Audit 359283

Reference Number: 2024-003 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Department of Transitional Assistance Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 244MA402S25 (10/1/2023 – 9/30/2024) 244MA441Q7503 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Reconciliation Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: States must have systems in place to reconcile all funds entering into, exiting from, and remaining in the system each day with the state’s benefit account with Treasury and EBT contractor records. This includes a reconciliation of the state’s issuance files of postings to recipient accounts with the EBT contractor. States (generally through the EBT contractor that operates the EBT system) must also have systems in place to reconcile retailer credit activity as reported into the banking system to client transactions maintained by the processor and to the funds drawn down from the EBT benefit account with Treasury. States’ EBT system processors should maintain audit trails that document the cycle of client transactions from posting to point-of-sale transactions at retailers through settlement of retailer credits. The financial and management data that comes from the EBT processor is reconciled by the state to the SNAP issuance files and settlement data to ensure that benefits are authorized by the state and funds have been properly drawn down. States’ may only draw federal funds for authorized transactions (e.g., electronic point-of-sale purchases supported by entry of a valid personal identification number (PIN) or purchases using manual vouchers with telephone verification supported by a client signature and an EBT contractor authorization number) (7 CFR sections 274.3(a)(1) and 274.4(a)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Transitional Assistance (Department) did not maintain proper documentation to support the required EBT Reconciliations. Context: The Department receives daily reconciliations from its third party vendor and performs monthly internal reconciliations. For four of four EBT Reconciliations sampled, the completed reconciliations did not have the proper reviewer signatures. Cause: The Department’s procedures were not sufficient to ensure that it maintained proper support over the EBT reconciliation process. Internal controls did not detect or prevent the error. Effect: The Department is not compliant with the EBT Reconciliation requirement and may be subject to disallowed program costs by the grantor. Improper controls over the EBT reconciliation process could result in ineligible costs being charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that documentation for EBT reconciliations is maintained in accordance with the federal program requirements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2024-004 Prior Year Finding: 2023-005 Federal Agency: U.S. Department of Agriculture State Agency: Department of Elementary and Secondary Education Federal Program: Child and Adult Care Food Program Assistance Listing Number: 10.558 Award Number and Year: 202323N202044 (10/1/2022 – 9/30/2023) 202323N202044 (10/1/2022 – 9/30/2023) 202323N105044 (10/1/2022 – 9/30/2024) 202423N115044 (10/1/2023 – 9/30/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes the subrecipient's unique entity identifier. Per 2 CFR section 200.332(e), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that it issued subawards in compliance with federal regulations. Context: For five of sixty subawards selected for testing, the Department was unable to provide documentation that it had obtained the subrecipient’s Unique Entity Identifier prior to the issuance of the subaward. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that subawards were issued in compliance with federal regulations. Internal controls did not prevent or detect the exceptions. Effect: Failure to ensure subrecipients have a registered unique entity identification number could result in unauthorized entities receiving program funding. Recommendation: The Department should review and enhance internal controls and procedures to ensure that required information is obtained prior to entering into a subrecipient agreement. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2024-003 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Department of Transitional Assistance Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 244MA402S25 (10/1/2023 – 9/30/2024) 244MA441Q7503 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Reconciliation Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: States must have systems in place to reconcile all funds entering into, exiting from, and remaining in the system each day with the state’s benefit account with Treasury and EBT contractor records. This includes a reconciliation of the state’s issuance files of postings to recipient accounts with the EBT contractor. States (generally through the EBT contractor that operates the EBT system) must also have systems in place to reconcile retailer credit activity as reported into the banking system to client transactions maintained by the processor and to the funds drawn down from the EBT benefit account with Treasury. States’ EBT system processors should maintain audit trails that document the cycle of client transactions from posting to point-of-sale transactions at retailers through settlement of retailer credits. The financial and management data that comes from the EBT processor is reconciled by the state to the SNAP issuance files and settlement data to ensure that benefits are authorized by the state and funds have been properly drawn down. States’ may only draw federal funds for authorized transactions (e.g., electronic point-of-sale purchases supported by entry of a valid personal identification number (PIN) or purchases using manual vouchers with telephone verification supported by a client signature and an EBT contractor authorization number) (7 CFR sections 274.3(a)(1) and 274.4(a)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Transitional Assistance (Department) did not maintain proper documentation to support the required EBT Reconciliations. Context: The Department receives daily reconciliations from its third party vendor and performs monthly internal reconciliations. For four of four EBT Reconciliations sampled, the completed reconciliations did not have the proper reviewer signatures. Cause: The Department’s procedures were not sufficient to ensure that it maintained proper support over the EBT reconciliation process. Internal controls did not detect or prevent the error. Effect: The Department is not compliant with the EBT Reconciliation requirement and may be subject to disallowed program costs by the grantor. Improper controls over the EBT reconciliation process could result in ineligible costs being charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that documentation for EBT reconciliations is maintained in accordance with the federal program requirements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2024-007 Prior Year Finding: 2023-007 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025), 23555DV000008 (10/1/2022 – 12/31/2024), 23555DV000005 (7/1/2023 - 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Eight of eight subawards selected for testing were not reported timely to FSRS. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. Specifically, we noted the following timely reporting exceptions: • Seven of eight subawards were issued 10/31/2023 and were due to be reported by 11/30/2023. o Four of seven were reported on 9/5/2024, or ten months late. o Three of seven were reported on 10/22/2024, or eleven months late. • One of eight subawards was issued on 1/31/2024 and was due to be reported by 2/28/2024. It was reported on 9/5/2024, or seven months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reviewed, approved and submitted timely to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved, and subsequently timely submitted to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-007 Prior Year Finding: 2023-007 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025), 23555DV000008 (10/1/2022 – 12/31/2024), 23555DV000005 (7/1/2023 - 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Eight of eight subawards selected for testing were not reported timely to FSRS. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. Specifically, we noted the following timely reporting exceptions: • Seven of eight subawards were issued 10/31/2023 and were due to be reported by 11/30/2023. o Four of seven were reported on 9/5/2024, or ten months late. o Three of seven were reported on 10/22/2024, or eleven months late. • One of eight subawards was issued on 1/31/2024 and was due to be reported by 2/28/2024. It was reported on 9/5/2024, or seven months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reviewed, approved and submitted timely to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved, and subsequently timely submitted to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-008 Prior Year Finding: 2023-008 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Earmarking Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or specific requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) was unable to provide documentation of internal controls used to ensure compliance with the program’s earmarking requirements. Context: Auditors obtained the Department’s earmarking calculation, which is shown in the allotment per the State Allotments (WIOA Title I & ES Federal to State Allocations) report. Auditors reviewed the report which supports that the earmarking requirements were met. For the one report selected for testing, the Department prepared the State Allotments report; however, the Department was unable to provide evidence that the report was reviewed and approved by program management. Therefore, auditors were unable to test the internal controls over the earmarking requirement. Cause: The Department’s internal controls are not sufficient to ensure that the earmark calculation is reviewed and approved by program management. Effect: Insufficient controls over earmarking requirements can result in undetected reporting errors and noncompliance with earmarking requirements. Questioned costs: None. Recommendation: We recommend the Department develop and document internal controls over reporting earmarking requirements to ensure that reports are accurate and that earmarking requirements are met. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-008 Prior Year Finding: 2023-008 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Earmarking Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or specific requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) was unable to provide documentation of internal controls used to ensure compliance with the program’s earmarking requirements. Context: Auditors obtained the Department’s earmarking calculation, which is shown in the allotment per the State Allotments (WIOA Title I & ES Federal to State Allocations) report. Auditors reviewed the report which supports that the earmarking requirements were met. For the one report selected for testing, the Department prepared the State Allotments report; however, the Department was unable to provide evidence that the report was reviewed and approved by program management. Therefore, auditors were unable to test the internal controls over the earmarking requirement. Cause: The Department’s internal controls are not sufficient to ensure that the earmark calculation is reviewed and approved by program management. Effect: Insufficient controls over earmarking requirements can result in undetected reporting errors and noncompliance with earmarking requirements. Questioned costs: None. Recommendation: We recommend the Department develop and document internal controls over reporting earmarking requirements to ensure that reports are accurate and that earmarking requirements are met. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-009 Prior Year Finding: 2023-009 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: DV378592255525 (10/1/2021 – 12/31/2023) 2355DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Reporting – VETS-402(A/B) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: VETS-402 (A/B), Expenditure Detail Report – This expenditure and staff utilization report separately identifies Jobs for Veterans State Grant-expenditures each quarter and year-to-date as a supplement to the DVOP and LVER SF 425, Federal Financial Reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree with supporting documentation. Context: Three of four quarterly reports did not agree with supporting documentation. Two reports for the 9/30/2023 and two reports for the 3/31/2024 quarters were selected for testing and we noted the following exceptions: • Two of two reports for the 9/30/2023 quarter did not agree with supporting documentation. In the reports for grant numbers DV-12345-20-55-5-1 and 2355DV000008-01-00, errors were noted in several line items in sections C.1 and C.3. • One of two reports for the 3/31/2024 quarters did not agree with supporting documentation. In the report for grant number 2355DV000008-01-00, errors were noted in all amounts reported in sections C.1, C.3, and C.5. Cause: The Department’s procedures were not sufficient to ensure that reports agreed with supporting documentation. Internal controls did not prevent or detect the errors. Auditors noted that the Department has not completed implementation of their corrective action plan from the prior year. Effect: Submitted reports were inaccurate. Questioned costs: Undetermined. Recommendation: We recommend the Department implement its corrective action plan from the prior year. Procedures and internal controls over reporting should be sufficient to ensure that reports are accurate and supported by documentation. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-009 Prior Year Finding: 2023-009 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: DV378592255525 (10/1/2021 – 12/31/2023) 2355DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Reporting – VETS-402(A/B) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: VETS-402 (A/B), Expenditure Detail Report – This expenditure and staff utilization report separately identifies Jobs for Veterans State Grant-expenditures each quarter and year-to-date as a supplement to the DVOP and LVER SF 425, Federal Financial Reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree with supporting documentation. Context: Three of four quarterly reports did not agree with supporting documentation. Two reports for the 9/30/2023 and two reports for the 3/31/2024 quarters were selected for testing and we noted the following exceptions: • Two of two reports for the 9/30/2023 quarter did not agree with supporting documentation. In the reports for grant numbers DV-12345-20-55-5-1 and 2355DV000008-01-00, errors were noted in several line items in sections C.1 and C.3. • One of two reports for the 3/31/2024 quarters did not agree with supporting documentation. In the report for grant number 2355DV000008-01-00, errors were noted in all amounts reported in sections C.1, C.3, and C.5. Cause: The Department’s procedures were not sufficient to ensure that reports agreed with supporting documentation. Internal controls did not prevent or detect the errors. Auditors noted that the Department has not completed implementation of their corrective action plan from the prior year. Effect: Submitted reports were inaccurate. Questioned costs: Undetermined. Recommendation: We recommend the Department implement its corrective action plan from the prior year. Procedures and internal controls over reporting should be sufficient to ensure that reports are accurate and supported by documentation. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-005 Prior Year Finding: 2023-006 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024), UI393282355A25 (10/1/2022 – 12/31/2025), 24A55UI00054 (10/1/2023 – 12/31/2026) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). BAM estimates error rates, number of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not complete BAM case investigations within the time limits established in the ET Handbook No. 395. Context: Sixty cases were selected for testing. The Department did not meet the required time limits for closing cases within 120 days. We noted that 97% of cases tested (58 of 60 cases) were closed within 120 days, which is less than the required 98%. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met the required BAM investigation time limits for closing cases. Effect: Noncompliance with BAM case investigation time limits could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-005 Prior Year Finding: 2023-006 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024), UI393282355A25 (10/1/2022 – 12/31/2025), 24A55UI00054 (10/1/2023 – 12/31/2026) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). BAM estimates error rates, number of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not complete BAM case investigations within the time limits established in the ET Handbook No. 395. Context: Sixty cases were selected for testing. The Department did not meet the required time limits for closing cases within 120 days. We noted that 97% of cases tested (58 of 60 cases) were closed within 120 days, which is less than the required 98%. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met the required BAM investigation time limits for closing cases. Effect: Noncompliance with BAM case investigation time limits could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI359502160A25 (1/1/2021 – 9/30/2023) UI379852260A25 (1/1/2021 – 9/30/2023) 23A60UR000009 (1/1/2023 – 9/30/2024) 24A60UR000073 (1/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. RESEA-related performance reports are due on the 20th day of the second month following the end of the reporting quarter. A state UI staff member must review these reports for accuracy each calendar quarter and prior to submission, in addition to being reviewed by the RESEA program lead (if a different staff member). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was unable to provide a copy of a claimant’s RESEA letter. In addition, the Department did not review performance reports prior to submission. Context: For one of sixty RESEA cases selected for testing, the Department was unable to furnish a copy of the RESEA letter sent to the claimant. Additionally, the Department lacks a formalized process for validating the accuracy of quarterly performance reports. Consequently, there was no documentation available to confirm that these reports were reviewed prior to submission. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met RESEA program and reporting requirements. The Department does not have a formal process to validate the accuracy of quarterly performance reports. Effect: The Department was unable to demonstrate that it was operating the RESEA program in accordance with federal requirements. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that RESEA program requirements are met. We further recommend the Department develop a formal process to review quarterly performance reports for accuracy prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI359502160A25 (1/1/2021 – 9/30/2023) UI379852260A25 (1/1/2021 – 9/30/2023) 23A60UR000009 (1/1/2023 – 9/30/2024) 24A60UR000073 (1/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. RESEA-related performance reports are due on the 20th day of the second month following the end of the reporting quarter. A state UI staff member must review these reports for accuracy each calendar quarter and prior to submission, in addition to being reviewed by the RESEA program lead (if a different staff member). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was unable to provide a copy of a claimant’s RESEA letter. In addition, the Department did not review performance reports prior to submission. Context: For one of sixty RESEA cases selected for testing, the Department was unable to furnish a copy of the RESEA letter sent to the claimant. Additionally, the Department lacks a formalized process for validating the accuracy of quarterly performance reports. Consequently, there was no documentation available to confirm that these reports were reviewed prior to submission. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met RESEA program and reporting requirements. The Department does not have a formal process to validate the accuracy of quarterly performance reports. Effect: The Department was unable to demonstrate that it was operating the RESEA program in accordance with federal requirements. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that RESEA program requirements are met. We further recommend the Department develop a formal process to review quarterly performance reports for accuracy prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-010 Prior Year Finding: 2023-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS timely or accurately. Context: Nine subawards were selected for testing and several of these subawards were modified multiple times after the initial award, for a total of seventeen report transmissions tested. Exceptions were noted for 17 of 17 transactions tested, and multiple exceptions were noted for several subawards. Specifically, we noted: • 8 of 17 subawards were not reported to FSRS until after they were selected for testing by auditors. The subawards were issued in December 2023 but were not reported to FSRS until December 2024. • 9 of 17 subawards were not reported to FSRS timely. The subawards were reported from one month to one year after the due date. • 2 of 17 subawards were reported inaccurately. The total of these subawards was $104,998, but $7,237,554 was reported. • 1 of 17 subawards was reported inaccurately. The amount reported for this subaward was revised in December 2024, but the revised amount did not agree with the subaward amount. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely or accurately to FSRS nor that reports were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-010 Prior Year Finding: 2023-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS timely or accurately. Context: Nine subawards were selected for testing and several of these subawards were modified multiple times after the initial award, for a total of seventeen report transmissions tested. Exceptions were noted for 17 of 17 transactions tested, and multiple exceptions were noted for several subawards. Specifically, we noted: • 8 of 17 subawards were not reported to FSRS until after they were selected for testing by auditors. The subawards were issued in December 2023 but were not reported to FSRS until December 2024. • 9 of 17 subawards were not reported to FSRS timely. The subawards were reported from one month to one year after the due date. • 2 of 17 subawards were reported inaccurately. The total of these subawards was $104,998, but $7,237,554 was reported. • 1 of 17 subawards was reported inaccurately. The amount reported for this subaward was revised in December 2024, but the revised amount did not agree with the subaward amount. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely or accurately to FSRS nor that reports were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-010 Prior Year Finding: 2023-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS timely or accurately. Context: Nine subawards were selected for testing and several of these subawards were modified multiple times after the initial award, for a total of seventeen report transmissions tested. Exceptions were noted for 17 of 17 transactions tested, and multiple exceptions were noted for several subawards. Specifically, we noted: • 8 of 17 subawards were not reported to FSRS until after they were selected for testing by auditors. The subawards were issued in December 2023 but were not reported to FSRS until December 2024. • 9 of 17 subawards were not reported to FSRS timely. The subawards were reported from one month to one year after the due date. • 2 of 17 subawards were reported inaccurately. The total of these subawards was $104,998, but $7,237,554 was reported. • 1 of 17 subawards was reported inaccurately. The amount reported for this subaward was revised in December 2024, but the revised amount did not agree with the subaward amount. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely or accurately to FSRS nor that reports were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-011 Prior Year Finding: 2023-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA38535QH0 (4/1/2022 – 6/30/2025) AA38535OC0 (4/1/2022 – 6/30/2025) AA38535OE0 (4/1/2022 – 6/30/2025) AY000020IS0 (4/1/2023 – 6/30/2026) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Nine ETA 9130 reports were selected for testing, which included four reports for the Adult program, three reports for the Dislocated Worker program, and two reports for the Youth program. For 5 of the 9 reports tested, exceptions were noted for several line items on each report. Specifically, we noted the following exceptions: • 2 of 4 reports for the Adult program did not agree to supporting documentation. The discrepancies were found in the following line items: o Federal share of expenditures o Total administration expenditures o Federal share of unliquidated obligations. • 1 of 3 reports for the Dislocated Worker program did not agree to support documentation. The discrepancy was found in the following line item: o Federal share of unliquidated obligations. • 2 of 2 reports for the Youth program did not agree to supporting documentation. The discrepancies were found in the following line item: o Federal share of unliquidated obligations. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-011 Prior Year Finding: 2023-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA38535QH0 (4/1/2022 – 6/30/2025) AA38535OC0 (4/1/2022 – 6/30/2025) AA38535OE0 (4/1/2022 – 6/30/2025) AY000020IS0 (4/1/2023 – 6/30/2026) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Nine ETA 9130 reports were selected for testing, which included four reports for the Adult program, three reports for the Dislocated Worker program, and two reports for the Youth program. For 5 of the 9 reports tested, exceptions were noted for several line items on each report. Specifically, we noted the following exceptions: • 2 of 4 reports for the Adult program did not agree to supporting documentation. The discrepancies were found in the following line items: o Federal share of expenditures o Total administration expenditures o Federal share of unliquidated obligations. • 1 of 3 reports for the Dislocated Worker program did not agree to support documentation. The discrepancy was found in the following line item: o Federal share of unliquidated obligations. • 2 of 2 reports for the Youth program did not agree to supporting documentation. The discrepancies were found in the following line item: o Federal share of unliquidated obligations. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-011 Prior Year Finding: 2023-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA38535QH0 (4/1/2022 – 6/30/2025) AA38535OC0 (4/1/2022 – 6/30/2025) AA38535OE0 (4/1/2022 – 6/30/2025) AY000020IS0 (4/1/2023 – 6/30/2026) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Nine ETA 9130 reports were selected for testing, which included four reports for the Adult program, three reports for the Dislocated Worker program, and two reports for the Youth program. For 5 of the 9 reports tested, exceptions were noted for several line items on each report. Specifically, we noted the following exceptions: • 2 of 4 reports for the Adult program did not agree to supporting documentation. The discrepancies were found in the following line items: o Federal share of expenditures o Total administration expenditures o Federal share of unliquidated obligations. • 1 of 3 reports for the Dislocated Worker program did not agree to support documentation. The discrepancy was found in the following line item: o Federal share of unliquidated obligations. • 2 of 2 reports for the Youth program did not agree to supporting documentation. The discrepancies were found in the following line item: o Federal share of unliquidated obligations. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-012 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was unable to provide documentation to support a negative expenditure adjustment made to the program. Context: The Department was unable to provide documentation supporting one of three negative expenditure adjustments selected for testing. The adjustment was for an expenditure correction for $174,735 and auditors could not verify its accuracy nor that the adjustment had been reviewed and approved. Cause: The Agency’s procedures were not sufficient to ensure that expenditure adjustments were properly supported and documented. Internal controls did not detect or prevent the errors. Effect: Failure to maintain supporting documentation of expenditure adjustments could result in unallowable costs being charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-012 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was unable to provide documentation to support a negative expenditure adjustment made to the program. Context: The Department was unable to provide documentation supporting one of three negative expenditure adjustments selected for testing. The adjustment was for an expenditure correction for $174,735 and auditors could not verify its accuracy nor that the adjustment had been reviewed and approved. Cause: The Agency’s procedures were not sufficient to ensure that expenditure adjustments were properly supported and documented. Internal controls did not detect or prevent the errors. Effect: Failure to maintain supporting documentation of expenditure adjustments could result in unallowable costs being charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-012 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was unable to provide documentation to support a negative expenditure adjustment made to the program. Context: The Department was unable to provide documentation supporting one of three negative expenditure adjustments selected for testing. The adjustment was for an expenditure correction for $174,735 and auditors could not verify its accuracy nor that the adjustment had been reviewed and approved. Cause: The Agency’s procedures were not sufficient to ensure that expenditure adjustments were properly supported and documented. Internal controls did not detect or prevent the errors. Effect: Failure to maintain supporting documentation of expenditure adjustments could result in unallowable costs being charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-013 Prior Year Finding: 2023-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Three of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. This resulted in the amount charged to the program being based on budgeted allocation and not based on the employee’s actual time and effort on the program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Questioned costs: Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-013 Prior Year Finding: 2023-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Three of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. This resulted in the amount charged to the program being based on budgeted allocation and not based on the employee’s actual time and effort on the program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Questioned costs: Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-013 Prior Year Finding: 2023-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Three of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. This resulted in the amount charged to the program being based on budgeted allocation and not based on the employee’s actual time and effort on the program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Questioned costs: Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-014 Prior Year Finding: 2023-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued to their subrecipients. Context: Six out of seventeen subrecipients were selected for testing. For six of six subawards selected, the subaward agreement did not include the federal award date for when the Federal agency awarded the funds to the prime recipient. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information in accordance with 2 CFR section 200.332. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-014 Prior Year Finding: 2023-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued to their subrecipients. Context: Six out of seventeen subrecipients were selected for testing. For six of six subawards selected, the subaward agreement did not include the federal award date for when the Federal agency awarded the funds to the prime recipient. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information in accordance with 2 CFR section 200.332. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-014 Prior Year Finding: 2023-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued to their subrecipients. Context: Six out of seventeen subrecipients were selected for testing. For six of six subawards selected, the subaward agreement did not include the federal award date for when the Federal agency awarded the funds to the prime recipient. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information in accordance with 2 CFR section 200.332. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-015 Prior Year Finding: 2023-014 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve ETA-9130 reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exception was noted: Statewide Activities requirement 3: For 1 of 2 reports selected for testing, the Department was unable to provide sufficient supporting documentation for the recaptured funds expended. The 25% limit was $960,962, but the actual amount expended was $973,266. The Department indicated the cause of exceeding the 25% limit was due to recaptured funds not expended by the local area within the two-year period allowed and these funds were returned to the State. However, the Department did not maintain sufficient documentation to support the specific amount of recaptured funds being expended at the state level. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained documentation supporting recaptured funds. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, and that documentation is maintained and readily available for audit. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-015 Prior Year Finding: 2023-014 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve ETA-9130 reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exception was noted: Statewide Activities requirement 3: For 1 of 2 reports selected for testing, the Department was unable to provide sufficient supporting documentation for the recaptured funds expended. The 25% limit was $960,962, but the actual amount expended was $973,266. The Department indicated the cause of exceeding the 25% limit was due to recaptured funds not expended by the local area within the two-year period allowed and these funds were returned to the State. However, the Department did not maintain sufficient documentation to support the specific amount of recaptured funds being expended at the state level. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained documentation supporting recaptured funds. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, and that documentation is maintained and readily available for audit. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-015 Prior Year Finding: 2023-014 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve ETA-9130 reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exception was noted: Statewide Activities requirement 3: For 1 of 2 reports selected for testing, the Department was unable to provide sufficient supporting documentation for the recaptured funds expended. The 25% limit was $960,962, but the actual amount expended was $973,266. The Department indicated the cause of exceeding the 25% limit was due to recaptured funds not expended by the local area within the two-year period allowed and these funds were returned to the State. However, the Department did not maintain sufficient documentation to support the specific amount of recaptured funds being expended at the state level. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained documentation supporting recaptured funds. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, and that documentation is maintained and readily available for audit. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation Section III – Findings and Questioned Costs – Major Federal Programs (Continued) of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS. Context: None of the six subawards selected for testing were reported to FSRS. Total subawards were $14,194,730 and $0 was reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation Section III – Findings and Questioned Costs – Major Federal Programs (Continued) of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS. Context: None of the six subawards selected for testing were reported to FSRS. Total subawards were $14,194,730 and $0 was reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation Section III – Findings and Questioned Costs – Major Federal Programs (Continued) of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS. Context: None of the six subawards selected for testing were reported to FSRS. Total subawards were $14,194,730 and $0 was reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-017 Prior Year Finding: 2023-021 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): (a) A State agency which serves a State with multiple planning and service areas, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) earmark calculation was not reviewed and approved by program management. Context: Auditors obtained the Department’s earmark calculation and agreed the calculation to supporting documentation and recalculated the required threshold, noting the Department is in compliance with the earmarking requirements. It was noted that the earmark calculation was prepared by the State Planner; however, the calculation was not reviewed and approved by program management. Questioned costs: Undetermined. Cause: The Department’s internal controls are not sufficient to ensure that the earmark calculation is reviewed and approved by program management. Effect: Failure to review and approve the earmark calculation could allow an error to be undetected and lead to the Department being out of compliance with the requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the earmark calculation is reviewed and approved by program management. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-017 Prior Year Finding: 2023-021 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): (a) A State agency which serves a State with multiple planning and service areas, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) earmark calculation was not reviewed and approved by program management. Context: Auditors obtained the Department’s earmark calculation and agreed the calculation to supporting documentation and recalculated the required threshold, noting the Department is in compliance with the earmarking requirements. It was noted that the earmark calculation was prepared by the State Planner; however, the calculation was not reviewed and approved by program management. Questioned costs: Undetermined. Cause: The Department’s internal controls are not sufficient to ensure that the earmark calculation is reviewed and approved by program management. Effect: Failure to review and approve the earmark calculation could allow an error to be undetected and lead to the Department being out of compliance with the requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the earmark calculation is reviewed and approved by program management. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-017 Prior Year Finding: 2023-021 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): (a) A State agency which serves a State with multiple planning and service areas, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) earmark calculation was not reviewed and approved by program management. Context: Auditors obtained the Department’s earmark calculation and agreed the calculation to supporting documentation and recalculated the required threshold, noting the Department is in compliance with the earmarking requirements. It was noted that the earmark calculation was prepared by the State Planner; however, the calculation was not reviewed and approved by program management. Questioned costs: Undetermined. Cause: The Department’s internal controls are not sufficient to ensure that the earmark calculation is reviewed and approved by program management. Effect: Failure to review and approve the earmark calculation could allow an error to be undetected and lead to the Department being out of compliance with the requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the earmark calculation is reviewed and approved by program management. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-018 Prior Year Finding: 2023-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a), pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes obtaining the subrecipient’s unique entity identifier. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) issued subawards that did not contain all required federal information. The Department also did not obtain a subrecipient’s unique entity identifier. Context: Six of six subawards selected for testing did not include the following required federal award information: • Federal Award Identification Number (FAIN); • Federal Award Date; • Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; and, • Assistance Listings title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement. For one of six subrecipients selected for testing, the Department did not obtain the subrecipient’s unique entity identifier prior to issuing the subaward. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it provided all required federal information to subrecipients and obtained unique entity identifiers for all subrecipients. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Failure to obtain subrecipients’ unique entity identifiers prevents the Department from properly identifying its subrecipients. Recommendation: The Department should review and enhance internal controls and procedures to ensure that it obtains subrecipients’ unique entity identifiers and that all required information is included in all subaward agreements. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-018 Prior Year Finding: 2023-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a), pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes obtaining the subrecipient’s unique entity identifier. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) issued subawards that did not contain all required federal information. The Department also did not obtain a subrecipient’s unique entity identifier. Context: Six of six subawards selected for testing did not include the following required federal award information: • Federal Award Identification Number (FAIN); • Federal Award Date; • Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; and, • Assistance Listings title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement. For one of six subrecipients selected for testing, the Department did not obtain the subrecipient’s unique entity identifier prior to issuing the subaward. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it provided all required federal information to subrecipients and obtained unique entity identifiers for all subrecipients. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Failure to obtain subrecipients’ unique entity identifiers prevents the Department from properly identifying its subrecipients. Recommendation: The Department should review and enhance internal controls and procedures to ensure that it obtains subrecipients’ unique entity identifiers and that all required information is included in all subaward agreements. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-018 Prior Year Finding: 2023-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a), pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes obtaining the subrecipient’s unique entity identifier. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) issued subawards that did not contain all required federal information. The Department also did not obtain a subrecipient’s unique entity identifier. Context: Six of six subawards selected for testing did not include the following required federal award information: • Federal Award Identification Number (FAIN); • Federal Award Date; • Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; and, • Assistance Listings title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement. For one of six subrecipients selected for testing, the Department did not obtain the subrecipient’s unique entity identifier prior to issuing the subaward. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it provided all required federal information to subrecipients and obtained unique entity identifiers for all subrecipients. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Failure to obtain subrecipients’ unique entity identifiers prevents the Department from properly identifying its subrecipients. Recommendation: The Department should review and enhance internal controls and procedures to ensure that it obtains subrecipients’ unique entity identifiers and that all required information is included in all subaward agreements. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-019 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 5 NH23IP922629 (7/1/2019-6/30/2025) 6 NH23IP922629 (7/1/2019-6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Public Health (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Seven subawards were selected for testing and the following exceptions were noted: • 4 of 7 subawards, totaling $696,159, were not reported to FSRS. The Department was unable to provide documentation pertaining to these subawards, therefore, the award issuance dates cannot be determined. • 3 of 7 subawards, totaling $2,012,286, were not reported timely to FSRS. The subawards were issued in July and September 2023 but were not reported until July 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has not completed implementation of its corrective action plan from the prior audit. Effect: The subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit. It should establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to the FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-019 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 5 NH23IP922629 (7/1/2019-6/30/2025) 6 NH23IP922629 (7/1/2019-6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Public Health (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Seven subawards were selected for testing and the following exceptions were noted: • 4 of 7 subawards, totaling $696,159, were not reported to FSRS. The Department was unable to provide documentation pertaining to these subawards, therefore, the award issuance dates cannot be determined. • 3 of 7 subawards, totaling $2,012,286, were not reported timely to FSRS. The subawards were issued in July and September 2023 but were not reported until July 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has not completed implementation of its corrective action plan from the prior audit. Effect: The subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit. It should establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to the FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Public Health (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: None of the eight subawards selected for testing were reported to FSRS. Total subawards were $6,922,656 and $0 was reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Public Health (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: None of the eight subawards selected for testing were reported to FSRS. Total subawards were $6,922,656 and $0 was reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases, COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Non-federal entities are required to submit Financial and Performance Measure Reports in accordance with the terms and conditions of the Federal award. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not review and approve performance and financial reports prior to submission and a performance report was not submitted timely. Context: The following reports were selected for testing: Financial Reports: COVID and ARPA Financial Reporting for the 9/30/2023 and 6/30/2024 quarters and Core Base Grant Report for the 9/30/2023 and 6/30/2024 quarters for a total of four financial reports tested. Performance Reports: The 2023 Annual Performance Measures Report and the Performance Report for 2023 for a total of two performance reports tested. The following exceptions were noted: • Four of four quarterly Financial Reports were not reviewed or approved prior to submission. • Two of two Performance Reports were not reviewed or approved prior to submission. • One of two Performance Reports was not submitted timely. The June 2023 monthly performance report was due 7/16/2023 but was not submitted until 7/18/2023. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure that financial and performance reports were reviewed prior to submission and were submitted timely. Effect: Failure to review and approve reports prior to submission could allow reporting errors to be undetected. Untimely submission of performance reports could impact the Federal Agency’s ability to oversee the program. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that performance reports are submitted timely and that the review and approval process of financial and performance reports is documented prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases, COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Non-federal entities are required to submit Financial and Performance Measure Reports in accordance with the terms and conditions of the Federal award. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not review and approve performance and financial reports prior to submission and a performance report was not submitted timely. Context: The following reports were selected for testing: Financial Reports: COVID and ARPA Financial Reporting for the 9/30/2023 and 6/30/2024 quarters and Core Base Grant Report for the 9/30/2023 and 6/30/2024 quarters for a total of four financial reports tested. Performance Reports: The 2023 Annual Performance Measures Report and the Performance Report for 2023 for a total of two performance reports tested. The following exceptions were noted: • Four of four quarterly Financial Reports were not reviewed or approved prior to submission. • Two of two Performance Reports were not reviewed or approved prior to submission. • One of two Performance Reports was not submitted timely. The June 2023 monthly performance report was due 7/16/2023 but was not submitted until 7/18/2023. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure that financial and performance reports were reviewed prior to submission and were submitted timely. Effect: Failure to review and approve reports prior to submission could allow reporting errors to be undetected. Untimely submission of performance reports could impact the Federal Agency’s ability to oversee the program. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that performance reports are submitted timely and that the review and approval process of financial and performance reports is documented prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) omitted required federal award information from subawards it issued from the program. Context: For eight of eight subawards selected for testing, the following required information was omitted from the subaward agreements: • Federal Award Identification Number (FAIN) • Federal Award Date • Name of the Federal Agency and contact information for awarding official of the pass-through entity. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) omitted required federal award information from subawards it issued from the program. Context: For eight of eight subawards selected for testing, the following required information was omitted from the subaward agreements: • Federal Award Identification Number (FAIN) • Federal Award Date • Name of the Federal Agency and contact information for awarding official of the pass-through entity. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: COVID-19 - Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2101MATANFC6 (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – ACF-196P – Pandemic Emergency Assistance Fund Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: ACF-196P – Pandemic Emergency Assistance Fund Report - Each state must report expenditures for the Pandemic Emergency Assistance Fund within 90 days of the end of each federal fiscal year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The annual ACF-196P report was not submitted timely by the Department of Transitional Assistance (Department). Context: The FFY 2023 annual report was due by December 29, 2023, but was not submitted until January 31, 2024. Cause: The Department’s procedures were not sufficient to ensure that the annual ACF-196P report was submitted timely. Internal controls did not prevent or detect the error. Effect: The Department was not in compliance with the program’s reporting requirements. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are submitted timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – ACF-204 - Annual Report including the Annual Report on State Maintenance-of-Effort Programs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: ACF-204 - Annual Report including the Annual Report on State Maintenance-of-Effort (MOE) Programs - Each state must file an annual report containing information on the TANF program and the state’s MOE program(s) for that year, including strategies to implement the Family Violence Option, state diversion programs, and other program characteristics. Each state must complete the ACF-204 for each program for which the state has claimed basic MOE expenditures for the fiscal year. States may submit this electronically through the On-Line Data Collection (OLDC) System. The annual report is due at the same time as the fourth quarter data reports — i.e., 45 days after the end of the fourth quarter, but no later than December 31. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The annual ACF-204 report was not submitted timely by the Department of Transitional Assistance (Department). Context: The FFY 2023 annual report was due November 14, 2023, but was not submitted until January 2, 2024. Cause: The Department’s procedures were not sufficient to ensure that the annual ACF-204 report was submitted timely. Internal controls did not prevent or detect the error. Effect: The Department was not in compliance with the program’s reporting requirements. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are submitted timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – ACF-209 - SSP-MOE Data Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: ACF-209 – SSP-MOE Data Report - If a State claims MOE expenditures for separate State programs (SSPs) and for persons served by those programs, it must collect and report this information on the SSP-MOE Data Report on SSP-MOE families receiving assistance only as follows: (1) If the State wishes to receive a high performance bonus, it must file the information in sections one and three of the SSP-MOE Data Report; and (2) if the State wishes to quality for caseload reduction credit, it must file the information in all three sections of the SSP-MOE Data Report. Reports for each sample month in a quarter are due in the Central Office of the Administration for Children and Families within 45 days following the end of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Department of Transitional Assistance (Department) did not agree with supporting documentation and were not submitted timely. Context: Two of four quarterly reports were selected for testing which included data for forty program participants. The following exceptions were noted: • For two of two reports, participant data reported for four of forty program participants did not agree with supporting documentation. Specifically, we noted the following: o Two program participants had zero earned income but this field was left blank on the report. o One program participant had a change in unsubsidized hours that was documented and reviewed by a program specialist; however, there was no process in place to ensure the changes to unsubsidized hours worked were updated in the Benefit Eligibility and Control Online Network (BEACON) and updated for the ACF-209 report. Although there was a difference in the number of hours reported in the ACF-209 report and the BEACON Program Module, the difference in the total number of hours did not impact the participants benefit amount or participation code. • One of two reports was not submitted timely. The 9/30/2023 quarterly report was due 11/14/2023 and was submitted on 12/15/2023. Cause: The Department’s procedures were not sufficient to ensure that reports were submitted timely and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: The Department was not in compliance with the program’s reporting requirements. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are supported by documentation and are submitted timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-026 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Child Support Non-Cooperation Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: If the state agency responsible for administering the state plan approved under Title IV-D of the Social Security Act determines that an individual is not cooperating with the state in establishing paternity, or in establishing, modifying or enforcing a support order with respect to a child of the individual, and reports that information to the state agency responsible for TANF, the state TANF agency must (1) deduct an amount equal to not less than 25 percent from the TANF assistance that would otherwise be provided to the family of the individual, and (2) may deny the family any TANF assistance. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Transitional Assistance (Department) did not apply sanctions in a timely manner to individuals who were not cooperating with the state. Context: Thirteen clients were selected for testing, and the following exceptions were noted: • For one of thirteen clients, a sanction letter was issued on June 27, 2024, but the Department did not reduce benefits until March 11, 2025. Therefore, the sanction amount of $196 per month was implemented eight months late, resulting in ineligible benefits paid in the amount of $1,568. • For one of thirteen clients, a sanction letter was issued on March 26, 2024, but the Department did not reduce benefits until August 27, 2024. Therefore, the sanction amount of $162 per month was implemented five months late, resulting in ineligible benefits paid in the amount $810. Cause: The Department’s procedures were not sufficient to ensure that sanctions established for Child Support Non-Cooperation were implemented timely. Effect: Sanctions to individuals who did not cooperate with Child Support were not properly implemented by the Department, resulting in overpayment of benefits. Questioned costs: $2,378, the benefit amounts that should have been sanctioned. Recommendation: We recommend the Department evaluate its procedures and internal controls over Child Support Non-Cooperation to ensure that sanctions are applied timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to: (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Transitional Assistance (Department) was unable to demonstrate that it had maintained adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. Context: The Benefit Eligibility and Control Online Network (BEACON) system is used by the Department to manage TANF benefits and participant data. Work verification data contained in BEACON was incomplete or did not agree with supporting documentation. Forty participants were selected for testing and the following exceptions were noted: • Per program requirements, self-employment cannot be self-attested. For six self-employed participants from a sample of forty participants, the Department was unable to provide additional documentation supporting work hours for the participants who were self-employed. • For four of forty participants, data in BEACON used to verify reported hours of work did not agree with supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that information maintained in BEACON was complete and accurate. Internal controls did not prevent or detect these errors. Effect: Data used to calculate work participation rates was not properly verified by the Department and could allow ineligible individuals to receive benefits from the program. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls to ensure that information used to verify work participation is complete, accurate, and agrees with supporting documentation. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-028 Prior Year Finding: 2023-026 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2401MALIEA (10/1/2023 – 9/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Three out of the eight subawards selected for testing were not reported to the FSRS. These subawards were issued on 10/1/2023, but have yet to be reported. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-029 Prior Year Finding: 2023-027 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Reporting – Special Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Quarterly Performance and Management Report (OMB No. 0970-0589) – Grant recipients must submit data and information about LIHEAP during the current fiscal year (FY) to the Federal LIHEAP Office; including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, and training and technical assistance needs. The quarterly reports are due to the Federal LIHEAP Office one month after the end of each calendar quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Quarterly Performance and Management Report submitted by the Executive Office of Housing and Livable Communities (Department) did not agree to supporting documentation. Context: For 1 of 2 Quarterly Performance and Management Reports selected for testing, discrepancies were identified between the reported amounts and the supporting documentation for several line items. These exceptions were noted in Sections I and II of the 9/30/2023 quarterly report. Specifically, the following variances were noted: • Number of assisted households Q4 – The report indicated 9,650 households, whereas the supporting documentation reflected 9,716 households, resulting in a variance of 66 households. • Number of occurrences of households where LIHEAP prevented the loss of home energy Q4 – The report indicated 1,660 occurrences, whereas the supporting documentation reflected 1,897 occurrences, resulting in a variance of 237 occurrences. • Number of occurrences of households where LIHEAP restored home energy Q4 – The report indicated 386 occurrences, whereas supporting documentation reflected 389 occurrences, resulting in a variance of 3 households. Cause: The Department’s procedures were not sufficient to ensure that special reports were accurate and agreed with supporting documentation. Internal controls were not sufficient to prevent or detect the errors prior to submission. Effect: Inaccuracies in special reports could impact the Federal agency’s ability to manage the program, could result in delays in annual awards, and could result in possible penalties or sanctions imposed by the grantor. Questioned costs: None. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that special reports are submitted accurately, and that the information reported agrees to supporting documentation. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-030 Prior Year Finding: 2023-028 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) 2401MALIEA (10/1/2023 – 9/30/2025) 2401MALIEE (10/1/2023 – 9/30/2025) 2401MALIEI (10/1/12023 – 9/30/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) omitted required federal award information from subawards it issued from the program. Context: Twelve subawards to six subrecipients were selected for testing. For six of twelve subawards issued, the Federal Award Identification Number (FAIN) was not included in the subaward agreements. For twelve of twelve subawards issued, the Federal Award Date was not included in the subaward agreements. Cause: Per discussion with the Department, it has not implemented its corrective action plan from the prior year and intends to include all required federal award information beginning with its federal fiscal year 2025 contracts. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department complete its corrective action plan from the prior year. It should ensure its internal controls and procedures are sufficient to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Early Education and Care (Department) did not report subaward information to FSRS. Context: The Department informed auditors that no subawards were reported to FSRS. Therefore, a sample was unavailable for testing. Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Early Education and Care (Department) did not report subaward information to FSRS. Context: The Department informed auditors that no subawards were reported to FSRS. Therefore, a sample was unavailable for testing. Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Fraud Detection and Repayment Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies shall recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud (45 CFR section 98.60). The Department of Early Education and Care’s (Department) procedures require issuance of a decision letter to the parent at the conclusion of an investigation. The letter must include the recoupment amount, Agreement to Repay, and the termination date. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not promptly recover a fraudulent payment. Context: According to the Department’s Bureau of Special Investigations policy, when a case is returned to the Department for final disposition and a parent has an active Request for Review, the assigned Financial Assistance Specialist is required to issue a decision letter including the recoupment amount, Agreement to Repay, and the termination date. For one of three fraud cases selected for testing, the Department did not issue a decision letter to the client at the conclusion of the fraud investigation. The investigation concluded on 6/19/2024 but the decision letter was not issued until 2/15/2025. Therefore, the recovery was not performed timely. Cause: The Department’s procedures were not sufficient to ensure that decision letters were issued promptly at the conclusion of the fraud investigation and that the recovery of funds was performed timely. Internal controls did not prevent or detect the error. Effect: Failure to promptly issue decision letters delays recoupment of fraudulent payments. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that, at the conclusion of fraud investigations, decision letters are issued promptly and that repayments are received timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Fraud Detection and Repayment Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies shall recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud (45 CFR section 98.60). The Department of Early Education and Care’s (Department) procedures require issuance of a decision letter to the parent at the conclusion of an investigation. The letter must include the recoupment amount, Agreement to Repay, and the termination date. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not promptly recover a fraudulent payment. Context: According to the Department’s Bureau of Special Investigations policy, when a case is returned to the Department for final disposition and a parent has an active Request for Review, the assigned Financial Assistance Specialist is required to issue a decision letter including the recoupment amount, Agreement to Repay, and the termination date. For one of three fraud cases selected for testing, the Department did not issue a decision letter to the client at the conclusion of the fraud investigation. The investigation concluded on 6/19/2024 but the decision letter was not issued until 2/15/2025. Therefore, the recovery was not performed timely. Cause: The Department’s procedures were not sufficient to ensure that decision letters were issued promptly at the conclusion of the fraud investigation and that the recovery of funds was performed timely. Internal controls did not prevent or detect the error. Effect: Failure to promptly issue decision letters delays recoupment of fraudulent payments. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that, at the conclusion of fraud investigations, decision letters are issued promptly and that repayments are received timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-036 Prior Year Finding: 2023-025 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH), Executive Office of Housing and Livable Communities (EOHLC) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (DPH) and the Executive Office of Housing and Livable Communities (EOHLC) omitted required federal award information from subawards issued from the program. Context: Twenty subawards issued to thirteen subrecipients were selected for testing for DPH. Twenty of twenty subawards were missing required federal award information. Specifically, we noted the following: • 20 of 20 subawards were missing the Federal Award Identification Number (FAIN) and the Federal Award Date. • 6 of 20 subawards were missing the clause stating that the Federal Award must be used in accordance with Federal statutes, regulations and the terms and conditions of the Federal Award. • 5 of 20 subawards were missing the Indirect Cost Rate for the Federal Award. • 3 of 20 subawards were missing the Name of the Federal Awarding Agency, the contact information for the awarding official of the pass-through entity, the Assistance Listing Number and Program Name. • 1 of 20 subawards was missing the following: o Amount of Federal Funds Obligated by this action o Total Amount of Federal Funds Obligated o Total Amount of the Federal Award o Federal Award Project Description • 1 of 20 subawards was missing the subrecipient’s unique entity identifier. Five subawards issued to five subrecipients were selected for testing for EOHLC. Five of five subawards were missing the following required federal award information: • Federal Award Identification Number (FAIN) • Federal Award Date • Name of the Federal Awarding Agency and contact information for awarding official of the pass-through entity • Assistance Listing Number and Name Cause: Per discussion with the Department, it has not implemented its corrective action plan from the prior year and intends to include all required federal award information beginning with its federal fiscal year 2025 contracts. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department complete its corrective action plan from the prior year. It should ensure its internal controls and procedures are sufficient to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-037 Prior Year Finding: 2023-033 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information to FSRS within thirty days after subaward issuance. Context: Thirteen subawards were selected for testing and the following exceptions were noted: • Twelve of thirteen subawards were not reported timely to FSRS. The subawards were issued 7/1/2023 and were not reported to FSRS until 3/28/2024, or seven months after the due date. • One of thirteen subawards was not reported to FSRS. The subaward was issued on 7/1/2023 but it has not been reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has not completed implementation of its corrective action plan from the prior audit year. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit year. It should establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-038 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency Federal Program: Disaster Grants – Public Assistance (Presidentially Declared Disasters), COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (2020) FEMA-4651-DR (2022) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Massachusetts Emergency Management Agency (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Thirty of the forty subawards selected for testing were not reported to the FSRS in accordance with FFATA requirements. The following exceptions were noted: • 4 of 40 subawards were inaccurately reported. The total of the subawards was $14,652,284, but $29,265,187 was reported. • 3 of 40 subawards, totaling $6,245,292, were not reported to FSRS. • 22 of 40 subawards, totaling $47,614,805, were not reported timely. The reports were submitted from one day to one year late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-038 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency Federal Program: Disaster Grants – Public Assistance (Presidentially Declared Disasters), COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (2020) FEMA-4651-DR (2022) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Massachusetts Emergency Management Agency (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Thirty of the forty subawards selected for testing were not reported to the FSRS in accordance with FFATA requirements. The following exceptions were noted: • 4 of 40 subawards were inaccurately reported. The total of the subawards was $14,652,284, but $29,265,187 was reported. • 3 of 40 subawards, totaling $6,245,292, were not reported to FSRS. • 22 of 40 subawards, totaling $47,614,805, were not reported timely. The reports were submitted from one day to one year late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-039 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency (Agency) Federal Program: COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (1/20/2020 and continuing) Compliance Requirement: Allowable Costs / Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency was unable to provide documentation to support the allowability, approval, and proper accounting of expenditures charged to the program. Context: Forty invoices were selected for testing and the following exceptions were noted: • For 4 of 40 invoices, support could not be provided to verify that the invoices had been charged to the correct general ledger codes and that the costs were allowable under the program. • For 3 of 40 invoices, payment details could not be verified because support did not include the check amount or the check date. • For 5 of 40 invoices, there was no evidence of approval of the purchase order or invoice. Cause: The Agency’s procedures were not sufficient to ensure that expenditures charged to the program were allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Internal controls did not detect or prevent the errors. Effect: Unallowable costs could be charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-039 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency (Agency) Federal Program: COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (1/20/2020 and continuing) Compliance Requirement: Allowable Costs / Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency was unable to provide documentation to support the allowability, approval, and proper accounting of expenditures charged to the program. Context: Forty invoices were selected for testing and the following exceptions were noted: • For 4 of 40 invoices, support could not be provided to verify that the invoices had been charged to the correct general ledger codes and that the costs were allowable under the program. • For 3 of 40 invoices, payment details could not be verified because support did not include the check amount or the check date. • For 5 of 40 invoices, there was no evidence of approval of the purchase order or invoice. Cause: The Agency’s procedures were not sufficient to ensure that expenditures charged to the program were allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Internal controls did not detect or prevent the errors. Effect: Unallowable costs could be charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-003 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Department of Transitional Assistance Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 244MA402S25 (10/1/2023 – 9/30/2024) 244MA441Q7503 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Reconciliation Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: States must have systems in place to reconcile all funds entering into, exiting from, and remaining in the system each day with the state’s benefit account with Treasury and EBT contractor records. This includes a reconciliation of the state’s issuance files of postings to recipient accounts with the EBT contractor. States (generally through the EBT contractor that operates the EBT system) must also have systems in place to reconcile retailer credit activity as reported into the banking system to client transactions maintained by the processor and to the funds drawn down from the EBT benefit account with Treasury. States’ EBT system processors should maintain audit trails that document the cycle of client transactions from posting to point-of-sale transactions at retailers through settlement of retailer credits. The financial and management data that comes from the EBT processor is reconciled by the state to the SNAP issuance files and settlement data to ensure that benefits are authorized by the state and funds have been properly drawn down. States’ may only draw federal funds for authorized transactions (e.g., electronic point-of-sale purchases supported by entry of a valid personal identification number (PIN) or purchases using manual vouchers with telephone verification supported by a client signature and an EBT contractor authorization number) (7 CFR sections 274.3(a)(1) and 274.4(a)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Transitional Assistance (Department) did not maintain proper documentation to support the required EBT Reconciliations. Context: The Department receives daily reconciliations from its third party vendor and performs monthly internal reconciliations. For four of four EBT Reconciliations sampled, the completed reconciliations did not have the proper reviewer signatures. Cause: The Department’s procedures were not sufficient to ensure that it maintained proper support over the EBT reconciliation process. Internal controls did not detect or prevent the error. Effect: The Department is not compliant with the EBT Reconciliation requirement and may be subject to disallowed program costs by the grantor. Improper controls over the EBT reconciliation process could result in ineligible costs being charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that documentation for EBT reconciliations is maintained in accordance with the federal program requirements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2024-004 Prior Year Finding: 2023-005 Federal Agency: U.S. Department of Agriculture State Agency: Department of Elementary and Secondary Education Federal Program: Child and Adult Care Food Program Assistance Listing Number: 10.558 Award Number and Year: 202323N202044 (10/1/2022 – 9/30/2023) 202323N202044 (10/1/2022 – 9/30/2023) 202323N105044 (10/1/2022 – 9/30/2024) 202423N115044 (10/1/2023 – 9/30/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes the subrecipient's unique entity identifier. Per 2 CFR section 200.332(e), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) was unable to provide documentation that it issued subawards in compliance with federal regulations. Context: For five of sixty subawards selected for testing, the Department was unable to provide documentation that it had obtained the subrecipient’s Unique Entity Identifier prior to the issuance of the subaward. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that subawards were issued in compliance with federal regulations. Internal controls did not prevent or detect the exceptions. Effect: Failure to ensure subrecipients have a registered unique entity identification number could result in unauthorized entities receiving program funding. Recommendation: The Department should review and enhance internal controls and procedures to ensure that required information is obtained prior to entering into a subrecipient agreement. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2024-003 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Department of Transitional Assistance Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 244MA402S25 (10/1/2023 – 9/30/2024) 244MA441Q7503 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Reconciliation Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: States must have systems in place to reconcile all funds entering into, exiting from, and remaining in the system each day with the state’s benefit account with Treasury and EBT contractor records. This includes a reconciliation of the state’s issuance files of postings to recipient accounts with the EBT contractor. States (generally through the EBT contractor that operates the EBT system) must also have systems in place to reconcile retailer credit activity as reported into the banking system to client transactions maintained by the processor and to the funds drawn down from the EBT benefit account with Treasury. States’ EBT system processors should maintain audit trails that document the cycle of client transactions from posting to point-of-sale transactions at retailers through settlement of retailer credits. The financial and management data that comes from the EBT processor is reconciled by the state to the SNAP issuance files and settlement data to ensure that benefits are authorized by the state and funds have been properly drawn down. States’ may only draw federal funds for authorized transactions (e.g., electronic point-of-sale purchases supported by entry of a valid personal identification number (PIN) or purchases using manual vouchers with telephone verification supported by a client signature and an EBT contractor authorization number) (7 CFR sections 274.3(a)(1) and 274.4(a)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Transitional Assistance (Department) did not maintain proper documentation to support the required EBT Reconciliations. Context: The Department receives daily reconciliations from its third party vendor and performs monthly internal reconciliations. For four of four EBT Reconciliations sampled, the completed reconciliations did not have the proper reviewer signatures. Cause: The Department’s procedures were not sufficient to ensure that it maintained proper support over the EBT reconciliation process. Internal controls did not detect or prevent the error. Effect: The Department is not compliant with the EBT Reconciliation requirement and may be subject to disallowed program costs by the grantor. Improper controls over the EBT reconciliation process could result in ineligible costs being charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that documentation for EBT reconciliations is maintained in accordance with the federal program requirements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2024-007 Prior Year Finding: 2023-007 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025), 23555DV000008 (10/1/2022 – 12/31/2024), 23555DV000005 (7/1/2023 - 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Eight of eight subawards selected for testing were not reported timely to FSRS. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. Specifically, we noted the following timely reporting exceptions: • Seven of eight subawards were issued 10/31/2023 and were due to be reported by 11/30/2023. o Four of seven were reported on 9/5/2024, or ten months late. o Three of seven were reported on 10/22/2024, or eleven months late. • One of eight subawards was issued on 1/31/2024 and was due to be reported by 2/28/2024. It was reported on 9/5/2024, or seven months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reviewed, approved and submitted timely to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved, and subsequently timely submitted to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-007 Prior Year Finding: 2023-007 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025), 23555DV000008 (10/1/2022 – 12/31/2024), 23555DV000005 (7/1/2023 - 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Eight of eight subawards selected for testing were not reported timely to FSRS. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. Specifically, we noted the following timely reporting exceptions: • Seven of eight subawards were issued 10/31/2023 and were due to be reported by 11/30/2023. o Four of seven were reported on 9/5/2024, or ten months late. o Three of seven were reported on 10/22/2024, or eleven months late. • One of eight subawards was issued on 1/31/2024 and was due to be reported by 2/28/2024. It was reported on 9/5/2024, or seven months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reviewed, approved and submitted timely to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved, and subsequently timely submitted to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-008 Prior Year Finding: 2023-008 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Earmarking Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or specific requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) was unable to provide documentation of internal controls used to ensure compliance with the program’s earmarking requirements. Context: Auditors obtained the Department’s earmarking calculation, which is shown in the allotment per the State Allotments (WIOA Title I & ES Federal to State Allocations) report. Auditors reviewed the report which supports that the earmarking requirements were met. For the one report selected for testing, the Department prepared the State Allotments report; however, the Department was unable to provide evidence that the report was reviewed and approved by program management. Therefore, auditors were unable to test the internal controls over the earmarking requirement. Cause: The Department’s internal controls are not sufficient to ensure that the earmark calculation is reviewed and approved by program management. Effect: Insufficient controls over earmarking requirements can result in undetected reporting errors and noncompliance with earmarking requirements. Questioned costs: None. Recommendation: We recommend the Department develop and document internal controls over reporting earmarking requirements to ensure that reports are accurate and that earmarking requirements are met. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-008 Prior Year Finding: 2023-008 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: ES387362255A25 (7/1/2022 – 9/30/2025) Compliance Requirement: Earmarking Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or specific requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) was unable to provide documentation of internal controls used to ensure compliance with the program’s earmarking requirements. Context: Auditors obtained the Department’s earmarking calculation, which is shown in the allotment per the State Allotments (WIOA Title I & ES Federal to State Allocations) report. Auditors reviewed the report which supports that the earmarking requirements were met. For the one report selected for testing, the Department prepared the State Allotments report; however, the Department was unable to provide evidence that the report was reviewed and approved by program management. Therefore, auditors were unable to test the internal controls over the earmarking requirement. Cause: The Department’s internal controls are not sufficient to ensure that the earmark calculation is reviewed and approved by program management. Effect: Insufficient controls over earmarking requirements can result in undetected reporting errors and noncompliance with earmarking requirements. Questioned costs: None. Recommendation: We recommend the Department develop and document internal controls over reporting earmarking requirements to ensure that reports are accurate and that earmarking requirements are met. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-009 Prior Year Finding: 2023-009 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: DV378592255525 (10/1/2021 – 12/31/2023) 2355DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Reporting – VETS-402(A/B) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: VETS-402 (A/B), Expenditure Detail Report – This expenditure and staff utilization report separately identifies Jobs for Veterans State Grant-expenditures each quarter and year-to-date as a supplement to the DVOP and LVER SF 425, Federal Financial Reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree with supporting documentation. Context: Three of four quarterly reports did not agree with supporting documentation. Two reports for the 9/30/2023 and two reports for the 3/31/2024 quarters were selected for testing and we noted the following exceptions: • Two of two reports for the 9/30/2023 quarter did not agree with supporting documentation. In the reports for grant numbers DV-12345-20-55-5-1 and 2355DV000008-01-00, errors were noted in several line items in sections C.1 and C.3. • One of two reports for the 3/31/2024 quarters did not agree with supporting documentation. In the report for grant number 2355DV000008-01-00, errors were noted in all amounts reported in sections C.1, C.3, and C.5. Cause: The Department’s procedures were not sufficient to ensure that reports agreed with supporting documentation. Internal controls did not prevent or detect the errors. Auditors noted that the Department has not completed implementation of their corrective action plan from the prior year. Effect: Submitted reports were inaccurate. Questioned costs: Undetermined. Recommendation: We recommend the Department implement its corrective action plan from the prior year. Procedures and internal controls over reporting should be sufficient to ensure that reports are accurate and supported by documentation. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-009 Prior Year Finding: 2023-009 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: DV378592255525 (10/1/2021 – 12/31/2023) 2355DV000008 (10/1/2022 – 12/31/2024) Compliance Requirement: Reporting – VETS-402(A/B) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: VETS-402 (A/B), Expenditure Detail Report – This expenditure and staff utilization report separately identifies Jobs for Veterans State Grant-expenditures each quarter and year-to-date as a supplement to the DVOP and LVER SF 425, Federal Financial Reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree with supporting documentation. Context: Three of four quarterly reports did not agree with supporting documentation. Two reports for the 9/30/2023 and two reports for the 3/31/2024 quarters were selected for testing and we noted the following exceptions: • Two of two reports for the 9/30/2023 quarter did not agree with supporting documentation. In the reports for grant numbers DV-12345-20-55-5-1 and 2355DV000008-01-00, errors were noted in several line items in sections C.1 and C.3. • One of two reports for the 3/31/2024 quarters did not agree with supporting documentation. In the report for grant number 2355DV000008-01-00, errors were noted in all amounts reported in sections C.1, C.3, and C.5. Cause: The Department’s procedures were not sufficient to ensure that reports agreed with supporting documentation. Internal controls did not prevent or detect the errors. Auditors noted that the Department has not completed implementation of their corrective action plan from the prior year. Effect: Submitted reports were inaccurate. Questioned costs: Undetermined. Recommendation: We recommend the Department implement its corrective action plan from the prior year. Procedures and internal controls over reporting should be sufficient to ensure that reports are accurate and supported by documentation. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-005 Prior Year Finding: 2023-006 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024), UI393282355A25 (10/1/2022 – 12/31/2025), 24A55UI00054 (10/1/2023 – 12/31/2026) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). BAM estimates error rates, number of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not complete BAM case investigations within the time limits established in the ET Handbook No. 395. Context: Sixty cases were selected for testing. The Department did not meet the required time limits for closing cases within 120 days. We noted that 97% of cases tested (58 of 60 cases) were closed within 120 days, which is less than the required 98%. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met the required BAM investigation time limits for closing cases. Effect: Noncompliance with BAM case investigation time limits could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-005 Prior Year Finding: 2023-006 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024), UI393282355A25 (10/1/2022 – 12/31/2025), 24A55UI00054 (10/1/2023 – 12/31/2026) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). BAM estimates error rates, number of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not complete BAM case investigations within the time limits established in the ET Handbook No. 395. Context: Sixty cases were selected for testing. The Department did not meet the required time limits for closing cases within 120 days. We noted that 97% of cases tested (58 of 60 cases) were closed within 120 days, which is less than the required 98%. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met the required BAM investigation time limits for closing cases. Effect: Noncompliance with BAM case investigation time limits could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI359502160A25 (1/1/2021 – 9/30/2023) UI379852260A25 (1/1/2021 – 9/30/2023) 23A60UR000009 (1/1/2023 – 9/30/2024) 24A60UR000073 (1/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. RESEA-related performance reports are due on the 20th day of the second month following the end of the reporting quarter. A state UI staff member must review these reports for accuracy each calendar quarter and prior to submission, in addition to being reviewed by the RESEA program lead (if a different staff member). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was unable to provide a copy of a claimant’s RESEA letter. In addition, the Department did not review performance reports prior to submission. Context: For one of sixty RESEA cases selected for testing, the Department was unable to furnish a copy of the RESEA letter sent to the claimant. Additionally, the Department lacks a formalized process for validating the accuracy of quarterly performance reports. Consequently, there was no documentation available to confirm that these reports were reviewed prior to submission. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met RESEA program and reporting requirements. The Department does not have a formal process to validate the accuracy of quarterly performance reports. Effect: The Department was unable to demonstrate that it was operating the RESEA program in accordance with federal requirements. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that RESEA program requirements are met. We further recommend the Department develop a formal process to review quarterly performance reports for accuracy prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI359502160A25 (1/1/2021 – 9/30/2023) UI379852260A25 (1/1/2021 – 9/30/2023) 23A60UR000009 (1/1/2023 – 9/30/2024) 24A60UR000073 (1/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. RESEA-related performance reports are due on the 20th day of the second month following the end of the reporting quarter. A state UI staff member must review these reports for accuracy each calendar quarter and prior to submission, in addition to being reviewed by the RESEA program lead (if a different staff member). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was unable to provide a copy of a claimant’s RESEA letter. In addition, the Department did not review performance reports prior to submission. Context: For one of sixty RESEA cases selected for testing, the Department was unable to furnish a copy of the RESEA letter sent to the claimant. Additionally, the Department lacks a formalized process for validating the accuracy of quarterly performance reports. Consequently, there was no documentation available to confirm that these reports were reviewed prior to submission. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met RESEA program and reporting requirements. The Department does not have a formal process to validate the accuracy of quarterly performance reports. Effect: The Department was unable to demonstrate that it was operating the RESEA program in accordance with federal requirements. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that RESEA program requirements are met. We further recommend the Department develop a formal process to review quarterly performance reports for accuracy prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-010 Prior Year Finding: 2023-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS timely or accurately. Context: Nine subawards were selected for testing and several of these subawards were modified multiple times after the initial award, for a total of seventeen report transmissions tested. Exceptions were noted for 17 of 17 transactions tested, and multiple exceptions were noted for several subawards. Specifically, we noted: • 8 of 17 subawards were not reported to FSRS until after they were selected for testing by auditors. The subawards were issued in December 2023 but were not reported to FSRS until December 2024. • 9 of 17 subawards were not reported to FSRS timely. The subawards were reported from one month to one year after the due date. • 2 of 17 subawards were reported inaccurately. The total of these subawards was $104,998, but $7,237,554 was reported. • 1 of 17 subawards was reported inaccurately. The amount reported for this subaward was revised in December 2024, but the revised amount did not agree with the subaward amount. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely or accurately to FSRS nor that reports were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-010 Prior Year Finding: 2023-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS timely or accurately. Context: Nine subawards were selected for testing and several of these subawards were modified multiple times after the initial award, for a total of seventeen report transmissions tested. Exceptions were noted for 17 of 17 transactions tested, and multiple exceptions were noted for several subawards. Specifically, we noted: • 8 of 17 subawards were not reported to FSRS until after they were selected for testing by auditors. The subawards were issued in December 2023 but were not reported to FSRS until December 2024. • 9 of 17 subawards were not reported to FSRS timely. The subawards were reported from one month to one year after the due date. • 2 of 17 subawards were reported inaccurately. The total of these subawards was $104,998, but $7,237,554 was reported. • 1 of 17 subawards was reported inaccurately. The amount reported for this subaward was revised in December 2024, but the revised amount did not agree with the subaward amount. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely or accurately to FSRS nor that reports were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-010 Prior Year Finding: 2023-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information to FSRS timely or accurately. Context: Nine subawards were selected for testing and several of these subawards were modified multiple times after the initial award, for a total of seventeen report transmissions tested. Exceptions were noted for 17 of 17 transactions tested, and multiple exceptions were noted for several subawards. Specifically, we noted: • 8 of 17 subawards were not reported to FSRS until after they were selected for testing by auditors. The subawards were issued in December 2023 but were not reported to FSRS until December 2024. • 9 of 17 subawards were not reported to FSRS timely. The subawards were reported from one month to one year after the due date. • 2 of 17 subawards were reported inaccurately. The total of these subawards was $104,998, but $7,237,554 was reported. • 1 of 17 subawards was reported inaccurately. The amount reported for this subaward was revised in December 2024, but the revised amount did not agree with the subaward amount. In addition, the Department was unable to produce documentation supporting their review and approval of the tested FFATA reports prior to submission in the FSRS system. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely or accurately to FSRS nor that reports were reviewed and approved prior to submission. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None. Recommendation: The Department should implement procedures and internal controls to ensure that all required subawards are reviewed, approved and subsequently reported timely to FSRS no later than the end of the month following the month of issuance. Documentation of implemented controls should be readily available for auditors. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-011 Prior Year Finding: 2023-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA38535QH0 (4/1/2022 – 6/30/2025) AA38535OC0 (4/1/2022 – 6/30/2025) AA38535OE0 (4/1/2022 – 6/30/2025) AY000020IS0 (4/1/2023 – 6/30/2026) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Nine ETA 9130 reports were selected for testing, which included four reports for the Adult program, three reports for the Dislocated Worker program, and two reports for the Youth program. For 5 of the 9 reports tested, exceptions were noted for several line items on each report. Specifically, we noted the following exceptions: • 2 of 4 reports for the Adult program did not agree to supporting documentation. The discrepancies were found in the following line items: o Federal share of expenditures o Total administration expenditures o Federal share of unliquidated obligations. • 1 of 3 reports for the Dislocated Worker program did not agree to support documentation. The discrepancy was found in the following line item: o Federal share of unliquidated obligations. • 2 of 2 reports for the Youth program did not agree to supporting documentation. The discrepancies were found in the following line item: o Federal share of unliquidated obligations. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-011 Prior Year Finding: 2023-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA38535QH0 (4/1/2022 – 6/30/2025) AA38535OC0 (4/1/2022 – 6/30/2025) AA38535OE0 (4/1/2022 – 6/30/2025) AY000020IS0 (4/1/2023 – 6/30/2026) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Nine ETA 9130 reports were selected for testing, which included four reports for the Adult program, three reports for the Dislocated Worker program, and two reports for the Youth program. For 5 of the 9 reports tested, exceptions were noted for several line items on each report. Specifically, we noted the following exceptions: • 2 of 4 reports for the Adult program did not agree to supporting documentation. The discrepancies were found in the following line items: o Federal share of expenditures o Total administration expenditures o Federal share of unliquidated obligations. • 1 of 3 reports for the Dislocated Worker program did not agree to support documentation. The discrepancy was found in the following line item: o Federal share of unliquidated obligations. • 2 of 2 reports for the Youth program did not agree to supporting documentation. The discrepancies were found in the following line item: o Federal share of unliquidated obligations. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-011 Prior Year Finding: 2023-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA38535QH0 (4/1/2022 – 6/30/2025) AA38535OC0 (4/1/2022 – 6/30/2025) AA38535OE0 (4/1/2022 – 6/30/2025) AY000020IS0 (4/1/2023 – 6/30/2026) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Nine ETA 9130 reports were selected for testing, which included four reports for the Adult program, three reports for the Dislocated Worker program, and two reports for the Youth program. For 5 of the 9 reports tested, exceptions were noted for several line items on each report. Specifically, we noted the following exceptions: • 2 of 4 reports for the Adult program did not agree to supporting documentation. The discrepancies were found in the following line items: o Federal share of expenditures o Total administration expenditures o Federal share of unliquidated obligations. • 1 of 3 reports for the Dislocated Worker program did not agree to support documentation. The discrepancy was found in the following line item: o Federal share of unliquidated obligations. • 2 of 2 reports for the Youth program did not agree to supporting documentation. The discrepancies were found in the following line item: o Federal share of unliquidated obligations. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-012 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was unable to provide documentation to support a negative expenditure adjustment made to the program. Context: The Department was unable to provide documentation supporting one of three negative expenditure adjustments selected for testing. The adjustment was for an expenditure correction for $174,735 and auditors could not verify its accuracy nor that the adjustment had been reviewed and approved. Cause: The Agency’s procedures were not sufficient to ensure that expenditure adjustments were properly supported and documented. Internal controls did not detect or prevent the errors. Effect: Failure to maintain supporting documentation of expenditure adjustments could result in unallowable costs being charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-012 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was unable to provide documentation to support a negative expenditure adjustment made to the program. Context: The Department was unable to provide documentation supporting one of three negative expenditure adjustments selected for testing. The adjustment was for an expenditure correction for $174,735 and auditors could not verify its accuracy nor that the adjustment had been reviewed and approved. Cause: The Agency’s procedures were not sufficient to ensure that expenditure adjustments were properly supported and documented. Internal controls did not detect or prevent the errors. Effect: Failure to maintain supporting documentation of expenditure adjustments could result in unallowable costs being charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-012 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was unable to provide documentation to support a negative expenditure adjustment made to the program. Context: The Department was unable to provide documentation supporting one of three negative expenditure adjustments selected for testing. The adjustment was for an expenditure correction for $174,735 and auditors could not verify its accuracy nor that the adjustment had been reviewed and approved. Cause: The Agency’s procedures were not sufficient to ensure that expenditure adjustments were properly supported and documented. Internal controls did not detect or prevent the errors. Effect: Failure to maintain supporting documentation of expenditure adjustments could result in unallowable costs being charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-013 Prior Year Finding: 2023-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Three of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. This resulted in the amount charged to the program being based on budgeted allocation and not based on the employee’s actual time and effort on the program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Questioned costs: Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-013 Prior Year Finding: 2023-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Three of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. This resulted in the amount charged to the program being based on budgeted allocation and not based on the employee’s actual time and effort on the program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Questioned costs: Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-013 Prior Year Finding: 2023-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Three of sixty employee timesheets selected for testing did not use combination codes and the employee’s time was defaulted to a budgeted grant allocation. This resulted in the amount charged to the program being based on budgeted allocation and not based on the employee’s actual time and effort on the program. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Questioned costs: Undetermined amount related to budgeted combination codes. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-014 Prior Year Finding: 2023-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued to their subrecipients. Context: Six out of seventeen subrecipients were selected for testing. For six of six subawards selected, the subaward agreement did not include the federal award date for when the Federal agency awarded the funds to the prime recipient. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information in accordance with 2 CFR section 200.332. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-014 Prior Year Finding: 2023-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued to their subrecipients. Context: Six out of seventeen subrecipients were selected for testing. For six of six subawards selected, the subaward agreement did not include the federal award date for when the Federal agency awarded the funds to the prime recipient. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information in accordance with 2 CFR section 200.332. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-014 Prior Year Finding: 2023-012 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AY000057 (4/1/2024 – 6/30/2027), 23A55AY000020 (4/1/2023 – 6/30/2026), 23A55AT000036 (7/1/2023 – 6/30/2026), 23A55AW000048 (7/1/2023 – 6/30/2026), AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025), AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued to their subrecipients. Context: Six out of seventeen subrecipients were selected for testing. For six of six subawards selected, the subaward agreement did not include the federal award date for when the Federal agency awarded the funds to the prime recipient. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information in accordance with 2 CFR section 200.332. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-015 Prior Year Finding: 2023-014 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve ETA-9130 reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exception was noted: Statewide Activities requirement 3: For 1 of 2 reports selected for testing, the Department was unable to provide sufficient supporting documentation for the recaptured funds expended. The 25% limit was $960,962, but the actual amount expended was $973,266. The Department indicated the cause of exceeding the 25% limit was due to recaptured funds not expended by the local area within the two-year period allowed and these funds were returned to the State. However, the Department did not maintain sufficient documentation to support the specific amount of recaptured funds being expended at the state level. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained documentation supporting recaptured funds. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, and that documentation is maintained and readily available for audit. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-015 Prior Year Finding: 2023-014 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve ETA-9130 reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exception was noted: Statewide Activities requirement 3: For 1 of 2 reports selected for testing, the Department was unable to provide sufficient supporting documentation for the recaptured funds expended. The 25% limit was $960,962, but the actual amount expended was $973,266. The Department indicated the cause of exceeding the 25% limit was due to recaptured funds not expended by the local area within the two-year period allowed and these funds were returned to the State. However, the Department did not maintain sufficient documentation to support the specific amount of recaptured funds being expended at the state level. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained documentation supporting recaptured funds. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, and that documentation is maintained and readily available for audit. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-015 Prior Year Finding: 2023-014 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-36325-21-55-A-25 (4/1/2021 – 6/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Earmarking requirements for Statewide Activities include the following: (1) The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under Section 129(b) or statewide employment and training activities for adults or dislocated workers under section 134(a) (Section 128(a), WIOA, 128 Stat. 1502). (2) Not more than 5 percent of the funds allotted to a state under Section 127(b)(1)(C) of WIOA shall be used by the state for administrative activities related to youth workforce investment and employment and training activities (Section 129(b)(3), WIOA, 128 Stat 1508). (3) The state must reserve for rapid response activities a portion of funds, up to 25 percent, allotted for dislocated workers. The funds are used to plan and deliver services to enable dislocated workers to transition to new employment as quickly as possible, following either a permanent closure or mass layoff, or a natural or other disaster resulting in a mass job relocation (20 CFR section 682.350; sections 133(a)(2) and 134(a)(2)(A), WIOA, 128 Stat. 1516 and 1520). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) did not properly report compliance with the program’s earmarking requirements. Context: Twelve ETA-9130 reports were selected for testing of earmarking requirements. The selected reports included five each for Statewide Activities requirement numbers 1 and 2 and two reports for Statewide Activities requirement number 3. The following exception was noted: Statewide Activities requirement 3: For 1 of 2 reports selected for testing, the Department was unable to provide sufficient supporting documentation for the recaptured funds expended. The 25% limit was $960,962, but the actual amount expended was $973,266. The Department indicated the cause of exceeding the 25% limit was due to recaptured funds not expended by the local area within the two-year period allowed and these funds were returned to the State. However, the Department did not maintain sufficient documentation to support the specific amount of recaptured funds being expended at the state level. Cause: Internal controls were not sufficient to ensure that the Department correctly reported its compliance with earmarking requirements nor that it maintained documentation supporting recaptured funds. Effect: Internal controls were not properly implemented over the reporting of earmarking requirements which resulted in undetected reporting errors. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance its controls over reporting earmarking requirements to ensure that reports are accurate and compliant, and that documentation is maintained and readily available for audit. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation Section III – Findings and Questioned Costs – Major Federal Programs (Continued) of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS. Context: None of the six subawards selected for testing were reported to FSRS. Total subawards were $14,194,730 and $0 was reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation Section III – Findings and Questioned Costs – Major Federal Programs (Continued) of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS. Context: None of the six subawards selected for testing were reported to FSRS. Total subawards were $14,194,730 and $0 was reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation Section III – Findings and Questioned Costs – Major Federal Programs (Continued) of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) did not report subaward information to FSRS. Context: None of the six subawards selected for testing were reported to FSRS. Total subawards were $14,194,730 and $0 was reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-017 Prior Year Finding: 2023-021 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): (a) A State agency which serves a State with multiple planning and service areas, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) earmark calculation was not reviewed and approved by program management. Context: Auditors obtained the Department’s earmark calculation and agreed the calculation to supporting documentation and recalculated the required threshold, noting the Department is in compliance with the earmarking requirements. It was noted that the earmark calculation was prepared by the State Planner; however, the calculation was not reviewed and approved by program management. Questioned costs: Undetermined. Cause: The Department’s internal controls are not sufficient to ensure that the earmark calculation is reviewed and approved by program management. Effect: Failure to review and approve the earmark calculation could allow an error to be undetected and lead to the Department being out of compliance with the requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the earmark calculation is reviewed and approved by program management. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-017 Prior Year Finding: 2023-021 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): (a) A State agency which serves a State with multiple planning and service areas, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) earmark calculation was not reviewed and approved by program management. Context: Auditors obtained the Department’s earmark calculation and agreed the calculation to supporting documentation and recalculated the required threshold, noting the Department is in compliance with the earmarking requirements. It was noted that the earmark calculation was prepared by the State Planner; however, the calculation was not reviewed and approved by program management. Questioned costs: Undetermined. Cause: The Department’s internal controls are not sufficient to ensure that the earmark calculation is reviewed and approved by program management. Effect: Failure to review and approve the earmark calculation could allow an error to be undetected and lead to the Department being out of compliance with the requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the earmark calculation is reviewed and approved by program management. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-017 Prior Year Finding: 2023-021 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Overall expenditures for administration are determined by the State agency’s status as set forth below, unless a waiver is granted by the assistant secretary for aging (42 USC 3028 (b)): (a) A State agency which serves a State with multiple planning and service areas, shall have available the greater of 5 percent or $750,000 of the total Title III award (42 USC 3028(b)(2)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) earmark calculation was not reviewed and approved by program management. Context: Auditors obtained the Department’s earmark calculation and agreed the calculation to supporting documentation and recalculated the required threshold, noting the Department is in compliance with the earmarking requirements. It was noted that the earmark calculation was prepared by the State Planner; however, the calculation was not reviewed and approved by program management. Questioned costs: Undetermined. Cause: The Department’s internal controls are not sufficient to ensure that the earmark calculation is reviewed and approved by program management. Effect: Failure to review and approve the earmark calculation could allow an error to be undetected and lead to the Department being out of compliance with the requirement. Recommendation: The Department should review and enhance internal controls and procedures to ensure that the earmark calculation is reviewed and approved by program management. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-018 Prior Year Finding: 2023-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a), pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes obtaining the subrecipient’s unique entity identifier. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) issued subawards that did not contain all required federal information. The Department also did not obtain a subrecipient’s unique entity identifier. Context: Six of six subawards selected for testing did not include the following required federal award information: • Federal Award Identification Number (FAIN); • Federal Award Date; • Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; and, • Assistance Listings title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement. For one of six subrecipients selected for testing, the Department did not obtain the subrecipient’s unique entity identifier prior to issuing the subaward. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it provided all required federal information to subrecipients and obtained unique entity identifiers for all subrecipients. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Failure to obtain subrecipients’ unique entity identifiers prevents the Department from properly identifying its subrecipients. Recommendation: The Department should review and enhance internal controls and procedures to ensure that it obtains subrecipients’ unique entity identifiers and that all required information is included in all subaward agreements. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-018 Prior Year Finding: 2023-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a), pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes obtaining the subrecipient’s unique entity identifier. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) issued subawards that did not contain all required federal information. The Department also did not obtain a subrecipient’s unique entity identifier. Context: Six of six subawards selected for testing did not include the following required federal award information: • Federal Award Identification Number (FAIN); • Federal Award Date; • Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; and, • Assistance Listings title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement. For one of six subrecipients selected for testing, the Department did not obtain the subrecipient’s unique entity identifier prior to issuing the subaward. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it provided all required federal information to subrecipients and obtained unique entity identifiers for all subrecipients. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Failure to obtain subrecipients’ unique entity identifiers prevents the Department from properly identifying its subrecipients. Recommendation: The Department should review and enhance internal controls and procedures to ensure that it obtains subrecipients’ unique entity identifiers and that all required information is included in all subaward agreements. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-018 Prior Year Finding: 2023-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Elders Affairs Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOAOM (10/1/2023 - 9/30/2025) 2101MAOAPH (10/1/2020 - 9/30/2023) 2101MAOACM (10/1/2020 - 9/30/2023) 2201MAOAPH (10/1/2021 - 9/30/2024) 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2301MAOASS (10/1/2022 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a), pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes obtaining the subrecipient’s unique entity identifier. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Elders Affairs (Department) issued subawards that did not contain all required federal information. The Department also did not obtain a subrecipient’s unique entity identifier. Context: Six of six subawards selected for testing did not include the following required federal award information: • Federal Award Identification Number (FAIN); • Federal Award Date; • Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity; and, • Assistance Listings title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement. For one of six subrecipients selected for testing, the Department did not obtain the subrecipient’s unique entity identifier prior to issuing the subaward. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it provided all required federal information to subrecipients and obtained unique entity identifiers for all subrecipients. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. Failure to obtain subrecipients’ unique entity identifiers prevents the Department from properly identifying its subrecipients. Recommendation: The Department should review and enhance internal controls and procedures to ensure that it obtains subrecipients’ unique entity identifiers and that all required information is included in all subaward agreements. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-019 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 5 NH23IP922629 (7/1/2019-6/30/2025) 6 NH23IP922629 (7/1/2019-6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Public Health (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Seven subawards were selected for testing and the following exceptions were noted: • 4 of 7 subawards, totaling $696,159, were not reported to FSRS. The Department was unable to provide documentation pertaining to these subawards, therefore, the award issuance dates cannot be determined. • 3 of 7 subawards, totaling $2,012,286, were not reported timely to FSRS. The subawards were issued in July and September 2023 but were not reported until July 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has not completed implementation of its corrective action plan from the prior audit. Effect: The subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit. It should establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to the FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-019 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 5 NH23IP922629 (7/1/2019-6/30/2025) 6 NH23IP922629 (7/1/2019-6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Public Health (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Seven subawards were selected for testing and the following exceptions were noted: • 4 of 7 subawards, totaling $696,159, were not reported to FSRS. The Department was unable to provide documentation pertaining to these subawards, therefore, the award issuance dates cannot be determined. • 3 of 7 subawards, totaling $2,012,286, were not reported timely to FSRS. The subawards were issued in July and September 2023 but were not reported until July 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has not completed implementation of its corrective action plan from the prior audit. Effect: The subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit. It should establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to the FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Public Health (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: None of the eight subawards selected for testing were reported to FSRS. Total subawards were $6,922,656 and $0 was reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Public Health (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: None of the eight subawards selected for testing were reported to FSRS. Total subawards were $6,922,656 and $0 was reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases, COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Non-federal entities are required to submit Financial and Performance Measure Reports in accordance with the terms and conditions of the Federal award. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not review and approve performance and financial reports prior to submission and a performance report was not submitted timely. Context: The following reports were selected for testing: Financial Reports: COVID and ARPA Financial Reporting for the 9/30/2023 and 6/30/2024 quarters and Core Base Grant Report for the 9/30/2023 and 6/30/2024 quarters for a total of four financial reports tested. Performance Reports: The 2023 Annual Performance Measures Report and the Performance Report for 2023 for a total of two performance reports tested. The following exceptions were noted: • Four of four quarterly Financial Reports were not reviewed or approved prior to submission. • Two of two Performance Reports were not reviewed or approved prior to submission. • One of two Performance Reports was not submitted timely. The June 2023 monthly performance report was due 7/16/2023 but was not submitted until 7/18/2023. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure that financial and performance reports were reviewed prior to submission and were submitted timely. Effect: Failure to review and approve reports prior to submission could allow reporting errors to be undetected. Untimely submission of performance reports could impact the Federal Agency’s ability to oversee the program. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that performance reports are submitted timely and that the review and approval process of financial and performance reports is documented prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases, COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Non-federal entities are required to submit Financial and Performance Measure Reports in accordance with the terms and conditions of the Federal award. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not review and approve performance and financial reports prior to submission and a performance report was not submitted timely. Context: The following reports were selected for testing: Financial Reports: COVID and ARPA Financial Reporting for the 9/30/2023 and 6/30/2024 quarters and Core Base Grant Report for the 9/30/2023 and 6/30/2024 quarters for a total of four financial reports tested. Performance Reports: The 2023 Annual Performance Measures Report and the Performance Report for 2023 for a total of two performance reports tested. The following exceptions were noted: • Four of four quarterly Financial Reports were not reviewed or approved prior to submission. • Two of two Performance Reports were not reviewed or approved prior to submission. • One of two Performance Reports was not submitted timely. The June 2023 monthly performance report was due 7/16/2023 but was not submitted until 7/18/2023. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure that financial and performance reports were reviewed prior to submission and were submitted timely. Effect: Failure to review and approve reports prior to submission could allow reporting errors to be undetected. Untimely submission of performance reports could impact the Federal Agency’s ability to oversee the program. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that performance reports are submitted timely and that the review and approval process of financial and performance reports is documented prior to submission. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) omitted required federal award information from subawards it issued from the program. Context: For eight of eight subawards selected for testing, the following required information was omitted from the subaward agreements: • Federal Award Identification Number (FAIN) • Federal Award Date • Name of the Federal Agency and contact information for awarding official of the pass-through entity. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 6 NU50CK000518 (8/1/2019 – 7/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) omitted required federal award information from subawards it issued from the program. Context: For eight of eight subawards selected for testing, the following required information was omitted from the subaward agreements: • Federal Award Identification Number (FAIN) • Federal Award Date • Name of the Federal Agency and contact information for awarding official of the pass-through entity. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required information. Internal controls did not detect or prevent the errors. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: COVID-19 - Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2101MATANFC6 (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – ACF-196P – Pandemic Emergency Assistance Fund Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: ACF-196P – Pandemic Emergency Assistance Fund Report - Each state must report expenditures for the Pandemic Emergency Assistance Fund within 90 days of the end of each federal fiscal year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The annual ACF-196P report was not submitted timely by the Department of Transitional Assistance (Department). Context: The FFY 2023 annual report was due by December 29, 2023, but was not submitted until January 31, 2024. Cause: The Department’s procedures were not sufficient to ensure that the annual ACF-196P report was submitted timely. Internal controls did not prevent or detect the error. Effect: The Department was not in compliance with the program’s reporting requirements. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are submitted timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – ACF-204 - Annual Report including the Annual Report on State Maintenance-of-Effort Programs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: ACF-204 - Annual Report including the Annual Report on State Maintenance-of-Effort (MOE) Programs - Each state must file an annual report containing information on the TANF program and the state’s MOE program(s) for that year, including strategies to implement the Family Violence Option, state diversion programs, and other program characteristics. Each state must complete the ACF-204 for each program for which the state has claimed basic MOE expenditures for the fiscal year. States may submit this electronically through the On-Line Data Collection (OLDC) System. The annual report is due at the same time as the fourth quarter data reports — i.e., 45 days after the end of the fourth quarter, but no later than December 31. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The annual ACF-204 report was not submitted timely by the Department of Transitional Assistance (Department). Context: The FFY 2023 annual report was due November 14, 2023, but was not submitted until January 2, 2024. Cause: The Department’s procedures were not sufficient to ensure that the annual ACF-204 report was submitted timely. Internal controls did not prevent or detect the error. Effect: The Department was not in compliance with the program’s reporting requirements. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are submitted timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – ACF-209 - SSP-MOE Data Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: ACF-209 – SSP-MOE Data Report - If a State claims MOE expenditures for separate State programs (SSPs) and for persons served by those programs, it must collect and report this information on the SSP-MOE Data Report on SSP-MOE families receiving assistance only as follows: (1) If the State wishes to receive a high performance bonus, it must file the information in sections one and three of the SSP-MOE Data Report; and (2) if the State wishes to quality for caseload reduction credit, it must file the information in all three sections of the SSP-MOE Data Report. Reports for each sample month in a quarter are due in the Central Office of the Administration for Children and Families within 45 days following the end of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Department of Transitional Assistance (Department) did not agree with supporting documentation and were not submitted timely. Context: Two of four quarterly reports were selected for testing which included data for forty program participants. The following exceptions were noted: • For two of two reports, participant data reported for four of forty program participants did not agree with supporting documentation. Specifically, we noted the following: o Two program participants had zero earned income but this field was left blank on the report. o One program participant had a change in unsubsidized hours that was documented and reviewed by a program specialist; however, there was no process in place to ensure the changes to unsubsidized hours worked were updated in the Benefit Eligibility and Control Online Network (BEACON) and updated for the ACF-209 report. Although there was a difference in the number of hours reported in the ACF-209 report and the BEACON Program Module, the difference in the total number of hours did not impact the participants benefit amount or participation code. • One of two reports was not submitted timely. The 9/30/2023 quarterly report was due 11/14/2023 and was submitted on 12/15/2023. Cause: The Department’s procedures were not sufficient to ensure that reports were submitted timely and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: The Department was not in compliance with the program’s reporting requirements. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls over reporting to ensure that reports are supported by documentation and are submitted timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-026 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Child Support Non-Cooperation Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: If the state agency responsible for administering the state plan approved under Title IV-D of the Social Security Act determines that an individual is not cooperating with the state in establishing paternity, or in establishing, modifying or enforcing a support order with respect to a child of the individual, and reports that information to the state agency responsible for TANF, the state TANF agency must (1) deduct an amount equal to not less than 25 percent from the TANF assistance that would otherwise be provided to the family of the individual, and (2) may deny the family any TANF assistance. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Transitional Assistance (Department) did not apply sanctions in a timely manner to individuals who were not cooperating with the state. Context: Thirteen clients were selected for testing, and the following exceptions were noted: • For one of thirteen clients, a sanction letter was issued on June 27, 2024, but the Department did not reduce benefits until March 11, 2025. Therefore, the sanction amount of $196 per month was implemented eight months late, resulting in ineligible benefits paid in the amount of $1,568. • For one of thirteen clients, a sanction letter was issued on March 26, 2024, but the Department did not reduce benefits until August 27, 2024. Therefore, the sanction amount of $162 per month was implemented five months late, resulting in ineligible benefits paid in the amount $810. Cause: The Department’s procedures were not sufficient to ensure that sanctions established for Child Support Non-Cooperation were implemented timely. Effect: Sanctions to individuals who did not cooperate with Child Support were not properly implemented by the Department, resulting in overpayment of benefits. Questioned costs: $2,378, the benefit amounts that should have been sanctioned. Recommendation: We recommend the Department evaluate its procedures and internal controls over Child Support Non-Cooperation to ensure that sanctions are applied timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Transitional Assistance Federal Program: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Award Number and Year: 2301MATANF (10/1/2022 – 9/30/2023), 2401MATANF (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to: (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; and (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Transitional Assistance (Department) was unable to demonstrate that it had maintained adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. Context: The Benefit Eligibility and Control Online Network (BEACON) system is used by the Department to manage TANF benefits and participant data. Work verification data contained in BEACON was incomplete or did not agree with supporting documentation. Forty participants were selected for testing and the following exceptions were noted: • Per program requirements, self-employment cannot be self-attested. For six self-employed participants from a sample of forty participants, the Department was unable to provide additional documentation supporting work hours for the participants who were self-employed. • For four of forty participants, data in BEACON used to verify reported hours of work did not agree with supporting documentation. Cause: The Department’s procedures were not sufficient to ensure that information maintained in BEACON was complete and accurate. Internal controls did not prevent or detect these errors. Effect: Data used to calculate work participation rates was not properly verified by the Department and could allow ineligible individuals to receive benefits from the program. Questioned costs: Undetermined. Recommendation: We recommend the Department evaluate its procedures and internal controls to ensure that information used to verify work participation is complete, accurate, and agrees with supporting documentation. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-028 Prior Year Finding: 2023-026 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2401MALIEA (10/1/2023 – 9/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Three out of the eight subawards selected for testing were not reported to the FSRS. These subawards were issued on 10/1/2023, but have yet to be reported. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-029 Prior Year Finding: 2023-027 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2201MALIE4 (10/1/2021 – 9/30/2023) 2201MALIEA (10/1/2021 – 9/30/2023) 2201MALIEI (10/1/2021 – 9/30/2023) 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) Compliance Requirement: Reporting – Special Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Quarterly Performance and Management Report (OMB No. 0970-0589) – Grant recipients must submit data and information about LIHEAP during the current fiscal year (FY) to the Federal LIHEAP Office; including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, and training and technical assistance needs. The quarterly reports are due to the Federal LIHEAP Office one month after the end of each calendar quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Quarterly Performance and Management Report submitted by the Executive Office of Housing and Livable Communities (Department) did not agree to supporting documentation. Context: For 1 of 2 Quarterly Performance and Management Reports selected for testing, discrepancies were identified between the reported amounts and the supporting documentation for several line items. These exceptions were noted in Sections I and II of the 9/30/2023 quarterly report. Specifically, the following variances were noted: • Number of assisted households Q4 – The report indicated 9,650 households, whereas the supporting documentation reflected 9,716 households, resulting in a variance of 66 households. • Number of occurrences of households where LIHEAP prevented the loss of home energy Q4 – The report indicated 1,660 occurrences, whereas the supporting documentation reflected 1,897 occurrences, resulting in a variance of 237 occurrences. • Number of occurrences of households where LIHEAP restored home energy Q4 – The report indicated 386 occurrences, whereas supporting documentation reflected 389 occurrences, resulting in a variance of 3 households. Cause: The Department’s procedures were not sufficient to ensure that special reports were accurate and agreed with supporting documentation. Internal controls were not sufficient to prevent or detect the errors prior to submission. Effect: Inaccuracies in special reports could impact the Federal agency’s ability to manage the program, could result in delays in annual awards, and could result in possible penalties or sanctions imposed by the grantor. Questioned costs: None. Recommendation: We recommend that the Department review and enhance its procedures and internal controls to ensure that special reports are submitted accurately, and that the information reported agrees to supporting documentation. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-030 Prior Year Finding: 2023-028 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Housing and Livable Communities Federal Program: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2301MALIEA (10/1/2022 – 9/30/2024) 2301MALIEE (10/1/2022 – 9/30/2024) 2301MALIEI (10/1/12022 – 9/30/2024) 2401MALIEA (10/1/2023 – 9/30/2025) 2401MALIEE (10/1/2023 – 9/30/2025) 2401MALIEI (10/1/12023 – 9/30/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Housing and Livable Communities (Department) omitted required federal award information from subawards it issued from the program. Context: Twelve subawards to six subrecipients were selected for testing. For six of twelve subawards issued, the Federal Award Identification Number (FAIN) was not included in the subaward agreements. For twelve of twelve subawards issued, the Federal Award Date was not included in the subaward agreements. Cause: Per discussion with the Department, it has not implemented its corrective action plan from the prior year and intends to include all required federal award information beginning with its federal fiscal year 2025 contracts. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department complete its corrective action plan from the prior year. It should ensure its internal controls and procedures are sufficient to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Early Education and Care (Department) did not report subaward information to FSRS. Context: The Department informed auditors that no subawards were reported to FSRS. Therefore, a sample was unavailable for testing. Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Early Education and Care (Department) did not report subaward information to FSRS. Context: The Department informed auditors that no subawards were reported to FSRS. Therefore, a sample was unavailable for testing. Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Fraud Detection and Repayment Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies shall recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud (45 CFR section 98.60). The Department of Early Education and Care’s (Department) procedures require issuance of a decision letter to the parent at the conclusion of an investigation. The letter must include the recoupment amount, Agreement to Repay, and the termination date. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not promptly recover a fraudulent payment. Context: According to the Department’s Bureau of Special Investigations policy, when a case is returned to the Department for final disposition and a parent has an active Request for Review, the assigned Financial Assistance Specialist is required to issue a decision letter including the recoupment amount, Agreement to Repay, and the termination date. For one of three fraud cases selected for testing, the Department did not issue a decision letter to the client at the conclusion of the fraud investigation. The investigation concluded on 6/19/2024 but the decision letter was not issued until 2/15/2025. Therefore, the recovery was not performed timely. Cause: The Department’s procedures were not sufficient to ensure that decision letters were issued promptly at the conclusion of the fraud investigation and that the recovery of funds was performed timely. Internal controls did not prevent or detect the error. Effect: Failure to promptly issue decision letters delays recoupment of fraudulent payments. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that, at the conclusion of fraud investigations, decision letters are issued promptly and that repayments are received timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Early Education and Care Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301MACCDF (10/1/2022 – 9/30/2025) 2301MACCDD (10/1/2022 – 9/30/2025) 2401MACCDD (10/1/2023 – 9/30/2026) 2401MACCDF (10/1/2023 – 9/30/2026) 2401MACCDM (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Fraud Detection and Repayment Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies shall recover child care payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud (45 CFR section 98.60). The Department of Early Education and Care’s (Department) procedures require issuance of a decision letter to the parent at the conclusion of an investigation. The letter must include the recoupment amount, Agreement to Repay, and the termination date. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not promptly recover a fraudulent payment. Context: According to the Department’s Bureau of Special Investigations policy, when a case is returned to the Department for final disposition and a parent has an active Request for Review, the assigned Financial Assistance Specialist is required to issue a decision letter including the recoupment amount, Agreement to Repay, and the termination date. For one of three fraud cases selected for testing, the Department did not issue a decision letter to the client at the conclusion of the fraud investigation. The investigation concluded on 6/19/2024 but the decision letter was not issued until 2/15/2025. Therefore, the recovery was not performed timely. Cause: The Department’s procedures were not sufficient to ensure that decision letters were issued promptly at the conclusion of the fraud investigation and that the recovery of funds was performed timely. Internal controls did not prevent or detect the error. Effect: Failure to promptly issue decision letters delays recoupment of fraudulent payments. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance procedures and internal controls to ensure that, at the conclusion of fraud investigations, decision letters are issued promptly and that repayments are received timely. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-033 Prior Year Finding: 2023-032 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP-24 Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Pursuant to 1903(d)(2)(C) of the Act (the Act) (42 USC 1396b), states have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 Summary, Line 9.C1-Fraud, Waste & Abuse Amounts, Line 9.C2-OIG Complaint False Claims Act, 9.D Other, 9.E. – RAC Collections, 9.F. – PERM Collections or 9.G. – MEQC Collections regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were made by the Executive Office of Health and Human Services (Department) when calculating the federal share of the overpayments to be returned on the CMS-64. Context: For eight of thirty-four overpayments selected for testing, the federal share to be returned for the 6/30/2024 quarter was calculated incorrectly. The amount reported in Column A - Total Computable on Line 9C1 was understated by $349,572 and the amount reported in Column E - Total Federal Share on Line 9C1 was understated by $185,098. Cause: The Department’s procedures were not sufficient to ensure that the spreadsheet used to calculate the federal share of overpayments to be returned was accurate. Internal controls did not prevent or detect the errors. Effect: The federal share of refunded overpayments was understated when reported on the CMS-64. Questioned costs: $185,098, which represents the total understatement of the reported federal share. Recommendation: We recommend that the Department enhance its procedures and controls to ensure that the calculation of the federal share of overpayments to be returned is accurate and is properly reported on the CMS-64. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-034 Prior Year Finding: 2023-029 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly monitor a provider that was determined to be high risk and, therefore, it failed to ensure the provider was eligible to provide services under the program. Context: One of sixty providers selected for testing was designated as high-risk on 9/30/2017. This provider was terminated on 10/3/2017 and was reinstated on 10/17/2017. The Department’s procedures require a site visit for high-risk providers; however, the scheduled site visit was canceled following the provider’s termination. After reinstatement, the site visit should have been rescheduled, but the Department has not yet performed a site visit for this provider. Therefore, the Department is unable to provide documentation that the provider is eligible to perform services under the program. Cause: The Department’s procedures were not sufficient to ensure it performed site visits for high-risk providers and ensure that it maintained documentation that all providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Claims were paid to a provider whose eligibility was not properly documented. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the provider was eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it properly monitors high-risk providers and that it maintains documentation that claims are paid only to eligible providers. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-035 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster, COVID-19 – Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP23, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly resolve a case after MEQC review identified one or more errors in the eligibility determination. Context: The eligibility review for one of sixty participants identified errors in the eligibility determination. The Department did not send an outreach letter to the participant to resolve the issue. Cause: The Department’s procedures were not sufficient to ensure it followed up when its MEQC program identified errors in participant eligibility determination. Effect: Claims may have been paid to an ineligible participant. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it promptly follows up with participants whose eligibility review identifies errors and that ineligible participants are terminated from the program. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-036 Prior Year Finding: 2023-025 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH), Executive Office of Housing and Livable Communities (EOHLC) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (DPH) and the Executive Office of Housing and Livable Communities (EOHLC) omitted required federal award information from subawards issued from the program. Context: Twenty subawards issued to thirteen subrecipients were selected for testing for DPH. Twenty of twenty subawards were missing required federal award information. Specifically, we noted the following: • 20 of 20 subawards were missing the Federal Award Identification Number (FAIN) and the Federal Award Date. • 6 of 20 subawards were missing the clause stating that the Federal Award must be used in accordance with Federal statutes, regulations and the terms and conditions of the Federal Award. • 5 of 20 subawards were missing the Indirect Cost Rate for the Federal Award. • 3 of 20 subawards were missing the Name of the Federal Awarding Agency, the contact information for the awarding official of the pass-through entity, the Assistance Listing Number and Program Name. • 1 of 20 subawards was missing the following: o Amount of Federal Funds Obligated by this action o Total Amount of Federal Funds Obligated o Total Amount of the Federal Award o Federal Award Project Description • 1 of 20 subawards was missing the subrecipient’s unique entity identifier. Five subawards issued to five subrecipients were selected for testing for EOHLC. Five of five subawards were missing the following required federal award information: • Federal Award Identification Number (FAIN) • Federal Award Date • Name of the Federal Awarding Agency and contact information for awarding official of the pass-through entity • Assistance Listing Number and Name Cause: Per discussion with the Department, it has not implemented its corrective action plan from the prior year and intends to include all required federal award information beginning with its federal fiscal year 2025 contracts. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: None. Recommendation: We recommend the Department complete its corrective action plan from the prior year. It should ensure its internal controls and procedures are sufficient to ensure that required information is included in its subawards. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-037 Prior Year Finding: 2023-033 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 6H79TI083328 (9/30/2021 – 9/29/2023) 1H79TI085778 (9/30/2021 – 9/29/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information to FSRS within thirty days after subaward issuance. Context: Thirteen subawards were selected for testing and the following exceptions were noted: • Twelve of thirteen subawards were not reported timely to FSRS. The subawards were issued 7/1/2023 and were not reported to FSRS until 3/28/2024, or seven months after the due date. • One of thirteen subawards was not reported to FSRS. The subaward was issued on 7/1/2023 but it has not been reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has not completed implementation of its corrective action plan from the prior audit year. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit year. It should establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-038 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency Federal Program: Disaster Grants – Public Assistance (Presidentially Declared Disasters), COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (2020) FEMA-4651-DR (2022) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Massachusetts Emergency Management Agency (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Thirty of the forty subawards selected for testing were not reported to the FSRS in accordance with FFATA requirements. The following exceptions were noted: • 4 of 40 subawards were inaccurately reported. The total of the subawards was $14,652,284, but $29,265,187 was reported. • 3 of 40 subawards, totaling $6,245,292, were not reported to FSRS. • 22 of 40 subawards, totaling $47,614,805, were not reported timely. The reports were submitted from one day to one year late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-038 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency Federal Program: Disaster Grants – Public Assistance (Presidentially Declared Disasters), COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (2020) FEMA-4651-DR (2022) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Massachusetts Emergency Management Agency (Department) did not report subaward information to FSRS in accordance with FFATA requirements. Context: Thirty of the forty subawards selected for testing were not reported to the FSRS in accordance with FFATA requirements. The following exceptions were noted: • 4 of 40 subawards were inaccurately reported. The total of the subawards was $14,652,284, but $29,265,187 was reported. • 3 of 40 subawards, totaling $6,245,292, were not reported to FSRS. • 22 of 40 subawards, totaling $47,614,805, were not reported timely. The reports were submitted from one day to one year late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-039 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency (Agency) Federal Program: COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (1/20/2020 and continuing) Compliance Requirement: Allowable Costs / Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency was unable to provide documentation to support the allowability, approval, and proper accounting of expenditures charged to the program. Context: Forty invoices were selected for testing and the following exceptions were noted: • For 4 of 40 invoices, support could not be provided to verify that the invoices had been charged to the correct general ledger codes and that the costs were allowable under the program. • For 3 of 40 invoices, payment details could not be verified because support did not include the check amount or the check date. • For 5 of 40 invoices, there was no evidence of approval of the purchase order or invoice. Cause: The Agency’s procedures were not sufficient to ensure that expenditures charged to the program were allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Internal controls did not detect or prevent the errors. Effect: Unallowable costs could be charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.

Reference Number: 2024-039 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency (Agency) Federal Program: COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (1/20/2020 and continuing) Compliance Requirement: Allowable Costs / Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency was unable to provide documentation to support the allowability, approval, and proper accounting of expenditures charged to the program. Context: Forty invoices were selected for testing and the following exceptions were noted: • For 4 of 40 invoices, support could not be provided to verify that the invoices had been charged to the correct general ledger codes and that the costs were allowable under the program. • For 3 of 40 invoices, payment details could not be verified because support did not include the check amount or the check date. • For 5 of 40 invoices, there was no evidence of approval of the purchase order or invoice. Cause: The Agency’s procedures were not sufficient to ensure that expenditures charged to the program were allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Internal controls did not detect or prevent the errors. Effect: Unallowable costs could be charged to the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that costs charged to the program are allowable, approved, and accounted for properly in the Commonwealth’s accounting system. Views of Responsible Officials: There is no disagreement with the finding.