 Category of Finding: Special Tests and Provisions – Provider Health and Safety Standards Type of Finding: Material Weakness State Administering Department: California Department of Public Health (Public Health) Assistance Listing Number: 93.778 Federal Program Title: Medical Assistance Program Federal Award Numbers and Years: 2305CA5ADM; 2023 2305CA5MAP;2023 2205CA5ADM; 2022 2205CA5MAP; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition There was no evidence of surveyor signature or supervisor review and approval on Form CMS 1539 for all 40 surveys of providers tested. Identification as a Repeat Finding Finding 2022-012 was reported in the immediate prior year. Cause California Department of Public Health (Public Health) did not adhere to their documented controls due to continued turnover of staff members within Public Health. Effect Nonadherence to internal controls over the review and approval process of the Form CMS-1539 can result in the risk of statewide noncompliance as providers may not meet the prescribed health and safety standards. Further, the integrity of the surveys can be compromised as they are being conducted with no documented oversight. Questioned Costs No questioned costs were identified. Context A total of 461 surveys were included in the population, which consisted of all surveys completed by Public Health for Hospitals, Intermediate Care Facilities and Individuals with Intellectual Disabilities and Nursing Facilities during the fiscal year ended June 30, 2023. The sample was not a statistically valid sample. Recommendation Public Health should update its processes and controls in place to ensure timely review and approval of the Form CMS-1539, including for situations when staff are on leave and/or have left the department. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Reference Number: 2023-019 Category of Finding: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency and Instance of Noncompliance State Administering Department: California Department of Social Services (CDSS) Assistance Listing Numbers: 96.001 Federal Program Title: Disability Insurance/SSI Cluster: Social Security Disability Insurance Federal Award Number and Year: 04-2204CADI00; 2022 Criteria Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart E – Cost Principles. §200.403 Factors affecting allowability of costs. Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (g) Be adequately documented. See §200.300 through §200.309.   Condition The documentation for one of forty samples selected for testing did not agree to the payment disbursed to a provider for medical evidence of record (MER) services. The provider was overpaid by $5. Identification as a Repeat Finding This was not a repeat finding from the immediate prior year. Cause CDSS has represented that the cause was an input error in the Midas subledger when processing the vendor payment. Effect CDSS did not have appropriate oversight controls to ensure that the data entry was accurate. Accordingly, there is an increased risk for data entry directly affecting the amount reported on the schedule of expenditures of federal awards to be inaccurate. Questioned Costs Questioned costs are projected to be $54,398. Context The total MER expenditures for the fiscal year ended June 30, 2023, were $4,432,781, which represents 1.8% of the total program expenditures of the Disability Insurance/SSI Cluster of $242,946,482. The sample was not a statistically valid sample. Recommendation CDSS should strengthen its controls over the review for accuracy of the provider invoice amounts input into Midas. Views of Responsible Officials and Corrective Action Plan Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.