Audit 360834

Finding Number: 2024-001 Prior Year Finding Number: 2023-002 Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 277.4(b), Federal reimbursement rate, states that the base percentage for Federal payment shall be 50 percent of State agencies’ allowable SNAP administrative costs. Per review of the Settlement Agreement from the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999, the District of Columbia is required to spend an additional $1,620,000 in local funds for the SNAP grant match each year by making an adjustment of $1,620,000 to the expenditures charged to the federal grant. Condition – During the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that two (2) out of four (4) quarterly SF-425 reports tested, which were for quarters ended March 30, 2024 and June 30, 2024, had the issues that resulted in this finding. The SF-425 reports tested were approved and certified, and DHS/ESA exceeded the required SNAP Matching amount of $41,509,067. However, the Office of the Chief Financial Officer (OCFO) for DHS/ESA was unable to provide supporting documentation that would allow us to agree specific amounts reported for (1) Quality Control, (2) Fraud Control, (3) ADP Operations, and (4) Outreach. The total calculated amount by OCFO for DHS/ESA reported as the actual match on the SF-425 report, excluding New Investment, was $43,129,064. However, the total recalculated amount by auditors to be reported as the actual match was $43,199,416. Variance between these two amounts was $70,352. In addition, during the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that the OCFO team for Human Support Services Cluster inadvertently failed to deduct the $1,620,000 adjustment from the Federal Share of Administrative Expenditures on the SEFA to comply with the Settlement Agreement with the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999. The Settlement Agreement requires the District of Columbia to spend $1,620,000 in local funds for the SNAP grant each year, which the Agency decided to reflect as a deduction from the Federal Share of Administrative Expenditures on the SEFA. Furthermore, as a result of the Random Movement Time Study, the Agency needed to move expenses from the SNAP bucket in the DIFS System and the Agency inadvertently moved $158,834 less expenses. Consequently, the Federal Share of Administrative Expenditures on the SEFA is higher compared to the Federal Share of Administrative Expenditures reported on SF-425 report.  Questioned Costs – None. Context – This is a condition identified per review of DHS/ESA’s compliance through the OCFO team with specified requirements using a statistically valid sample. Effect – OCFO for DHS/ESA is not in compliance with the stated provisions. Without adequate internal controls to ensure reconciliation of the amounts reported for the matching requirements and other pertinent information, there is an increased risk that matching and other pertinent information will not be properly reported. Cause – OCFO for DHS/ESA does not appear to have adequate policies and procedures in place to ensure that the amounts reported for the matching requirement and other pertinent information are accurate and supported. Recommendation – We recommend that OCFO for DHS/ESA strengthen its policies and procedures to ensure that amounts for SNAP matching requirements and other pertinent information are properly reported and that related reports are reviewed for compliance with program requirements as well as completeness and accuracy prior to submission. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-002 Prior Year Finding Number: 2023-003 Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Department of Health Care Finance (DHCF) DC Access System (DCAS) Program Management Administration Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 272.10(a), “All State agencies are required to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP.” Per 7 CFR Section 272.10(b), “In order to meet the requirements of the Act and ensure the efficient and effective administration of the program, a SNAP system, at a minimum, shall be automated in each of the following program areas (1) Certification and (2) Issuance Reconciliation and Reporting. Under Certification – States agencies must determine eligibility and calculate benefits or validate the eligibility worker’s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members’ names, addresses, dates of birth, social security numbers, individual household members’ earned and unearned income by source, deductions, resources and household size). Also, State agencies must redetermine or revalidate eligibility and benefits based on notices of change in households’ circumstances.” Condition – The District is self-reporting findings it noted from its ongoing efforts to resolve issues with the ADP system for SNAP. The issues identified and the estimated impact follows: 1. Failure to Send Correct and Timely Notices to SNAP Households - Notices pertaining to SNAP eligibility contain incorrect information, and/or SNAP applicants and recipients fail to receive proper notices. For example, in the Federal Fiscal Year (FFY) 2018 Local Program Access Review (PAR), Food and Nutrition Service (FNS) cited that SNAP applicants did not receive a Notice of Eligibility or notice contained incorrect information, no notice of required verification, and the notice of adverse action was incorrect. 2. Untimely Processing of SNAP Applications and Periodic Reports - On October 23, 2017, FNS advised DHS that its application processing timeliness (APT) rate between October 2016 and March 2017 was 88.45%, which triggered corrective action per FNS policy. Moreover, between that last APT report and now, DHS has disclosed that it has experienced processing backlogs of varying severity and persistence to FNS via ongoing communications and as part of waiver requests. DHS also provided a report to FNS in August 2022 that indicated significant application processing backlogs. 3. Establishment of Duplicate Accounts - DHS discovered that duplicate Product Delivery Cases (PDC) were being created in DCAS. One PDC was active and the other closed, but the closed PDC was still receiving benefits. 4. Issuance of Duplicate Payment - As a result of duplicate accounts in Deficiency 3, duplicate payments may have been issued to the same household when a caseworker reactivated a closed case. There is also a possibility that customers who received duplicate electronic benefits transfer (EBT) cards from different EBT vendors may have received duplicate payments. 5. Failure to Implement Computer Matching System - Based on the FFY18 Program Integrity Management Evaluation (ME) review, DHS failed to process Prisoner Verification System (PVS) matches, deceased matches, and National Directory of New Hires (NDNH) matches in accordance with federal requirements. 6. Failure to Produce System Computations to Support Recipient Claims - DCAS does not have the ability to calculate overpayments or send a demand letter. FNS correspondence letters dated October 18, 2017, and September 20, 2018, advised DHS to suspend the establishment of DCAS claims but allowed DHS to continue servicing ACEDS claims. 7. Treasury Offset Program (TOP) Reporting and Maintenance Decertified - FNS conducted a TOP Technical Review in June 2021 and DHS was decertified from TOP due to the following: • Referral of customers to TOP that are undergoing recoupment. • Incorrect determination of the date of delinquency. • Incorrect debt balance and debt status in TOP. 8. Failure to Initiate Recoupment on Active Households - When DCAS launched in October 2016, more than 3,000 claim cases with outstanding balances originating from SNAP overpayments were converted from ACEDS to DCAS. Some claims were not properly converted or activated in DCAS. As a result, DHS failed to take the required recovery actions, including TOP recovery or activation of the recoupment process through EBT cards. 9. Recipient and Benefit Integrity Report Update Required - DHS must provide an update on the target completion dates for system generation of all SNAP-related reports currently being created through manual intervention. The plan must include the procedures for reviewing and ensuring the accuracy of the data being submitted to Food Programs Reporting System (FPRS) with particular emphasis on the FNS-209 and the FNS-366B reports. DHS experienced some technical challenges in processing and retrieving claim and recoupment information accurately since the launch of DCAS in October 2016, which affected the FNS-209 quarterly reports. The Payment and Collections Division (PCD) and the DCAS report development team have made concerted efforts to improve the ability to generate data for the reports but continue to have difficulties in verifying the accuracy of data due in part to the laborious manual processes involved. Based on the FFY 2018 Program Integrity ME review, lines 3b, 10, and 14 of the FNS-209 failed to reconcile with the detailed documentation. 10. Work Requirements Have Not Been Properly Implemented - DHS is not in compliance with the requirement to accurately report on the FNS 583. DHS is unprepared to implement the work requirement and time limit for able-bodied adults without dependents when the current suspension mandated by the Families First Coronavirus Response Act ends and/or its waiver ends. Additionally, the District is not prepared to apply the Able-Bodied Adults Without Dependents (ABAWD) time limits when their ABAWD waiver expires. 11. Failure to Analyze Client Complaints and Include in the State’s Corrective Action Plans (CAP) Where Appropriate - DHS is failing to analyze client complaints and include in the State’s CAP where appropriate, per 7 CFR 271.6(a)(3) and 275.16. 12. The SNAP Application Does Not Clearly Explain Which Questions Are Required for SNAP - FNS reviewers found that the District’s SNAP application does not provide clear directions about which questions are required for SNAP, versus Cash or Medical Assistance. For example, Step 5 of the application asks “Does anyone in your household (including non-applicants) have any income? Yes – complete below; No – skip to step 6 (Complete if you are applying for Food, Medical, or Cash Assistance).” The directions are confusing and may be difficult to understand. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements resulting from a system implementation. Effect – Without an effectively designed and operated system in place, ineligible beneficiaries may receive benefits under the SNAP grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Inaccurate beneficiary allotment payments could result in participants receiving benefits that they are not entitled to receive under the program. Cause – DHS did not effectively design and operate the ADP system for SNAP which resulted to inaccurate benefit payments. Recommendation – We recommend that DHS continue to evaluate and improve the new ADP system for SNAP to ensure that it addresses all the administration requirements of the SNAP program. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS and DHCF DCAS team agree with the findings noted in this report. DHS self-reported these findings as part of the agency’s ongoing effort to maintain integrity with all eligibility determinations. The root cause of each of the twelve (12) case issues with the ADP system for SNAP varied. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-003 Prior Year Finding Number: 2023-004 Compliance Requirement: Special Tests and Provisions – EBT Card Security Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Office of the Chief Financial Officer/Office of Finance and Treasury (OCFO/OFT) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 274.8(b)(3), As an addition to or component of the Security Program required of Automated Data Processing (ADP) systems, the State agency shall ensure that the following electronic benefits transfer (EBT) security requirements are established: (i) Storage and control measures to control blank unissued EBT cards and PINs, and unused or spare POS devices; (ii) Measures to ensure communication access control. Communication controls shall include the transmission of transaction data and issuance information from POS terminals to work-stations and terminals at the data processing center; (iii) Message validation; (iv) Administrative and operational procedures; (v) A separate EBT security component shall be incorporated into the State agency Security Program for ADP systems. The periodic risk analyses required by the Security Program shall address the following items specific to an EBT system – (B) Completeness and timeliness of the reconciliation system; and (vi) The State agency shall incorporate the contingency plan approved by FNS into the Security Program. Condition – OCFO/OFT for DHS are required to maintain adequate security over, and documentation/records for EBT cards, to prevent their theft, embezzlement, loss damage, destruction, unauthorized transfer, negotiation, or use. OCFO/OFT have contracted with Fidelity National Information Service (FIS) for the issuance and security of the EBT cards; however, it is OCFO/OFT’s ultimate responsibility to ensure the contractor has controls in place to maintain adequate security over, and documentation/records of EBT cards in accordance with 7 CFR Section 274.8(b)(3). During our tests of the design and implementation of internal controls and compliance requirements in accordance with 7 CFR Section 274.8(b)(3), we noted the following issues: • For seventeen (17) out of the 60 samples, out of a population of 496 days from two EBT card centers, although both EBT Balance Sheets reconciled with the EBT Card Issuance Logs included in the package, we noted the following deficiencies: o For fourteen (14) out of the samples, we noted various issues including (a) the ID type for identification purposes was missing, (b) the customer case number was missing, (c) the Photo ID Program Referral Form was missing, (d) the identification type was noted as referral on the EBT Intake Form, but no referral form was attached, (e) the UPO EBT Center Intake Form was not signed by staff who created the card, and (f) the EBT Card Destruction log was missing. o For two (2) out of the samples, we noted that the required authorizations by a DHS Supervisor and eligibility staff was missing. o For one (1) out of the samples, we noted that the EBT Card Issuance Log had a wrong date. • In addition, for one (1) out of the 60 samples, we noted that the information on the summary reconciliation sheet did not agree to the Card Issuance Log. The summary reconciliation sheet shows 40 cards issued while the Card Issuance Log shows a total of 39 cards issued. These exceptions resulted in the Agency not being in compliance with 7 CFR Section 274.8(b)(3). Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without adequate internal controls to ensure compliance with EBT Card Security requirements, there is an increased risk that the inventory of EBT cards will not be properly maintained and accounted for, or that the program will not be in compliance with program requirements. Cause – OCFO/OFT for DHS does not have adequate policies and procedures in place to ensure adequate safeguarding, documentation over issuance and monitoring of EBT cards. Recommendation - We recommend that OCFO/OFT for DHS strengthen formal policies and procedures to maintain adequate security over, and documentation/records for EBT Cards. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The OCFO/OFT for DHS concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-001 Prior Year Finding Number: 2023-002 Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 277.4(b), Federal reimbursement rate, states that the base percentage for Federal payment shall be 50 percent of State agencies’ allowable SNAP administrative costs. Per review of the Settlement Agreement from the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999, the District of Columbia is required to spend an additional $1,620,000 in local funds for the SNAP grant match each year by making an adjustment of $1,620,000 to the expenditures charged to the federal grant. Condition – During the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that two (2) out of four (4) quarterly SF-425 reports tested, which were for quarters ended March 30, 2024 and June 30, 2024, had the issues that resulted in this finding. The SF-425 reports tested were approved and certified, and DHS/ESA exceeded the required SNAP Matching amount of $41,509,067. However, the Office of the Chief Financial Officer (OCFO) for DHS/ESA was unable to provide supporting documentation that would allow us to agree specific amounts reported for (1) Quality Control, (2) Fraud Control, (3) ADP Operations, and (4) Outreach. The total calculated amount by OCFO for DHS/ESA reported as the actual match on the SF-425 report, excluding New Investment, was $43,129,064. However, the total recalculated amount by auditors to be reported as the actual match was $43,199,416. Variance between these two amounts was $70,352. In addition, during the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that the OCFO team for Human Support Services Cluster inadvertently failed to deduct the $1,620,000 adjustment from the Federal Share of Administrative Expenditures on the SEFA to comply with the Settlement Agreement with the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999. The Settlement Agreement requires the District of Columbia to spend $1,620,000 in local funds for the SNAP grant each year, which the Agency decided to reflect as a deduction from the Federal Share of Administrative Expenditures on the SEFA. Furthermore, as a result of the Random Movement Time Study, the Agency needed to move expenses from the SNAP bucket in the DIFS System and the Agency inadvertently moved $158,834 less expenses. Consequently, the Federal Share of Administrative Expenditures on the SEFA is higher compared to the Federal Share of Administrative Expenditures reported on SF-425 report.  Questioned Costs – None. Context – This is a condition identified per review of DHS/ESA’s compliance through the OCFO team with specified requirements using a statistically valid sample. Effect – OCFO for DHS/ESA is not in compliance with the stated provisions. Without adequate internal controls to ensure reconciliation of the amounts reported for the matching requirements and other pertinent information, there is an increased risk that matching and other pertinent information will not be properly reported. Cause – OCFO for DHS/ESA does not appear to have adequate policies and procedures in place to ensure that the amounts reported for the matching requirement and other pertinent information are accurate and supported. Recommendation – We recommend that OCFO for DHS/ESA strengthen its policies and procedures to ensure that amounts for SNAP matching requirements and other pertinent information are properly reported and that related reports are reviewed for compliance with program requirements as well as completeness and accuracy prior to submission. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-002 Prior Year Finding Number: 2023-003 Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Department of Health Care Finance (DHCF) DC Access System (DCAS) Program Management Administration Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 272.10(a), “All State agencies are required to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP.” Per 7 CFR Section 272.10(b), “In order to meet the requirements of the Act and ensure the efficient and effective administration of the program, a SNAP system, at a minimum, shall be automated in each of the following program areas (1) Certification and (2) Issuance Reconciliation and Reporting. Under Certification – States agencies must determine eligibility and calculate benefits or validate the eligibility worker’s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members’ names, addresses, dates of birth, social security numbers, individual household members’ earned and unearned income by source, deductions, resources and household size). Also, State agencies must redetermine or revalidate eligibility and benefits based on notices of change in households’ circumstances.” Condition – The District is self-reporting findings it noted from its ongoing efforts to resolve issues with the ADP system for SNAP. The issues identified and the estimated impact follows: 1. Failure to Send Correct and Timely Notices to SNAP Households - Notices pertaining to SNAP eligibility contain incorrect information, and/or SNAP applicants and recipients fail to receive proper notices. For example, in the Federal Fiscal Year (FFY) 2018 Local Program Access Review (PAR), Food and Nutrition Service (FNS) cited that SNAP applicants did not receive a Notice of Eligibility or notice contained incorrect information, no notice of required verification, and the notice of adverse action was incorrect. 2. Untimely Processing of SNAP Applications and Periodic Reports - On October 23, 2017, FNS advised DHS that its application processing timeliness (APT) rate between October 2016 and March 2017 was 88.45%, which triggered corrective action per FNS policy. Moreover, between that last APT report and now, DHS has disclosed that it has experienced processing backlogs of varying severity and persistence to FNS via ongoing communications and as part of waiver requests. DHS also provided a report to FNS in August 2022 that indicated significant application processing backlogs. 3. Establishment of Duplicate Accounts - DHS discovered that duplicate Product Delivery Cases (PDC) were being created in DCAS. One PDC was active and the other closed, but the closed PDC was still receiving benefits. 4. Issuance of Duplicate Payment - As a result of duplicate accounts in Deficiency 3, duplicate payments may have been issued to the same household when a caseworker reactivated a closed case. There is also a possibility that customers who received duplicate electronic benefits transfer (EBT) cards from different EBT vendors may have received duplicate payments. 5. Failure to Implement Computer Matching System - Based on the FFY18 Program Integrity Management Evaluation (ME) review, DHS failed to process Prisoner Verification System (PVS) matches, deceased matches, and National Directory of New Hires (NDNH) matches in accordance with federal requirements. 6. Failure to Produce System Computations to Support Recipient Claims - DCAS does not have the ability to calculate overpayments or send a demand letter. FNS correspondence letters dated October 18, 2017, and September 20, 2018, advised DHS to suspend the establishment of DCAS claims but allowed DHS to continue servicing ACEDS claims. 7. Treasury Offset Program (TOP) Reporting and Maintenance Decertified - FNS conducted a TOP Technical Review in June 2021 and DHS was decertified from TOP due to the following: • Referral of customers to TOP that are undergoing recoupment. • Incorrect determination of the date of delinquency. • Incorrect debt balance and debt status in TOP. 8. Failure to Initiate Recoupment on Active Households - When DCAS launched in October 2016, more than 3,000 claim cases with outstanding balances originating from SNAP overpayments were converted from ACEDS to DCAS. Some claims were not properly converted or activated in DCAS. As a result, DHS failed to take the required recovery actions, including TOP recovery or activation of the recoupment process through EBT cards. 9. Recipient and Benefit Integrity Report Update Required - DHS must provide an update on the target completion dates for system generation of all SNAP-related reports currently being created through manual intervention. The plan must include the procedures for reviewing and ensuring the accuracy of the data being submitted to Food Programs Reporting System (FPRS) with particular emphasis on the FNS-209 and the FNS-366B reports. DHS experienced some technical challenges in processing and retrieving claim and recoupment information accurately since the launch of DCAS in October 2016, which affected the FNS-209 quarterly reports. The Payment and Collections Division (PCD) and the DCAS report development team have made concerted efforts to improve the ability to generate data for the reports but continue to have difficulties in verifying the accuracy of data due in part to the laborious manual processes involved. Based on the FFY 2018 Program Integrity ME review, lines 3b, 10, and 14 of the FNS-209 failed to reconcile with the detailed documentation. 10. Work Requirements Have Not Been Properly Implemented - DHS is not in compliance with the requirement to accurately report on the FNS 583. DHS is unprepared to implement the work requirement and time limit for able-bodied adults without dependents when the current suspension mandated by the Families First Coronavirus Response Act ends and/or its waiver ends. Additionally, the District is not prepared to apply the Able-Bodied Adults Without Dependents (ABAWD) time limits when their ABAWD waiver expires. 11. Failure to Analyze Client Complaints and Include in the State’s Corrective Action Plans (CAP) Where Appropriate - DHS is failing to analyze client complaints and include in the State’s CAP where appropriate, per 7 CFR 271.6(a)(3) and 275.16. 12. The SNAP Application Does Not Clearly Explain Which Questions Are Required for SNAP - FNS reviewers found that the District’s SNAP application does not provide clear directions about which questions are required for SNAP, versus Cash or Medical Assistance. For example, Step 5 of the application asks “Does anyone in your household (including non-applicants) have any income? Yes – complete below; No – skip to step 6 (Complete if you are applying for Food, Medical, or Cash Assistance).” The directions are confusing and may be difficult to understand. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements resulting from a system implementation. Effect – Without an effectively designed and operated system in place, ineligible beneficiaries may receive benefits under the SNAP grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Inaccurate beneficiary allotment payments could result in participants receiving benefits that they are not entitled to receive under the program. Cause – DHS did not effectively design and operate the ADP system for SNAP which resulted to inaccurate benefit payments. Recommendation – We recommend that DHS continue to evaluate and improve the new ADP system for SNAP to ensure that it addresses all the administration requirements of the SNAP program. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS and DHCF DCAS team agree with the findings noted in this report. DHS self-reported these findings as part of the agency’s ongoing effort to maintain integrity with all eligibility determinations. The root cause of each of the twelve (12) case issues with the ADP system for SNAP varied. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-003 Prior Year Finding Number: 2023-004 Compliance Requirement: Special Tests and Provisions – EBT Card Security Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Office of the Chief Financial Officer/Office of Finance and Treasury (OCFO/OFT) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 274.8(b)(3), As an addition to or component of the Security Program required of Automated Data Processing (ADP) systems, the State agency shall ensure that the following electronic benefits transfer (EBT) security requirements are established: (i) Storage and control measures to control blank unissued EBT cards and PINs, and unused or spare POS devices; (ii) Measures to ensure communication access control. Communication controls shall include the transmission of transaction data and issuance information from POS terminals to work-stations and terminals at the data processing center; (iii) Message validation; (iv) Administrative and operational procedures; (v) A separate EBT security component shall be incorporated into the State agency Security Program for ADP systems. The periodic risk analyses required by the Security Program shall address the following items specific to an EBT system – (B) Completeness and timeliness of the reconciliation system; and (vi) The State agency shall incorporate the contingency plan approved by FNS into the Security Program. Condition – OCFO/OFT for DHS are required to maintain adequate security over, and documentation/records for EBT cards, to prevent their theft, embezzlement, loss damage, destruction, unauthorized transfer, negotiation, or use. OCFO/OFT have contracted with Fidelity National Information Service (FIS) for the issuance and security of the EBT cards; however, it is OCFO/OFT’s ultimate responsibility to ensure the contractor has controls in place to maintain adequate security over, and documentation/records of EBT cards in accordance with 7 CFR Section 274.8(b)(3). During our tests of the design and implementation of internal controls and compliance requirements in accordance with 7 CFR Section 274.8(b)(3), we noted the following issues: • For seventeen (17) out of the 60 samples, out of a population of 496 days from two EBT card centers, although both EBT Balance Sheets reconciled with the EBT Card Issuance Logs included in the package, we noted the following deficiencies: o For fourteen (14) out of the samples, we noted various issues including (a) the ID type for identification purposes was missing, (b) the customer case number was missing, (c) the Photo ID Program Referral Form was missing, (d) the identification type was noted as referral on the EBT Intake Form, but no referral form was attached, (e) the UPO EBT Center Intake Form was not signed by staff who created the card, and (f) the EBT Card Destruction log was missing. o For two (2) out of the samples, we noted that the required authorizations by a DHS Supervisor and eligibility staff was missing. o For one (1) out of the samples, we noted that the EBT Card Issuance Log had a wrong date. • In addition, for one (1) out of the 60 samples, we noted that the information on the summary reconciliation sheet did not agree to the Card Issuance Log. The summary reconciliation sheet shows 40 cards issued while the Card Issuance Log shows a total of 39 cards issued. These exceptions resulted in the Agency not being in compliance with 7 CFR Section 274.8(b)(3). Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without adequate internal controls to ensure compliance with EBT Card Security requirements, there is an increased risk that the inventory of EBT cards will not be properly maintained and accounted for, or that the program will not be in compliance with program requirements. Cause – OCFO/OFT for DHS does not have adequate policies and procedures in place to ensure adequate safeguarding, documentation over issuance and monitoring of EBT cards. Recommendation - We recommend that OCFO/OFT for DHS strengthen formal policies and procedures to maintain adequate security over, and documentation/records for EBT Cards. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The OCFO/OFT for DHS concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-001 Prior Year Finding Number: 2023-002 Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 277.4(b), Federal reimbursement rate, states that the base percentage for Federal payment shall be 50 percent of State agencies’ allowable SNAP administrative costs. Per review of the Settlement Agreement from the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999, the District of Columbia is required to spend an additional $1,620,000 in local funds for the SNAP grant match each year by making an adjustment of $1,620,000 to the expenditures charged to the federal grant. Condition – During the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that two (2) out of four (4) quarterly SF-425 reports tested, which were for quarters ended March 30, 2024 and June 30, 2024, had the issues that resulted in this finding. The SF-425 reports tested were approved and certified, and DHS/ESA exceeded the required SNAP Matching amount of $41,509,067. However, the Office of the Chief Financial Officer (OCFO) for DHS/ESA was unable to provide supporting documentation that would allow us to agree specific amounts reported for (1) Quality Control, (2) Fraud Control, (3) ADP Operations, and (4) Outreach. The total calculated amount by OCFO for DHS/ESA reported as the actual match on the SF-425 report, excluding New Investment, was $43,129,064. However, the total recalculated amount by auditors to be reported as the actual match was $43,199,416. Variance between these two amounts was $70,352. In addition, during the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that the OCFO team for Human Support Services Cluster inadvertently failed to deduct the $1,620,000 adjustment from the Federal Share of Administrative Expenditures on the SEFA to comply with the Settlement Agreement with the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999. The Settlement Agreement requires the District of Columbia to spend $1,620,000 in local funds for the SNAP grant each year, which the Agency decided to reflect as a deduction from the Federal Share of Administrative Expenditures on the SEFA. Furthermore, as a result of the Random Movement Time Study, the Agency needed to move expenses from the SNAP bucket in the DIFS System and the Agency inadvertently moved $158,834 less expenses. Consequently, the Federal Share of Administrative Expenditures on the SEFA is higher compared to the Federal Share of Administrative Expenditures reported on SF-425 report.  Questioned Costs – None. Context – This is a condition identified per review of DHS/ESA’s compliance through the OCFO team with specified requirements using a statistically valid sample. Effect – OCFO for DHS/ESA is not in compliance with the stated provisions. Without adequate internal controls to ensure reconciliation of the amounts reported for the matching requirements and other pertinent information, there is an increased risk that matching and other pertinent information will not be properly reported. Cause – OCFO for DHS/ESA does not appear to have adequate policies and procedures in place to ensure that the amounts reported for the matching requirement and other pertinent information are accurate and supported. Recommendation – We recommend that OCFO for DHS/ESA strengthen its policies and procedures to ensure that amounts for SNAP matching requirements and other pertinent information are properly reported and that related reports are reviewed for compliance with program requirements as well as completeness and accuracy prior to submission. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-002 Prior Year Finding Number: 2023-003 Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Department of Health Care Finance (DHCF) DC Access System (DCAS) Program Management Administration Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 272.10(a), “All State agencies are required to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP.” Per 7 CFR Section 272.10(b), “In order to meet the requirements of the Act and ensure the efficient and effective administration of the program, a SNAP system, at a minimum, shall be automated in each of the following program areas (1) Certification and (2) Issuance Reconciliation and Reporting. Under Certification – States agencies must determine eligibility and calculate benefits or validate the eligibility worker’s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members’ names, addresses, dates of birth, social security numbers, individual household members’ earned and unearned income by source, deductions, resources and household size). Also, State agencies must redetermine or revalidate eligibility and benefits based on notices of change in households’ circumstances.” Condition – The District is self-reporting findings it noted from its ongoing efforts to resolve issues with the ADP system for SNAP. The issues identified and the estimated impact follows: 1. Failure to Send Correct and Timely Notices to SNAP Households - Notices pertaining to SNAP eligibility contain incorrect information, and/or SNAP applicants and recipients fail to receive proper notices. For example, in the Federal Fiscal Year (FFY) 2018 Local Program Access Review (PAR), Food and Nutrition Service (FNS) cited that SNAP applicants did not receive a Notice of Eligibility or notice contained incorrect information, no notice of required verification, and the notice of adverse action was incorrect. 2. Untimely Processing of SNAP Applications and Periodic Reports - On October 23, 2017, FNS advised DHS that its application processing timeliness (APT) rate between October 2016 and March 2017 was 88.45%, which triggered corrective action per FNS policy. Moreover, between that last APT report and now, DHS has disclosed that it has experienced processing backlogs of varying severity and persistence to FNS via ongoing communications and as part of waiver requests. DHS also provided a report to FNS in August 2022 that indicated significant application processing backlogs. 3. Establishment of Duplicate Accounts - DHS discovered that duplicate Product Delivery Cases (PDC) were being created in DCAS. One PDC was active and the other closed, but the closed PDC was still receiving benefits. 4. Issuance of Duplicate Payment - As a result of duplicate accounts in Deficiency 3, duplicate payments may have been issued to the same household when a caseworker reactivated a closed case. There is also a possibility that customers who received duplicate electronic benefits transfer (EBT) cards from different EBT vendors may have received duplicate payments. 5. Failure to Implement Computer Matching System - Based on the FFY18 Program Integrity Management Evaluation (ME) review, DHS failed to process Prisoner Verification System (PVS) matches, deceased matches, and National Directory of New Hires (NDNH) matches in accordance with federal requirements. 6. Failure to Produce System Computations to Support Recipient Claims - DCAS does not have the ability to calculate overpayments or send a demand letter. FNS correspondence letters dated October 18, 2017, and September 20, 2018, advised DHS to suspend the establishment of DCAS claims but allowed DHS to continue servicing ACEDS claims. 7. Treasury Offset Program (TOP) Reporting and Maintenance Decertified - FNS conducted a TOP Technical Review in June 2021 and DHS was decertified from TOP due to the following: • Referral of customers to TOP that are undergoing recoupment. • Incorrect determination of the date of delinquency. • Incorrect debt balance and debt status in TOP. 8. Failure to Initiate Recoupment on Active Households - When DCAS launched in October 2016, more than 3,000 claim cases with outstanding balances originating from SNAP overpayments were converted from ACEDS to DCAS. Some claims were not properly converted or activated in DCAS. As a result, DHS failed to take the required recovery actions, including TOP recovery or activation of the recoupment process through EBT cards. 9. Recipient and Benefit Integrity Report Update Required - DHS must provide an update on the target completion dates for system generation of all SNAP-related reports currently being created through manual intervention. The plan must include the procedures for reviewing and ensuring the accuracy of the data being submitted to Food Programs Reporting System (FPRS) with particular emphasis on the FNS-209 and the FNS-366B reports. DHS experienced some technical challenges in processing and retrieving claim and recoupment information accurately since the launch of DCAS in October 2016, which affected the FNS-209 quarterly reports. The Payment and Collections Division (PCD) and the DCAS report development team have made concerted efforts to improve the ability to generate data for the reports but continue to have difficulties in verifying the accuracy of data due in part to the laborious manual processes involved. Based on the FFY 2018 Program Integrity ME review, lines 3b, 10, and 14 of the FNS-209 failed to reconcile with the detailed documentation. 10. Work Requirements Have Not Been Properly Implemented - DHS is not in compliance with the requirement to accurately report on the FNS 583. DHS is unprepared to implement the work requirement and time limit for able-bodied adults without dependents when the current suspension mandated by the Families First Coronavirus Response Act ends and/or its waiver ends. Additionally, the District is not prepared to apply the Able-Bodied Adults Without Dependents (ABAWD) time limits when their ABAWD waiver expires. 11. Failure to Analyze Client Complaints and Include in the State’s Corrective Action Plans (CAP) Where Appropriate - DHS is failing to analyze client complaints and include in the State’s CAP where appropriate, per 7 CFR 271.6(a)(3) and 275.16. 12. The SNAP Application Does Not Clearly Explain Which Questions Are Required for SNAP - FNS reviewers found that the District’s SNAP application does not provide clear directions about which questions are required for SNAP, versus Cash or Medical Assistance. For example, Step 5 of the application asks “Does anyone in your household (including non-applicants) have any income? Yes – complete below; No – skip to step 6 (Complete if you are applying for Food, Medical, or Cash Assistance).” The directions are confusing and may be difficult to understand. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements resulting from a system implementation. Effect – Without an effectively designed and operated system in place, ineligible beneficiaries may receive benefits under the SNAP grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Inaccurate beneficiary allotment payments could result in participants receiving benefits that they are not entitled to receive under the program. Cause – DHS did not effectively design and operate the ADP system for SNAP which resulted to inaccurate benefit payments. Recommendation – We recommend that DHS continue to evaluate and improve the new ADP system for SNAP to ensure that it addresses all the administration requirements of the SNAP program. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS and DHCF DCAS team agree with the findings noted in this report. DHS self-reported these findings as part of the agency’s ongoing effort to maintain integrity with all eligibility determinations. The root cause of each of the twelve (12) case issues with the ADP system for SNAP varied. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-003 Prior Year Finding Number: 2023-004 Compliance Requirement: Special Tests and Provisions – EBT Card Security Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Office of the Chief Financial Officer/Office of Finance and Treasury (OCFO/OFT) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 274.8(b)(3), As an addition to or component of the Security Program required of Automated Data Processing (ADP) systems, the State agency shall ensure that the following electronic benefits transfer (EBT) security requirements are established: (i) Storage and control measures to control blank unissued EBT cards and PINs, and unused or spare POS devices; (ii) Measures to ensure communication access control. Communication controls shall include the transmission of transaction data and issuance information from POS terminals to work-stations and terminals at the data processing center; (iii) Message validation; (iv) Administrative and operational procedures; (v) A separate EBT security component shall be incorporated into the State agency Security Program for ADP systems. The periodic risk analyses required by the Security Program shall address the following items specific to an EBT system – (B) Completeness and timeliness of the reconciliation system; and (vi) The State agency shall incorporate the contingency plan approved by FNS into the Security Program. Condition – OCFO/OFT for DHS are required to maintain adequate security over, and documentation/records for EBT cards, to prevent their theft, embezzlement, loss damage, destruction, unauthorized transfer, negotiation, or use. OCFO/OFT have contracted with Fidelity National Information Service (FIS) for the issuance and security of the EBT cards; however, it is OCFO/OFT’s ultimate responsibility to ensure the contractor has controls in place to maintain adequate security over, and documentation/records of EBT cards in accordance with 7 CFR Section 274.8(b)(3). During our tests of the design and implementation of internal controls and compliance requirements in accordance with 7 CFR Section 274.8(b)(3), we noted the following issues: • For seventeen (17) out of the 60 samples, out of a population of 496 days from two EBT card centers, although both EBT Balance Sheets reconciled with the EBT Card Issuance Logs included in the package, we noted the following deficiencies: o For fourteen (14) out of the samples, we noted various issues including (a) the ID type for identification purposes was missing, (b) the customer case number was missing, (c) the Photo ID Program Referral Form was missing, (d) the identification type was noted as referral on the EBT Intake Form, but no referral form was attached, (e) the UPO EBT Center Intake Form was not signed by staff who created the card, and (f) the EBT Card Destruction log was missing. o For two (2) out of the samples, we noted that the required authorizations by a DHS Supervisor and eligibility staff was missing. o For one (1) out of the samples, we noted that the EBT Card Issuance Log had a wrong date. • In addition, for one (1) out of the 60 samples, we noted that the information on the summary reconciliation sheet did not agree to the Card Issuance Log. The summary reconciliation sheet shows 40 cards issued while the Card Issuance Log shows a total of 39 cards issued. These exceptions resulted in the Agency not being in compliance with 7 CFR Section 274.8(b)(3). Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without adequate internal controls to ensure compliance with EBT Card Security requirements, there is an increased risk that the inventory of EBT cards will not be properly maintained and accounted for, or that the program will not be in compliance with program requirements. Cause – OCFO/OFT for DHS does not have adequate policies and procedures in place to ensure adequate safeguarding, documentation over issuance and monitoring of EBT cards. Recommendation - We recommend that OCFO/OFT for DHS strengthen formal policies and procedures to maintain adequate security over, and documentation/records for EBT Cards. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The OCFO/OFT for DHS concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-004 Prior Year Finding Number: 2023-011 Compliance Requirement: Reporting Program: U.S. Department of the Treasury COVID-19 – Emergency Rental Assistance (ERA) Program ALN: 21.023 Award #: N/A Award Year: 12/27/2020 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Subrecipient expenditures, totaling approximately $29.8 million, which are required to be presented in the Schedule of Expenditures of Federal Awards (SEFA), were improperly excluded from the initial SEFA prepared by management. Subsequently, the SEFA was adjusted by DHS to reflect the subrecipient expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – DHS did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that DHS adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS Office of the Chief Financial Officer (OCFO) concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-005 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of the Treasury COVID-19 - Homeowner Assistance Fund ALN: 21.026 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Housing and Community Development (DHCD) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 2 CFR Section 200.406(a) defines credits as transactions that offset or reduce direct or indirect costs allocable to a Federal award. Examples of such transactions are purchase discounts, rebates or allowances, recoveries or indemnities on losses, insurance refunds or rebates, and adjustments of overpayments or erroneous charges. To the extent that such credits accruing to or received by the recipient or subrecipient relate to allowable costs, they must be credited to the Federal award either as a cost reduction or cash refund, as appropriate. Condition – During the review of benefit payments for the sixty (60) eligibility samples, we noted the following: • One payment made to the utility company where it was later determined that the homeowner was not eligible when additional information became available. • One instance where a duplicate payment was issued to the mortgage loan servicer. • One instance where the mortgage loan servicer noted the payment was no longer needed. For the conditions noted above, refunds are due to DHCD. Questioned Costs – Known amount is $42,289. Context – This is a condition identified per review of DHCD’s compliance with specified requirements using a statistically valid sample. Effect – Without adequate internal controls in place to ensure overpayments are identified and tracked by program and accounting personnel, DHCD could be noncompliant with the requirement to refund the agency for credits. Cause – DHCD did not have a process in place to identify and track credits. Recommendation – We recommend that DHCD implement a control to identify and track credits, such as refunds and duplicate payments, so that these amounts can be refunded to the agency. This includes strengthening communication between the program and accounting teams to ensure an awareness of possible refunds so adjustments can be made if necessary. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHCD concurs with the findings. DHCD will review and pursue repayment from these expenditures. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-006 Prior Year Finding Number: 2023-013 Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of the Treasury COVID-19 - Homeowner Assistance Fund ALN: 21.026 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Housing and Community Development (DHCD) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Additionally, 2 CFR Section 200.332 specifies that pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Based upon the pass-through entity's assessment of risk posed by the subrecipient, auditee management determined that onsite reviews of the subrecipient’s program operations were appropriate and designed the following control: DHCD performs desk audits, scheduled site visits and unscheduled site visits during the fiscal year. Reports are prepared at the site visits and properly documented. The reports include deficiencies, recommendations, and proposed corrective action and are reviewed and approved by the Project Managers, Program Managers, and Supervisory Program Managers. Condition – During our review of four (4) subrecipient samples from a total population of seven (7) subrecipients, we noted the following: • For one (1) subrecipient, DHCD provided plans to perform a review, but was unable to provide evidence of the review or a finalized report. • For three (3) subrecipients, DHCD neither performed an onsite review nor a desk audit. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHCD’s compliance with the subrecipient monitoring requirements using a statistically valid sample. Effect – DHCD did not comply with the subrecipient monitoring requirements of the Homeowner Assistance Fund program. Cause – DHCD does not have fully effective internal controls over compliance with respect to the onsite review process. Recommendation – We recommend that DHCD strictly adhere to its policies and procedures to ensure that onsite reviews are properly performed and documented for subrecipients. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHCD concurs with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-007 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of the Treasury COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Year: 10/01/2021 – 09/20/2024 Government Department/Agency: Office of the Deputy Mayor for Planning and Economic Development (DMPED); Office of the State Superintendent of Education (OSSE); Department of Employment Services (DOES); Department of Energy and Environment (DOEE); Department of Behavioral Health (DBH); Office of Neighborhood Safety and Engagement (ONSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – During the audit, of the total amounts passed through to subrecipients of $69.6 million, we noted that certain grant expenditures totaling approximately $14.8 million were erroneously reflected as amounts passed through to subrecipients on the initial Schedule of Expenditures Federal Awards (SEFA) under ALN 21.027, COVID-19 - Coronavirus State and Local Fiscal Recovery Funds. Total amounts passed through to subrecipients should have been $54.8 million. OCFO subsequently adjusted the SEFA to reflect the correct amounts passed through to subrecipients for the major program. Questioned Costs – None. Context – This is a condition identified per review of various agencies’ compliance with specified requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – The District agencies did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that the District agencies adhere to instituted policies and procedures to ensure accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The District agencies agree with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-008 Prior Year Finding Number: 2023-015 Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of the Treasury COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Year: 10/01/2021 – 09/20/2024 Government Department/Agency: Office of the Deputy Mayor for Public Safety and Justice (DMPSJ); Office of Neighborhood Safety and Engagement (ONSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with the Uniform Guidance in 2 CFR Section 200.331(a) Requirements for Pass-Through Entities requires that pass-through entities must: Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information outlined in the section noted above, pre-award assessment, indirect cost rated for the award, assistance listing number, finding and award follow-up and other pertinent actions. In accordance with the Uniform Guidance in 2 CFR Section 200.332 Requirements for Pass-Through Entities requires that pass-through entities Verify that the subrecipient is not excluded or disqualified in accordance with Section 180.300. Verification methods are provided in Section 180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. In accordance with the Uniform Guidance in 2 CFR Section 200.332(e) Requirements for Pass-Through Entities requires that pass-through entities must: Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: • Review financial and performance reports • Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. • Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200.521. • Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section Section 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Condition – The program’s documented subrecipient monitoring requirements includes risk assessments, monitoring of subrecipients and the submission and review of monthly financial and performance reports. During our testing of the subrecipient’s compliance requirements, we noted the following issues: • Our testing of the program’s subrecipient monitoring requirements includes submission and review of monthly financial and performance reports. We noted for one (1) out of 17 samples, the subrecipient failed to submit their monthly financial and performance reports. • For one (1) out of 17 samples, the agency had no evidence to support it had performed the mandatory follow up on reported audit findings in the subrecipient’s audit report for the Corrective Action taken by the subrecipient to remediate the finding. • For one (1) out of 17 samples, the agency had no evidence that a debarment check was performed before the contract was entered into. The agency’s documented policies and the procurement procedures mandate a debarment check before entering into new contracts. Questioned Costs – Not determinable. Context – This is a condition identified per review of various District agencies’ compliance with specified monitoring requirements on the program’s subrecipients using a statistically valid sample. Effect – Subrecipients may not be properly monitored, which may result in subawards being used for unauthorized purposes in violation of the terms and conditions of the subawards or that the subaward performance goals were not achieved. Cause – There is lack of sufficient documentary evidence to support that the controls are operating as designed related to subrecipient monitoring compliance. Recommendation – We recommend that the agencies maintain sufficient documentation to evidence its internal controls over the risk assessment and monitoring of subrecipients. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – While DMPSJ doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. ONSE acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section. BDO’s Response – We have reviewed management’s response and our finding remains as indicated.

Finding Number: 2024-009 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: Office of the Deputy Mayor for Planning and Economic Development (DMPED) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.403, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented.” In addition, the U.S. Department of Treasury, Guidance for the Coronavirus Capital Projects Fund For States, Territories & Freely Associated States (CPF), Section D. Eligible and Ineligible Cost: states that “Allowable costs are determined in accordance with the cost principles identified in 2 CFR Part 200, Subpart E. Federal funds committed to an award may only be used to cover allowable costs incurred during the period of performance and for allowable closeout costs incurred during the grant closeout process. Cost sharing is not a requirement for the use of these funds” Section C. Project Eligibility: also states the following, “Capital Project or Project means the construction, purchase, and installation of, and/or improvements to capital assets where the costs of such assets are capitalized or depreciated, including ancillary costs necessary to put the capital asset to use. Examples of capital assets include buildings, towers, digital devices and equipment, fiber-optic lines, and broadband networks. Examples of ancillary costs include project costs related to project planning and feasibility, broadband installation, and community engagement, broadband adoption, digital literacy, and training associated with a planned or completed Project funded by the Capital Projects Fund program.” Condition – During our examination of Activities Allowed or Unallowed and Allowable Costs/Cost Principles, we observed that the agency used federal funds to reimburse their subrecipient for lease rent of $3,242,953 invoiced from August 2023 through May 2024. This amount was reported to the Federal agency as ancillary costs. However, upon reviewing the supporting documentation, it was found that the rent charged to the grant pertained to the period following the substantial completion of the capital project's construction. Additionally, the leased rent does not appear to align with the definition of ancillary costs as outlined by the CFP guidance mentioned earlier. Furthermore, the agency was unable to provide documentation from the U.S. Treasury approving the leased rent or indicating its knowledge that it was included as part of ancillary costs. Based on the procedures performed and the review of relevant guidance, BDO notes that these costs do not meet the requirements to be considered allowable under the program. Questioned Costs – Known amount $3,242,953. Context – This is a condition identified per review of DMPED’s compliance with specified requirements using a statistically valid sample. Total subrecipient expenditures reported as allowable costs were $14,400,000. Effect – DMPED was unable to demonstrate that the rent charged was approved by the Department of Treasury and was an allowable cost under the guidance. Cause – DMPED did not have proper internal controls and policies and procedures in place to identify allowable costs and activities. Recommendation – We recommend that DMPED evaluate its procedures to ensure only allowable expenses are charged to the program as required under 2 CFR Section 200.403. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DMPED does not concur with the auditor’s finding regarding the allowability of rent per the CPF guidance. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section. BDO’s Response – We have reviewed management’s response and our finding remains as indicated.

Finding Number: 2024-010 Prior Year Finding Number: N/A Compliance Requirement: Procurement and Suspension and Debarment Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: District of Columbia Public Library (DCPL) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Section 200.318(a), General Procurement Standards, the non-federal entity must use its own documented procurement procedures which reflect applicable State, local, and tribal laws and regulations, provided that the procurements conform to applicable federal law and the standards identified in General Procurement Standards. Additionally, 2 CFR Section 200.318(i) states that the non-federal entity must maintain records sufficient to detail the history of the procurement. These records are required to include but are not necessarily limited to the following: rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. All procurement transactions must be conducted in a manner providing full and open competition consistent in accordance with 2 CFR Section 200.319 and must be performed using the appropriate procurement method as outlined in 2 CFR Section 200.320. In accordance with 2 CFR Section 200.320(c), Noncompetitive procurement. There are specific circumstances in which the recipient or subrecipient may use a noncompetitive procurement method. The noncompetitive procurement method may only be used if one of the following circumstances applies: (1) The aggregate amount of the procurement transaction does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section); (2) The procurement transaction can only be fulfilled by a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from providing public notice of a competitive solicitation; (4) The recipient or subrecipient requests in writing to use a noncompetitive procurement method, and the Federal agency or pass-through entity provides written approval; or (5) After soliciting several sources, competition is determined inadequate. Condition – During our testing of procurement and suspension and debarment requirements, we examined the two (2) procurement contracts that comprised the entire procurement population. Based on the procedures performed, we identified one (1) contract, valued at $278,259, out of the two (2) contracts totaling $8,185,708, in which DCPL used a single source or sole source justification for the selection rationale. However, this justification did not comply with the requirements set forth in 2 CFR Section 200.320(c). Questioned Costs – Not determinable. Context – This is a condition identified per review of DCPL’s compliance with the specified requirements using a statistically valid sample. Effect – Failure to adhere to the procurement procedures specified in the Uniform Administrative Requirements may lead to the Federal agency disallowing the procurement and associated costs. Cause – While DCPL adhered to their policies and procedures for private expenditures, the agency did not adhere to federal procurement requirements (2 CFR Section 200.320(c)) listed above to support noncompetitive procurement on the requirements to use sole source. Recommendation – We recommend that management establish the requisite internal control policies and procedures to ensure that all procurements reported under the federal program are in compliance. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DCPL concurs with the auditor’s findings and recommendations. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-011 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: Office of the Deputy Mayor for Planning and Economic Development (DMPED) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – DMPED had a single subrecipient through which $14.4 million in grant funds was expended. During our audit, we noted that DMPED did not submit the required FFATA report for its subrecipient through the FSRS or the sam.gov website for the one subaward issued in fiscal year 2024. Questioned Costs – None. Context – This is a condition identified per review of DMPED’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report results in noncompliance for the Coronavirus Capital Projects Fund program. Cause – DMPED did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that DMPED evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DMPED concurs with the auditor’s findings and recommendations related to Grant Reporting. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-012 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Credit Balances) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.164(h) outlines the following compliance requirements for Title IV credit balances: (6) Title IV, HEA credit balances. (1) A title IV, HEA credit balance occurs whenever the amount of title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period as provided under paragraph (c) of this section. (2) A title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than— (i) Fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (ii) Fourteen (14) days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition – During our testing, we noted the following issues: • For eight (8) of twenty-five (25) credit balances selected for testing, the credit balance created by the disbursement of Title IV awards was not refunded to the student within the required 14-day timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over credit balances from student financial assistance. Cause – Insufficient internal control and administrative oversight with respect to the disbursement of federal awards. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that Title IV credit balances are paid timely to students. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-013 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.173(b)(1) outlines the following compliance requirements for Title IV refunds. (b) Timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if— (1) The institution deposits or transfers the funds into the bank account it maintains under Section 668.163 no later than 45 days after the date it determines that the student withdrew. Condition – During our testing, we noted the following exception: • For one (1) of nineteen (19) students selected for Title IV refund calculation testing, the required Title IV refund was not adjusted in the U.S. Department of Education's Common Origination and Disbursement (COD) system within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not compliant with the Return of Title IV Funds compliance requirements. Cause – Insufficient administrative oversight with respect to Return of Title IV Funds requirements. Recommendation – We recommend that UDC enhance its process surrounding the disbursement of federal student aid to ensure compliance with the Return of Title IV Funds requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-014 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Enrollment Reporting Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Institutions are required to report enrollment information under the Pell grant and the Direct and Federal Family Education Loan (“FFEL”) loan programs via the National Student Loan Data System (“NSLDS”) (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the Student Financial Assistance Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (“NSLDSFAP”) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • Enrollment Effective Date – The date that the current enrollment status reported for a student was first effective. (See 4.4.2 of the NSLDS Enrollment Reporting Guide for the specific requirements for reporting the Enrollment Effective Date. Also see 4.4.3 of the NSLDS Enrollment Reporting Guide for additional guidance on effective dates for Withdrawal versus Graduation and Electronic Announcement titled – NSLDS Enrollment Reporting – Submission Dates, Effective Dates and Certification Dates, dated April 20, 2017, for additional information and examples at https://fsapartners.ed.gov/knowledge¬center/library/electronic-announcements/2017-04-20/general-subject-nslds¬enrollment-reporting-submission-dates-effective-dates-and-certification-dates.) • Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Certification Date – The Date enrollment certified by institution. At a minimum, institutions are required to certify enrollment every 60 days or every other month. Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • CIP Code – The Classification of Instructional Programs (CIP) is a set of codes that define fields of study. CIP Codes are maintained by ED's National Center for Education Statistics (NCES). They were most recently updated in 2020 and are usually updated every ten years. A listing of current CIP codes is available at: https://nces.ed.gov/ipeds/cipcode/resources.aspx?y=56. • CIP Year – Year for the corresponding CIP code. The CIP Year for the codes currently used by NSLDS is 2020. • Credential Level – Indicates the level of a credential the student will receive for the program the student is attending, for example undergraduate certificate, associate degree, or bachelor’s degree. (See 4.4.7 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting the Credential Level.) • Published Program Length Measurement – The institution identifies whether the Published Program Length is in days, weeks, or years. • Published Program Length - Published Program Length should be reported based on the definition of “normal time” to completion in the regulations at 34 CFR 668.41(a), • Program Begin Date – The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. (See 4.4.8 of the NSLDS Enrollment Reporting Guide for additional guidance.) • Program Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Program Enrollment Effective Date – The date when the student's current program status first took effect. Condition – UDC did not submit an accurate status change notification or failed to submit timely notification to the NSLDS website for certain students who graduated, withdrew or had a change in their enrollment status (full time, half time or less than half time) during the year. BDO selected a random sample of twenty-five (25) students used to evaluate both campus and program level enrollment reporting compliance requirements. For campus level enrollment, we noted the following exceptions: • For five (5) of twenty-five (25) campus level records tested, UDC did not certify the students’ enrollment data within 60 days. • For ten (10) of twenty-five (25) campus level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) campus level records tested, UDC did not correctly report the students’ enrollment status. For program level enrollment, we noted the following exceptions: • For one (1) of twenty-five (25) program level records tested, UDC did not accurately report the Published Program Length. • For ten (10) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment Status. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified enrollment requirements using a statistically valid sample. Effect – UDC is not in compliance with enrollment reporting requirements. Failure to promptly report accurate and timely changes in enrollment status may adversely impact the repayment status for student loan borrowers. Cause – Insufficient internal controls and administrative oversight with respect to enrollment reporting requirements. Recommendation – We recommend that UDC enhance its procedures and internal controls over enrollment reporting to ensure that significant data elements under both campus-level and program-level records are reported accurately and timely to NSLDS. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-012 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Credit Balances) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.164(h) outlines the following compliance requirements for Title IV credit balances: (6) Title IV, HEA credit balances. (1) A title IV, HEA credit balance occurs whenever the amount of title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period as provided under paragraph (c) of this section. (2) A title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than— (i) Fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (ii) Fourteen (14) days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition – During our testing, we noted the following issues: • For eight (8) of twenty-five (25) credit balances selected for testing, the credit balance created by the disbursement of Title IV awards was not refunded to the student within the required 14-day timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over credit balances from student financial assistance. Cause – Insufficient internal control and administrative oversight with respect to the disbursement of federal awards. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that Title IV credit balances are paid timely to students. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-013 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.173(b)(1) outlines the following compliance requirements for Title IV refunds. (b) Timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if— (1) The institution deposits or transfers the funds into the bank account it maintains under Section 668.163 no later than 45 days after the date it determines that the student withdrew. Condition – During our testing, we noted the following exception: • For one (1) of nineteen (19) students selected for Title IV refund calculation testing, the required Title IV refund was not adjusted in the U.S. Department of Education's Common Origination and Disbursement (COD) system within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not compliant with the Return of Title IV Funds compliance requirements. Cause – Insufficient administrative oversight with respect to Return of Title IV Funds requirements. Recommendation – We recommend that UDC enhance its process surrounding the disbursement of federal student aid to ensure compliance with the Return of Title IV Funds requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-014 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Enrollment Reporting Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Institutions are required to report enrollment information under the Pell grant and the Direct and Federal Family Education Loan (“FFEL”) loan programs via the National Student Loan Data System (“NSLDS”) (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the Student Financial Assistance Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (“NSLDSFAP”) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • Enrollment Effective Date – The date that the current enrollment status reported for a student was first effective. (See 4.4.2 of the NSLDS Enrollment Reporting Guide for the specific requirements for reporting the Enrollment Effective Date. Also see 4.4.3 of the NSLDS Enrollment Reporting Guide for additional guidance on effective dates for Withdrawal versus Graduation and Electronic Announcement titled – NSLDS Enrollment Reporting – Submission Dates, Effective Dates and Certification Dates, dated April 20, 2017, for additional information and examples at https://fsapartners.ed.gov/knowledge¬center/library/electronic-announcements/2017-04-20/general-subject-nslds¬enrollment-reporting-submission-dates-effective-dates-and-certification-dates.) • Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Certification Date – The Date enrollment certified by institution. At a minimum, institutions are required to certify enrollment every 60 days or every other month. Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • CIP Code – The Classification of Instructional Programs (CIP) is a set of codes that define fields of study. CIP Codes are maintained by ED's National Center for Education Statistics (NCES). They were most recently updated in 2020 and are usually updated every ten years. A listing of current CIP codes is available at: https://nces.ed.gov/ipeds/cipcode/resources.aspx?y=56. • CIP Year – Year for the corresponding CIP code. The CIP Year for the codes currently used by NSLDS is 2020. • Credential Level – Indicates the level of a credential the student will receive for the program the student is attending, for example undergraduate certificate, associate degree, or bachelor’s degree. (See 4.4.7 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting the Credential Level.) • Published Program Length Measurement – The institution identifies whether the Published Program Length is in days, weeks, or years. • Published Program Length - Published Program Length should be reported based on the definition of “normal time” to completion in the regulations at 34 CFR 668.41(a), • Program Begin Date – The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. (See 4.4.8 of the NSLDS Enrollment Reporting Guide for additional guidance.) • Program Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Program Enrollment Effective Date – The date when the student's current program status first took effect. Condition – UDC did not submit an accurate status change notification or failed to submit timely notification to the NSLDS website for certain students who graduated, withdrew or had a change in their enrollment status (full time, half time or less than half time) during the year. BDO selected a random sample of twenty-five (25) students used to evaluate both campus and program level enrollment reporting compliance requirements. For campus level enrollment, we noted the following exceptions: • For five (5) of twenty-five (25) campus level records tested, UDC did not certify the students’ enrollment data within 60 days. • For ten (10) of twenty-five (25) campus level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) campus level records tested, UDC did not correctly report the students’ enrollment status. For program level enrollment, we noted the following exceptions: • For one (1) of twenty-five (25) program level records tested, UDC did not accurately report the Published Program Length. • For ten (10) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment Status. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified enrollment requirements using a statistically valid sample. Effect – UDC is not in compliance with enrollment reporting requirements. Failure to promptly report accurate and timely changes in enrollment status may adversely impact the repayment status for student loan borrowers. Cause – Insufficient internal controls and administrative oversight with respect to enrollment reporting requirements. Recommendation – We recommend that UDC enhance its procedures and internal controls over enrollment reporting to ensure that significant data elements under both campus-level and program-level records are reported accurately and timely to NSLDS. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-012 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Credit Balances) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.164(h) outlines the following compliance requirements for Title IV credit balances: (6) Title IV, HEA credit balances. (1) A title IV, HEA credit balance occurs whenever the amount of title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period as provided under paragraph (c) of this section. (2) A title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than— (i) Fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (ii) Fourteen (14) days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition – During our testing, we noted the following issues: • For eight (8) of twenty-five (25) credit balances selected for testing, the credit balance created by the disbursement of Title IV awards was not refunded to the student within the required 14-day timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over credit balances from student financial assistance. Cause – Insufficient internal control and administrative oversight with respect to the disbursement of federal awards. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that Title IV credit balances are paid timely to students. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-013 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.173(b)(1) outlines the following compliance requirements for Title IV refunds. (b) Timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if— (1) The institution deposits or transfers the funds into the bank account it maintains under Section 668.163 no later than 45 days after the date it determines that the student withdrew. Condition – During our testing, we noted the following exception: • For one (1) of nineteen (19) students selected for Title IV refund calculation testing, the required Title IV refund was not adjusted in the U.S. Department of Education's Common Origination and Disbursement (COD) system within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not compliant with the Return of Title IV Funds compliance requirements. Cause – Insufficient administrative oversight with respect to Return of Title IV Funds requirements. Recommendation – We recommend that UDC enhance its process surrounding the disbursement of federal student aid to ensure compliance with the Return of Title IV Funds requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-014 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Enrollment Reporting Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Institutions are required to report enrollment information under the Pell grant and the Direct and Federal Family Education Loan (“FFEL”) loan programs via the National Student Loan Data System (“NSLDS”) (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the Student Financial Assistance Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (“NSLDSFAP”) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • Enrollment Effective Date – The date that the current enrollment status reported for a student was first effective. (See 4.4.2 of the NSLDS Enrollment Reporting Guide for the specific requirements for reporting the Enrollment Effective Date. Also see 4.4.3 of the NSLDS Enrollment Reporting Guide for additional guidance on effective dates for Withdrawal versus Graduation and Electronic Announcement titled – NSLDS Enrollment Reporting – Submission Dates, Effective Dates and Certification Dates, dated April 20, 2017, for additional information and examples at https://fsapartners.ed.gov/knowledge¬center/library/electronic-announcements/2017-04-20/general-subject-nslds¬enrollment-reporting-submission-dates-effective-dates-and-certification-dates.) • Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Certification Date – The Date enrollment certified by institution. At a minimum, institutions are required to certify enrollment every 60 days or every other month. Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • CIP Code – The Classification of Instructional Programs (CIP) is a set of codes that define fields of study. CIP Codes are maintained by ED's National Center for Education Statistics (NCES). They were most recently updated in 2020 and are usually updated every ten years. A listing of current CIP codes is available at: https://nces.ed.gov/ipeds/cipcode/resources.aspx?y=56. • CIP Year – Year for the corresponding CIP code. The CIP Year for the codes currently used by NSLDS is 2020. • Credential Level – Indicates the level of a credential the student will receive for the program the student is attending, for example undergraduate certificate, associate degree, or bachelor’s degree. (See 4.4.7 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting the Credential Level.) • Published Program Length Measurement – The institution identifies whether the Published Program Length is in days, weeks, or years. • Published Program Length - Published Program Length should be reported based on the definition of “normal time” to completion in the regulations at 34 CFR 668.41(a), • Program Begin Date – The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. (See 4.4.8 of the NSLDS Enrollment Reporting Guide for additional guidance.) • Program Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Program Enrollment Effective Date – The date when the student's current program status first took effect. Condition – UDC did not submit an accurate status change notification or failed to submit timely notification to the NSLDS website for certain students who graduated, withdrew or had a change in their enrollment status (full time, half time or less than half time) during the year. BDO selected a random sample of twenty-five (25) students used to evaluate both campus and program level enrollment reporting compliance requirements. For campus level enrollment, we noted the following exceptions: • For five (5) of twenty-five (25) campus level records tested, UDC did not certify the students’ enrollment data within 60 days. • For ten (10) of twenty-five (25) campus level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) campus level records tested, UDC did not correctly report the students’ enrollment status. For program level enrollment, we noted the following exceptions: • For one (1) of twenty-five (25) program level records tested, UDC did not accurately report the Published Program Length. • For ten (10) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment Status. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified enrollment requirements using a statistically valid sample. Effect – UDC is not in compliance with enrollment reporting requirements. Failure to promptly report accurate and timely changes in enrollment status may adversely impact the repayment status for student loan borrowers. Cause – Insufficient internal controls and administrative oversight with respect to enrollment reporting requirements. Recommendation – We recommend that UDC enhance its procedures and internal controls over enrollment reporting to ensure that significant data elements under both campus-level and program-level records are reported accurately and timely to NSLDS. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-012 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Credit Balances) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.164(h) outlines the following compliance requirements for Title IV credit balances: (6) Title IV, HEA credit balances. (1) A title IV, HEA credit balance occurs whenever the amount of title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period as provided under paragraph (c) of this section. (2) A title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than— (i) Fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (ii) Fourteen (14) days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition – During our testing, we noted the following issues: • For eight (8) of twenty-five (25) credit balances selected for testing, the credit balance created by the disbursement of Title IV awards was not refunded to the student within the required 14-day timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over credit balances from student financial assistance. Cause – Insufficient internal control and administrative oversight with respect to the disbursement of federal awards. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that Title IV credit balances are paid timely to students. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-013 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.173(b)(1) outlines the following compliance requirements for Title IV refunds. (b) Timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if— (1) The institution deposits or transfers the funds into the bank account it maintains under Section 668.163 no later than 45 days after the date it determines that the student withdrew. Condition – During our testing, we noted the following exception: • For one (1) of nineteen (19) students selected for Title IV refund calculation testing, the required Title IV refund was not adjusted in the U.S. Department of Education's Common Origination and Disbursement (COD) system within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not compliant with the Return of Title IV Funds compliance requirements. Cause – Insufficient administrative oversight with respect to Return of Title IV Funds requirements. Recommendation – We recommend that UDC enhance its process surrounding the disbursement of federal student aid to ensure compliance with the Return of Title IV Funds requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-014 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Enrollment Reporting Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Institutions are required to report enrollment information under the Pell grant and the Direct and Federal Family Education Loan (“FFEL”) loan programs via the National Student Loan Data System (“NSLDS”) (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the Student Financial Assistance Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (“NSLDSFAP”) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • Enrollment Effective Date – The date that the current enrollment status reported for a student was first effective. (See 4.4.2 of the NSLDS Enrollment Reporting Guide for the specific requirements for reporting the Enrollment Effective Date. Also see 4.4.3 of the NSLDS Enrollment Reporting Guide for additional guidance on effective dates for Withdrawal versus Graduation and Electronic Announcement titled – NSLDS Enrollment Reporting – Submission Dates, Effective Dates and Certification Dates, dated April 20, 2017, for additional information and examples at https://fsapartners.ed.gov/knowledge¬center/library/electronic-announcements/2017-04-20/general-subject-nslds¬enrollment-reporting-submission-dates-effective-dates-and-certification-dates.) • Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Certification Date – The Date enrollment certified by institution. At a minimum, institutions are required to certify enrollment every 60 days or every other month. Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • CIP Code – The Classification of Instructional Programs (CIP) is a set of codes that define fields of study. CIP Codes are maintained by ED's National Center for Education Statistics (NCES). They were most recently updated in 2020 and are usually updated every ten years. A listing of current CIP codes is available at: https://nces.ed.gov/ipeds/cipcode/resources.aspx?y=56. • CIP Year – Year for the corresponding CIP code. The CIP Year for the codes currently used by NSLDS is 2020. • Credential Level – Indicates the level of a credential the student will receive for the program the student is attending, for example undergraduate certificate, associate degree, or bachelor’s degree. (See 4.4.7 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting the Credential Level.) • Published Program Length Measurement – The institution identifies whether the Published Program Length is in days, weeks, or years. • Published Program Length - Published Program Length should be reported based on the definition of “normal time” to completion in the regulations at 34 CFR 668.41(a), • Program Begin Date – The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. (See 4.4.8 of the NSLDS Enrollment Reporting Guide for additional guidance.) • Program Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Program Enrollment Effective Date – The date when the student's current program status first took effect. Condition – UDC did not submit an accurate status change notification or failed to submit timely notification to the NSLDS website for certain students who graduated, withdrew or had a change in their enrollment status (full time, half time or less than half time) during the year. BDO selected a random sample of twenty-five (25) students used to evaluate both campus and program level enrollment reporting compliance requirements. For campus level enrollment, we noted the following exceptions: • For five (5) of twenty-five (25) campus level records tested, UDC did not certify the students’ enrollment data within 60 days. • For ten (10) of twenty-five (25) campus level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) campus level records tested, UDC did not correctly report the students’ enrollment status. For program level enrollment, we noted the following exceptions: • For one (1) of twenty-five (25) program level records tested, UDC did not accurately report the Published Program Length. • For ten (10) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment Status. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified enrollment requirements using a statistically valid sample. Effect – UDC is not in compliance with enrollment reporting requirements. Failure to promptly report accurate and timely changes in enrollment status may adversely impact the repayment status for student loan borrowers. Cause – Insufficient internal controls and administrative oversight with respect to enrollment reporting requirements. Recommendation – We recommend that UDC enhance its procedures and internal controls over enrollment reporting to ensure that significant data elements under both campus-level and program-level records are reported accurately and timely to NSLDS. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-015 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Annual Report Card, High School Graduation Rate Program: U.S. Department of Education Title I Grants to Local Educational Agencies ALN: 84.010 Award #: S010A230051; S010A220051-22A Award Year: 07/01/2023 – 09/30/2024 Government Department/Agency: District of Columbia Public Schools (DCPS) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. A State Educational Agency (SEA) and its Local Educational Agencies (LEAs) must report graduation rate data for all public high schools at the school, LEA, and state levels using the four-year adjusted cohort rate and, at an SEA’s or LEA’s discretion, one or more extended-year adjusted cohort rates. Graduation rate data must be reported both in the aggregate and disaggregated by the subgroups in Section 1111(c)(2) of the Elementary and Secondary Act of 1965 (ESEA), homeless status, status as a child in foster care using a four-year adjusted cohort graduation rate (and any extended-year adjusted cohort rates) (ESEA sections 1111(h)(1)(C)(iii)(II) and 8101(23), (25) (20 USC 6311(h)(1)(C)(iii)(II) and 7801(23), (25))). To remove a student from the cohort, a school or LEA must confirm, in writing, that the student transferred out, emigrated to another country, transferred to a prison or juvenile facility, or is deceased. To confirm that a student transferred out, the school or LEA must have official written documentation that the student enrolled in another school or in an educational program that culminates in the award of a regular high school diploma. A student who is retained in grade, enrolls in a General Education Development program, or leaves school for any other reason may not be counted as having transferred out for the purpose of calculating graduation rate and must remain in the adjusted cohort (ESEA sections 1111(h)(1)(C)(iii)(II) and 8101(23), (25) (20 USC 6311(h)(1)(C)(iii)(II) and 7801(23), (25))). Condition – During the audit, we noted the following out of forty (40) samples tested: • For two (2) samples, there were no supporting documentation for the removal from the cohort of students who voluntarily dropped their enrollment. • For two (2) samples, students who graduated under DCPS school were incorrectly removed from the cohort. • For ten (10) samples, there were no evidence of review and approval on the documentation maintained for the removal of the student from the cohort. Questioned Costs – Not determinable. Context – This is a condition identified per review of DCPS’ compliance with specified requirements using a statistically valid sample. Effect – Failure to maintain appropriate documentation supporting the approval and removal of a student from the cohort report results in noncompliance for the Title I Part A Grants to LEA program. Cause – DCPS is unable to consistently apply existing policy on documenting review and approval of written documentation supporting the removal of students from the cohort due to lack of consistent communication, coordination and oversight over this process. Recommendation – We recommend that DCPS strengthen its policies, procedures and controls to ensure review and approval are documented and maintained with regards to removal of students from the cohort. We also recommend that training is conducted for employees to ensure that the process is implemented and consistently applied across all DCPS schools. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DCPS agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-016 Prior Year Finding Number: 2023-020 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. For TANF, per 45 CFR Section 205.60 (a), “The State agency will maintain or supervise the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of financial assistance, and the use of any information obtained under Section 205.55, with respect to individual applications denied, recipients whose benefits have been terminated, recipients whose benefits have been modified, and the dollar value of these denials, terminations and modifications. Under this requirement, the agency will keep individual records which contain pertinent facts about each applicant and recipient. The records will include information concerning the date of application and the date and basis of its disposition; facts essential to the determination of initial and continuing eligibility (including the individual's social security number, need for, and provision of financial assistance); and the basis for discontinuing assistance.” Condition – During our testing over beneficiary eligibility compliance requirements of the Temporary Assistance for Needy Families (TANF) program, we selected a sample of 60 beneficiaries in fiscal year 2024 to test DHS’ compliance with TANF eligibility requirements. Total number of payments in the population is 46,856, and total dollar amount from which we selected the samples is $34,639,375. We noted the following: • For ten (10) out of 60 samples, DHS was unable to provide support that would allow us to test that cash assistance was not provided to an individual during the 10-year period that began on the date the individual was convicted in Federal or State court of having made a fraudulent statement or representation with respect to place of residence. In addition, one (1) of these ten (10) samples, DHS was unable to include the individual’s Social Security Number (SSN) in DCAS. Consequently, we were unable to verify the following information in DCAS: household composition, income, proof of residency, and SSNs for all individuals included in the application. Further, one (1) of these ten (10) samples, DHS was unable to provide support that would allow us to test that assistance was not provided to any individual who was fleeing to avoid prosecution, or custody or confinement after conviction, for a felony or attempt to commit a felony, or who is violating a condition of probation or parole imposed under Federal or State law. These exceptions happened due to inadequate review of application for cash assistance by the Social Service Representatives. The questioned costs for the above issues amounted to $107,137, which represents 26.22% of the total eligibility amounts tested related to the 60 sampled items of $408,555. Questioned Costs – Known amount is $107,137. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support eligibility determinations, ineligible beneficiaries may receive benefits under the TANF grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation supporting participant eligibility. Recommendation - We recommend that DHS strengthen its existing policies and procedures over the review and maintenance of appropriate documentation to ensure compliance with eligibility requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS/ESA concur with the findings. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-017 Prior Year Finding Number: 2023-021 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. According to Title IV-A, Section 411 of the Social Security Act (the Act), 45 CFR 265.3, and the American Recovery and Reinvestment Act (ARRA) of 2009, (Public Law 111-5), each State must file an annual report containing information on the TANF program and the State’s maintenance-of-effort (MOE) program(s) for that year, including strategies to implement the Family Violence Option, State diversion programs, and other program characteristics. States are required to submit the ACF-196R report quarterly, beginning in Federal Fiscal Year (FFY) 2015, in lieu of the SF-425, Federal Financial Report (financial status). Each State files quarterly expenditure data on the State’s use of Federal TANF funds, State TANF MOE expenditures, and State expenditures of MOE funds in separate State programs. If a State is expending Federal TANF funds received in prior fiscal years, it must file a separate quarterly TANF Financial Report for each fiscal year that provides information on the expenditures of that year’s TANF funds. This form must be used for reporting regular TANF grant funds, Contingency Funds, and ARRA-Emergency Fund for TANF State Programs funds. See TANF-ACF-PI-2014-02, available at http://www.acf.hhs.gov/programs/ofa/resource/tanf-acf-pi-2014-02, for more information. Condition – During our test work over the quarterly ACF-196R report, we noted that for Grant Identifying numbers G-2101DCTANF, G-2201DCTANF and G-2301DCTANF, the ACF-196R filed for 4th quarter in fiscal year 2024 showed a variance of $86,958, $375,033 and $2,648,441, respectively, between the amounts reported on the ACF-196R and the amounts included in DIFS. In addition, for Grant Identifying number G-2401DCTANF, we noted that there was a variance of ($4,637,270) between the amount included in the SEFA detail including Indirect Costs ($64,708,667) and the cumulative amount reported on the ACF-196R for the fiscal year 2024 grant for the sum of federal and contingency funds ($60,071,397). DHS was unable to provide support for the variance. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure that correct amounts were reported and were properly reviewed, DHS may report incorrect amounts on the quarterly ACF-196R reports. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that the amounts on the ACF-196R were properly reported and the reports were properly reviewed and approved. Recommendation - We recommend that DHS implement policies, procedures and controls that will enable an accurate reconciliation between the data sources used in the preparation of the ACF-196R reports to ensure proper reporting of TANF expenditures. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS OCFO concurs with the finding. The variances identified specifically relate to administrative costs incurred on the fiscal year 2024 grant that were moved to prior year grants. The fiscal year 2024 TANF administrative expenditure exceeded the TANF administrative cap for fiscal year 2024 and to correct the issue, the excess administrative cost was reallocated to prior open fiscal years (fiscal years 2021, 2022 and 2023). The administrative cap limit for fiscal years 2021, 2022 and 2023 were not fully utilized and so the Agency decided to charge the excess fiscal year 2024 administrative expenses to those grants. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-018 Prior Year Finding Number: 2023-022 Compliance Requirement: Reporting; Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 261.60 (a), “A State must report the actual hours that an individual participates in an activity, subject to the qualifications in paragraphs (b) and (c) of this section and Section 261.61(c). It is not sufficient to report the hours an individual is scheduled to participate in an activity. (b) For the purposes of calculating the work participation rates for a month, actual hours may include the hours for which an individual was paid, including paid holidays and sick leave. For participation in unpaid work activities, it may include excused absences for hours missed due to a maximum of 10 holidays in the preceding 12-month period and up to 80 hours of additional excused absences in the preceding 12-month period, no more than 16 of which may occur in a month, for each work-eligible individual. Each State must designate the days that it wishes to count as holidays for those in unpaid activities in its Work Verification Plan. It may designate no more than 10 such days. In order to count an excused absence as actual hours of participation, the individual must have been scheduled to participate in a countable work activity for the period of the absence that the State reports as participation. A State must describe its excused absence policies and definitions as part of its Work Verification Plan, specified at Section 261.62. (c) For unsubsidized employment, subsidized employment, and OJT, a State may report projected actual hours of employment participation for up to six months based on current, documented actual hours of work. Any time a State receives information that the client's actual hours of work have changed, or no later than the end of any six-month period, the State must re-verify the client's current actual average hours of work, and may report these projected actual hours of participation for another six-month period. (d) A State may not count more hours toward the participation rate for a self-employed individual than the number derived by dividing the individual's self-employment income (gross income less business expenses) by the Federal minimum wage. A State may propose an alternative method of determining self-employment hours as part of its Work Verification Plan. (e) A State may count supervised homework time and up to one hour of unsupervised homework time for each hour of class time. Total homework time counted for participation cannot exceed the hours required or advised by a particular educational program.” Per 45 CFR Section 261.61 (a), “A State must support each individual’s hours of participation with documentation in the case file. In accordance with Section 261.62, a State must describe in its Work Verification Plan the documentation it uses to verify hours of participation in each activity.”   According to the DC State Verification Plan, the D.C. Department of Human Services (DHS), Department of Human Services Monitoring Unit reviews and audits all documentation submitted by vendors reflecting the activities of recipients in TANF Employment program. This documentation includes time sheets, activity logs, school records, pay stubs, and verification of employment, work experience and on-the-job training. The Monitoring Unit completes this audit process to determine if sufficient documentation exists to substantiate reported time and attendance data, to warrant a payment to TANF Employment program vendors, and submission of countable hours for federal reporting purposes. The District projects hours of participation in unsubsidized, self-employment for six months or until the recipient's next scheduled recertification, whichever is sooner. Per 45 CFR Section 265.7 (a)-(c), “Each State’s quarterly reports (the TANF Data Report, the TANF Financial Report (or Territorial Financial Report), and the SSP-MOE Data Report) must be complete and accurate and filed by the due date.” For disaggregated data report, ‘a complete and accurate report’ means that: (1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems, and include correction of the quarterly data by the end of the fiscal year reporting period; (2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so); (3) The State reports data for all required elements (i.e., no data are missing); (4)(i) The State provides data on all families; or (ii) if the State opts to use sampling, the State reports data on all families selected in a sample that meets the specification and procedures in the TANF Sampling Manual (except for families listed in error); and (5) Where estimates are necessary (e.g., some types of assistance may require cost estimates), the State uses reasonable methods to develop these estimates. For an aggregated data report, “a complete and accurate report” means that: (1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems; (2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so); (3) The State reports data on all applicable elements; and (4) Monthly totals are unduplicated counts for all families (e.g., the number of families and the number of out-of-wedlock births are unduplicated counts).” 45 CFR Section 265.7 (f) states that “States must maintain records to adequately support any report, in accordance with Section 75.361 through 75.370 of this title.” Condition – During our test work over a sample of 60 participants for Special Tests and Provisions - Penalty for Failure to Comply with Work Verification Plan and Reporting, we noted: • For six (6) instances, we noted that although the hours reported on the ACF-199 report met or exceeded the required hours, the hours reported did not agree with the average hours reported in CATCH. • For seven (7) instances, we noted that although participant work activity was adequately documented and properly supported by audited timesheets, the participant did not meet the work participation weekly hours requirement. In addition, for four (4) of these samples, we noted that the hours reported on the ACF-199 report do not agree with the average hours in CATCH. • For nine (9) instances, we noted that for a customer with unsubsidized employment, although the hours reported on the ACF-199 report met or exceeded the required hours, the hours reported did not agree with the projected hours per the support. • For ten (10) instances, we noted that although the reported hours met or exceeded the required hours, no documentation support was provided to support the ACF-199 report. • For one (1) instance, we noted that although the hours on the support provided met or exceeded the required hours and the hours reported in the ACF-199 report agree with the average hours reported in CATCH, the hours entered in CATCH should initially have been denied by TANF Office of Performance Monitoring and then re-entered by provider because the hours were entered incorrectly. • For one (1) instance, we noted that the number of audited hours per timesheet did not agree with the approved hours in CATCH. In addition, although the hours reported on the ACF-199 report met or exceeded the required hours, the hours reported did not agree with the actual hours per the CATCH support. • For one (1) instance, we noted that for a customer with unsubsidized employment, the support provided was for more than six months before the sample month. Therefore, the hours reported were not properly supported. In addition, although the hours reported on the ACF-199 report met or exceeded the required hours, the hours reported did not agree with the projected hours per the support. • For one (1) instance, we noted that although the hours reported in the ACF-199 report met or exceeded the required hours, a review of the Work documentation support provided detailing employment, noted no hours were included on the documentation. Therefore, the hours reported and projected were not supported. The information tested in our sample represents the underlying data used in Reporting for the 2nd and 4th quarters of fiscal year 2024. Consequently, DHS incorrectly reported data in the ACF-199 report for the 2nd and 4th quarters of fiscal year 2024. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Data within the ACF-199 report may not be complete and accurate. Specifically, if the work participation data is not substantiated, or inconsistencies are noted, it may result in inaccurate data being reported and may lead to an incorrect ACF-199 report and could result in an incorrect allocation of Federal Funds to the state. Cause – Controls are not operating effectively over the documentation of work participation data to ensure that adequate evidence of the work participation is maintained. Recommendation - We recommend that DHS enforce existing policies and procedures and implement additional controls to ensure that adequate documentation is maintained to substantiate the work participation data reported in the ACF-199 report in accordance with the District of Columbia Work Verification Plan. We also recommend that DHS implement policies, procedures and controls that will enable an accurate reconciliation between the data sources used in the preparation of the ACF-199 report to ensure proper reporting of data elements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS agrees with the findings and will work with the DC Access System (DCAS) and Division of Innovation and Change Management (DICM) teams to mitigate the causes of the findings. These findings are mostly residual issues with the tables in DHS/ESA DCAS system. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-019 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Child Support Non-Cooperation Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 264.30 (a) (1) The State agency must refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency (i.e., the IV-D agency). (2) Referred individuals must cooperate in establishing paternity and in establishing, modifying, or enforcing a support order with respect to the child. Per 45 CFR Section 264.30 (c) The IV-A agency must then take appropriate action by: (1) Deducting from the assistance that would otherwise be provided to the family of the individual an amount equal to not less than 25 percent of the amount of such assistance; or (2) Denying the family any assistance under the program. Per the Code of the District of Columbia - Section 4–205.55. (a) The Mayor shall give timely and adequate notice in cases of intended action to discontinue, withhold, terminate, suspend, reduce assistance, or make assistance subject to additional conditions, or to change the manner or form of payment to a protective, vendor, or 2-party payment. (1) “Timely” means that the notice is postmarked at least 15 days before the date upon which the action would become effective, except as provided in Section 4-205.54(d). (2) “Adequate” means that the written notice includes a statement of what action the Mayor intends to take, the reasons for the intended action, the specific law and regulations supporting the action, an explanation of the individual’s right to request a hearing, and the circumstances under which assistance will be continued if a hearing is requested. Condition – During our compliance test work for the Special Tests and Provisions – Child Support Non-Cooperation compliance requirement, we tested forty (40) out of a population of 295 child support cases referred by Child Support Enforcement (CSE) to the TANF program as having not cooperated with Child Support. We noted that for four (4) out of 40 samples, DHS was unable to provide support why the individual was not sanctioned. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support not imposing sanctions to individuals may result to noncompliance with TANF Child Support Non-Cooperation compliance requirements. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation supporting compliance with TANF Child Support Non-Cooperation compliance requirements. Recommendation - We recommend that DHS strengthen its existing policies and procedures over enforcement of sanctions and maintenance of appropriate documentation to ensure compliance with TANF Child Support Non-Cooperation compliance requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS/ESA agree with the auditor’s findings regarding the lack of completion of requests from the Child Support Enforcement (CSE) to the TANF program to impose a child support on parents who have not cooperated with child support compliance requirements. The incomplete work was due to staff transitions occurring during the review period which impacted the oversight and productivity of DHS/ESA staff working on the child support sanction process. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-020 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Penalty for Refusal to Work Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 261.14 (a) and (b) “(a) If an individual refuses to engage in work required under section 407 of the Act, the State must reduce or terminate the amount of assistance payable to the family, subject to any good cause or other exceptions the State may establish. Such a reduction is governed by the provisions of Section 261.16. The State must, at a minimum, reduce the amount of assistance otherwise payable to the family pro rata with respect to any period during the month in which the individual refuses to work. The State may impose a greater reduction, including terminating assistance.” Condition – During our testing of Special Tests and Provisions – Penalty for Refusal to Work, we selected a sample of 60 cases in fiscal year 2024 to test DHS’ compliance with specified requirements. Total population is comprised of 4,812 case numbers for individuals that received payments for months where they did not meet the work requirements. Total dollar amount is $19,993,065. We noted the following: • For eight (8) instances, we noted that an individual had no participation hours in CATCH for various dates during fiscal year 2024 and DHS/ESA was unable to provide supporting exemptions or justifications for not sanctioning the individual during the period in question. • For one (1) instance, we noted that an individual had no participation hours reported in CATCH for period October 2023 through April 2024 but a review of DCAS showed that the individual was partially engaged during this period. The individual’s required hours increased to 30 but was coded to Outreach rather than Noncompliance, thus, there was miscoding of hours. Consequently, the individual was not sanctioned as required, and the benefits were not properly reduced. • For one (1) instance, we noted that an individual had no participation hours reported in CATCH for period April 2024 through September 2024 and a review of DCAS showed that the individual was paid twice for period March 2024 to September 2024, which resulted to potential overpayment of $3,528. DHS-ESA was unable to provide support to confirm whether the duplicate payment was necessary or was properly reversed. Total payments made to these ten (10) individuals during the periods in question was $59,874. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support exemptions or justifications for not imposing sanctions to individuals, individuals may be given full benefits instead of reduced federal benefits under the TANF program. In addition, miscoding of hours or amounts paid may result to providing inappropriate benefits to individuals. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation to support exemptions or justifications for individuals who refuse to fulfill the minimum working requirements to receive or maintain benefits under the TANF program. In addition, controls are not operating effectively over the supervisory review of transactions posted in DCAS to ensure accuracy. Recommendation - We recommend that DHS enforce existing policies and procedures over review and maintenance of appropriate documentation to ensure compliance with Penalty for Refusal to Work compliance requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS agrees with the findings and will work within the Division of Customer Workforce Employment and Training (DCWET) team to mitigate the causes of the findings. These findings are mostly residual issues caused by inconsistency of caseload management practices. Another mitigating factor is attributable to inadequate training of staff involved in the sanction process. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-021 Prior Year Finding Number: 2023-024 Compliance Requirement: Special Tests and Provisions – Lack of Child Care for Single Custodial Parent of Child Under Age Six Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 261.15 “Can a family be penalized if a parent refuses to work because he or she cannot find child care? (a) No, the State may not reduce or terminate assistance based on an individual’s refusal to engage in required work if the individual is a single custodial parent caring for a child under age six who has a demonstrated inability to obtain needed child care, as specified at Section 261.56.” Per 45 CFR Section 261.16 “Does the imposition of a penalty affect an individual’s work requirement? A penalty imposed by a State against the family of an individual by reason of the failure of the individual to comply with a requirement under TANF shall not be construed to be a reduction in any wage paid to the individual.” Per 45 CFR Section 261.56 “What happens if a parent cannot obtain needed child care? (a)(1) If the individual is a single custodial parent caring for a child under age six, the State may not reduce or terminate assistance based on the parent's refusal to engage in required work if he or she demonstrates an inability to obtain needed child care for one or more of the following reasons: (i) Appropriate child care within a reasonable distance from the home or work site is unavailable; (ii) Informal child care by a relative or under other arrangements is unavailable or unsuitable; or (iii) Appropriate and affordable formal child care arrangements are unavailable. (2) Refusal to work when an acceptable form of child care is available is not protected from sanctioning. Per 45 CFR Section 261.57 What happens if a State sanctions a single parent of a child under six who cannot get needed child care? (a) If we determine that a State has not complied with the requirements of Section 261.56, we will reduce the SFAG payable to the State by no more than five percent for the immediately succeeding fiscal year unless the State demonstrates to our satisfaction that it had reasonable cause or it achieves compliance under a corrective compliance plan pursuant to Section 262.5 and 262.6 of this chapter. (b) We will impose the maximum penalty if: (1) The State does not have a statewide process in place to inform parents about the exception to the work requirement and enable them to demonstrate that they have been unable to obtain child care; or (2) There is a pattern of substantiated complaints from parents or organizations verifying that a State has reduced or terminated assistance in violation of this requirement. (c) We may impose a reduced penalty if the State demonstrates that the violations were isolated or that they affected a minimal number of families. Condition – During our test work over a sample of twenty-nine (29) out of a population of 275 childcare cases reviewed by supervisors and included on two quarterly reports submitted to the DC Office of the State Superintendent of Education (OSSE), for Special Tests and Provisions - Lack of Child Care of Single Custodial Parent of Child under Age Six, we noted that all files sampled were reviewed by the supervisors. However, for one child care case, we noted the following: (1) the Date the discussion was held with the Eligibility worker, the date the Eligibility worker made corrections, and Eligibility Review completed date were not included; and (2) no comments were included by the supervisor to explain the “No” responses on various questions, or the status of the “No” responses. Consequently, we were unable to verify that the required follow-up occurred for this one sample. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without following the internal controls and policies and procedures already in place to ensure that eligibility for child care is being properly determined by staff, it may result in inaccurate decisions for child care cases or inaccurate information being reported to OSSE. Cause – Controls are not operating effectively over the documentation of the supervisory review of child care cases before submission of the quarterly report to OSSE. Recommendation - We recommend that DHS/ESA enforce existing policies and procedures and implement additional controls to ensure that all Supervisory Case Record Review forms are properly completed and reviewed, signed and dated by the supervisor before the report is submitted to OSSE. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS agrees with the findings that appropriate actions were taken to approve the case, however, the reviewing supervisor failed to update the Supervisory Case Review form with 1) date the discussion was held with the eligibility worker, the date the eligibility worker made corrections, and the date the eligibility worker review was completed and 2) failed to enter comments on “No” responses on various questions. DHS will enforce current policies and procedures and will ensure that Supervisory Case Reviews are updated and double-checked by the supervisor once the eligibility worker make the corrections prior to OSSE’s report being submitted to reflect the accurate information. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-022 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Child Care and Development Fund Cluster ALN: 93.575, 93.596 Award #: 2401DCCDD; 2101DCCDC6 Award Years: 10/01/2023 – 09/30/2026 10/01/2020 – 09/30/2024 Government Department/Agency: Office of the State Superintendent of Education (OSSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – For one (1) subaward sample selected for FFATA testing, we noted that OSSE failed to provide evidence that it reported the subaward information through the FSRS or sam.gov website to fulfill the FFATA requirements. Questioned Costs – None. Context – This is a condition identified per review of OSSE’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report results in noncompliance for the Child Care and Development Block Grant program. Cause – OSSE did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that OSSE evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – OSSE concurs with the auditor’s finding and recommendations related to this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-022 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Child Care and Development Fund Cluster ALN: 93.575, 93.596 Award #: 2401DCCDD; 2101DCCDC6 Award Years: 10/01/2023 – 09/30/2026 10/01/2020 – 09/30/2024 Government Department/Agency: Office of the State Superintendent of Education (OSSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – For one (1) subaward sample selected for FFATA testing, we noted that OSSE failed to provide evidence that it reported the subaward information through the FSRS or sam.gov website to fulfill the FFATA requirements. Questioned Costs – None. Context – This is a condition identified per review of OSSE’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report results in noncompliance for the Child Care and Development Block Grant program. Cause – OSSE did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that OSSE evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – OSSE concurs with the auditor’s finding and recommendations related to this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-023 Prior Year Finding Number: 2023-027 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Based on CFSA’s Human Resources Administration Issuance: HR-06-1 dated May 12, 2006, staff must seek and receive advance written approval prior to working overtime. It also indicates that in emergency situations requiring an immediate response, the employee shall make every reasonable attempt to obtain advance approval by an appropriate manager or supervisor. Per District Personnel Issuance No. 2018-00 (Annual Leave) effective April 21, 2018 “Using Annual Leave” - An employee may use accrued annual leave at any time during the leave year if they receive approval from their immediate supervisor or the agency head responsible for the employee’s timesheet. If an employee wishes to use their accrued annual leave, they must: 1. Submit a request in advance to use annual leave to their manager or supervisor. 2. Receive approval from the manager or supervisor; and 3. Record the approved leave taken on their timesheet in PeopleSoft. CFSA uses a Random Moment Study (RMS) to allocate the administrative costs to the Foster Care program. The study entails selecting a sample of social workers on a quarterly basis to participate in the RMS study where the social workers are required to notate what they were doing at the sample moment. Subsequently, the supervisors of these social workers review and validate their responses. validation of the responses adds an extra layer of reliability to the data collected. It ensures that the information provided by social workers is accurate and reflective of their actual activities. This validation process helps maintain the integrity of the study and ensures that the results are trustworthy in making decisions when determining the RMS percentage utilization in the allocation of the administrative costs. Condition – The following issues were observed: 1. Our procedures revealed that CFSA had erroneously included fiscal year 2025 expenditures totaling $2,571,560 in the fiscal year 2024 cost allocation, thereby overstating expenses reported and claimed. The financial impact based on the allocation calculation to the Foster Care program was $724,724. 2. During our review of the payroll process regarding the review and approval of time and attendance, we noted the following in our sample of 60 payroll items: • For two (2) samples, CFSA failed to provide documentation evidencing the approval of overtime paid and annual leave taken. • For three (3) samples, we noted that there were differences between the approved hours of overtime and annual leave paid and the actual hours taken. CFSA failed to provide documentation for the actual hours taken. • For one (1) sample, validation of the Random Moment Study was not performed. Questioned Costs – Known amount is $724,724. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample and review of the detail expenses database compared to the SEFA. Effect – CFSA reported and claimed fiscal year 2025 costs, which resulted into questioned costs. Additionally, without adequate internal controls and procedures for record maintenance, there is a risk of disputes between the agency and its employee’s accuracy of leave and overtime. Furthermore, failing to validate the Random Moment Study (RMS) may result in inaccurate outcomes, compromising the study's effectiveness in allocating administrative costs. Cause – CFSA did not have proper internal controls and policies and procedures in place to ensure that the correct fiscal year costs were submitted and claimed, and that authorization forms evidencing the preapproval of overtime and annual leave were maintained. Additionally, CFSA did not follow its internal controls, policies, and procedures to ensure the accuracy and consistent documentation of the RMS validation. Recommendation - We recommend that CFSA strengthen its policies, procedures, and controls to ensure that costs are accurately reported and claimed. We also recommend that pre-authorization of overtime and annual leave is maintained. Furthermore, we recommend that CFSA enhance its procedures to ensure the verification process is performed and maintained and the supervisors maintain consistent documentation of the RMS validation. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with the findings as stated. Regarding Condition 2 above, Differences in pre-approved leave or overtime and actual leave or overtime taken are not uncommon in light of changing circumstances. CFSA notes that for one sample involving overtime charges, the situation involved a social worker performing field work and the difference between pre-approved overtime and actual overtime taken was 30 minutes. Regarding the RMS, CFSA notes that the statistical standard for supervisory validation of RMS responses is 10%. Across fiscal year 2024 as a whole, CFSA’s validation rate of accepted responses was 10% and therefore met this standard. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-024 Prior Year Finding Number: 2023-028 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 29 CFR Section 97.20(b)(2), Accounting records. “Grantees and sub grantees must maintain records which adequately identify the source and application of funds provided for financially assisted activities. These records must contain information pertaining to grant or subgrant awards and authorizations, obligations, unobligated balances, assets, liabilities, outlays or expenditures, and income.” Per 45 CFR Section 1356.30(b), “The Title IV-E agency may not approve or license any prospective foster or adoptive parent, nor may the Title IV-E agency claim Federal Financial Participation (FFP) for any foster care maintenance or adoption assistance payment made on behalf of a child placed in a foster home operated under the auspices of a child placing agency or on behalf of a child placed in an adoptive home through a private adoption agency, if the Title IV-E agency finds that, based on a criminal records check conducted in accordance with paragraph (a) of this section, a court of competent jurisdiction has determined that the prospective foster or adoptive parent has been convicted of a felony involving: (1) Child abuse or neglect; (2) Spousal abuse; (3) A crime against a child or children (including child pornography); or, (4) A crime involving violence, including rape, sexual assault, or homicide, but not including other physical assault or battery.” Per 45 CFR Section 1356.30(f), "In order for a childcare institution to be eligible for Title IV-E funding, the licensing file for the institution must contain documentation which verifies that safety considerations with respect to the staff of the institution have been addressed.” Furthermore, per 45 CFR Section 1356.21(a), “Statutory and regulatory requirements of the Federal foster care program, To implement the foster care maintenance payments program provisions of the Title IV-E plan and to be eligible to receive FFP for foster care maintenance payments under this part, a Title IV-E agency must meet the requirements of this section, 45 CFR 1356.22, 45 CFR 1356.30, and Parts 472, 475(1), 475(4), 475(5), 475(6).” Per CFSA policy 6008.1, “As part of the home study process, an agency shall ensure that each applicant and any other person eighteen (18) years of age or older residing in the home comply with the requirements for a criminal records check established by the Adoption and Safe Families Amendment Act of 2000, effective June 27, 2000, D.C. Law 13-136.” Condition – For the fiscal year 2024, the Foster Care program had total disbursements of $2,390,443 for 3,008 maintenance payments. We selected a sample of 60 participants representing disbursed federal funds totaling $43,656, we noted the following deficiencies: • For one (1) of 60 samples, CFSA was unable to provide valid providers licenses as required by CFR 1356.30 (b) and background check information. • For one (1) of 60 samples, CFSA did not provide copy of the registry check which is part of the criminal records check required by CFR 1356.30 (b) and CFSA policy 6008.1. • For one (1) of 60 samples, CFSA did not provide complete documentation for adult member that resided in the home; therefore, we were unable to determine whether background checks such as criminal record checks and fingerprint-based checks from the national crime information databases was properly performed as required by the District of Columbia as detailed in CFSA policy 6008.1. These deficiencies represent 4% of the total disbursements tested. Questioned Costs – Known amount is $1,583. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – CFSA was not in compliance with the eligibility requirements of the Foster Care program. Cause – CFSA does not have adequate controls in place to ensure that the required eligibility documentation is maintained to evidence compliance with eligibility requirements. Recommendation - We recommend CFSA reevaluate and strengthen its existing policies and procedures over the review and maintenance of appropriate documentation to ensure compliance with eligibility requirements in accordance with the program. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with the findings. The licensure issue involved a provider who was in process of permanently closing her home as a foster care provider (and the existing license expired in the meantime), and the other item involved a brief lapse in the child protection register check. Corrective action will involve improved automation within the claiming process. CFSA also acknowledges that the third bullet regarding the legibility of the background criminal check document for the “other adult in the home” is an internal control issue for which there are no questioned costs.   The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-025 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per OMB No. 0970-0205, Form CB-496, Title IV-E Programs Quarterly Financial Report, “is required to be submitted at the end of each fiscal quarter by each State or Tribe with an approved plan under the Title IV-E of the Social Security act to administer the Foster Care, Adoption Assistance, and Guardianship Assistance programs. In submitting this form, each State or Tribal grantee meets its statutory and regulatory requirements to report actual program expenditures made in the preceding fiscal quarter and to provide an estimate of program expenditures anticipate in the upcoming fiscal quarter. Condition – The following conditions were observed: 1. Based on reconciliation review of Form CB-496 for all the quarterly reports in fiscal year 2024, it was observed that CFSA incorrectly calculated the family-based rate adjustment claims for quarters 2, 3 & 4. CFSA failed to apply the Federal Medical Assistance Percentage (FMAP) rate of 76.2% to net adjusted IV-E maintenance costs. Instead, the gross amount was reported and claimed, resulting in an overstatement of $412,808 for claims reported - $140,209 related to quarter 2, $135,819 related to quarter 3, and $136,780 related to quarter 4. 2. During the reconciliation of the SEFA to the claimed program expenditures, as reported on Form CB-496, we noted that expenditures totaling $791,224 were charged to the incorrect grant years for the Title IV-E Foster Care grant. Although these costs were not claimed by the agency, as a result of the error relating to the incorrect grant years, the SEFA did not reconcile to the submitted CB-496 reports. Questioned Costs – Known amount is $412,808. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure that correct amounts were reported, CFSA can report incorrect amounts on the quarterly federal claims submissions. Cause – CFSA did not have proper internal controls and policies and procedures in place to ensure that the amounts on the quarterly claims submissions were properly reported. Recommendation - We recommend that CFSA implement policies, procedures and controls that will enable an accurate preparation of quarterly reporting. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with the findings. The finding involved a recurring formula error in the workbook CFSA uses to calculate its lapsing quarter family-based rate adjustment. The issue stemmed from the pandemic-era stimulus funding that increased the District’s FMAP percentage from the standard 70% to 76.2%, which CFSA accommodated in its family-based rate adjustment claiming tools with manual entries. Corrective action is outlined in the Management’s Section, but in the meantime the District has returned to the standard 70% FMAP, which precludes recurrence. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-026 Prior Year Finding Number: 2023-029 Compliance Requirement: Special Tests and Provisions – Payment Rate Setting and Application Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per CFSA’s internal policies and procedures, providers must submit quarterly reports within 45 days of the end of each Federal fiscal year quarter. Upon receipt of quarterly reports from the provider, the Business Services Administration Program Manager reviews each Expenditure Detail Spreadsheet for compliance, accuracy and reasonableness. Condition – Our assessment of the special tests and provisions requirement, revealed that while the selected providers’ quarterly reports displayed no deficiencies, CFSA was unable to provide documentation evidencing the review and approval of the quarterly reports relating to all 40 transactions that were tested. Questioned Costs – Not determinable. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – The absence of documentation specifying who reviews and approves the quarterly reports compromises accountability and creates ambiguity in identifying the responsible parties in instances of errors or discrepancies. Cause – CFSA does not have adequate controls in place to ensure that review and approval of provider’s quarterly reports are documented. Recommendation - We recommend CFSA strengthen its policies and procedures to address the review and approval process for the provider’s quarterly reports. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with this finding as stated. The analysis of provider quarterly reports was performed consistently, but CFSA was inconsistent in demonstrating through formal correspondence back to the provider community that their quarterly reports were acceptable and approved as submitted. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-027 Prior Year Finding Number: 2023-032 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CRF Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CRF Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CRF Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CRF Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination totaling 283,898 total population during the fiscal year 2024 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exception: • For three (3) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-027 Prior Year Finding Number: 2023-032 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CRF Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CRF Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CRF Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CRF Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination totaling 283,898 total population during the fiscal year 2024 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exception: • For three (3) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-027 Prior Year Finding Number: 2023-032 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CRF Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CRF Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CRF Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CRF Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination totaling 283,898 total population during the fiscal year 2024 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exception: • For three (3) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-028 Prior Year Finding Number: 2023-033 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Year: 09/30/2020 – 09/29/2024 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.403, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented.” Condition – During our testwork over nonpayroll transactions for the Activities Allowed or Unallowed and Allowable Costs/Cost Principles, we noted that for one (1) out of sixty-two (62) samples, the transaction was charged twice to the program. Total amount of nonpayroll transactions is $19,095,189, and the amount of exception is $122,311. Questioned Costs – Known amount is $122,311. Context – This is a condition identified per review of DBH’s compliance with specified requirements using a statistically valid sample. Total amount of samples selected for testing amounted to $5,633,513. Effect – Lack of proper review of expenditures could result to unallowable costs charged to the program. Cause – DBH does not have adequate controls in place to ensure that only allowable costs are charged to the program. Recommendation – We recommend that DBH strengthen internal control procedures to ensure that expenditures are allowable, and that sufficient documentation is retained to support that allowability. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-029 Prior Year Finding Number: N/A Compliance Requirement: Cash Management Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Year: 09/30/2020 – 09/29/2024 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. When entities are funded on a reimbursement basis, program costs must be incurred prior to the date of the reimbursement request (2 CFR Section 200.305(b)(3)). US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Condition – During our testing of individual draws of federal funds, we noted that for one (1) sample selected and tested, the review of drawdown was made after it has been requested. Questioned Costs – Not determinable. Context – This is a condition identified per review of DBH’s compliance with specified requirements using a statistically valid sample. The sample drawdown, which is related to expenditures incurred during fiscal year 2024, was requested on December 24, 2024 but the review of the drawdown request did not happen until January 28, 2025. The total drawdown selected for testing amounted to $19,381,854. Effect – DBH is not in compliance with cash management requirements. Failure to timely review cash draw requests could result in cash draws that do not accurately reflect eligible program costs. Cause – DBH did not appear to adhere to internal control procedures to ensure the timely review of cash draws. Recommendation – We recommend DBH evaluate its existing cash management control procedures and ensure all federal draw requests are reviewed timely. We also recommend DBH establish procedures to periodically monitor its compliance with the cash management requirements and initiate necessary actions to resolve any noncompliance that results. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-030 Prior Year Finding Number: 2023-035 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Year: 09/30/2020 – 09/29/2024 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Federal Financial Report (FFR) Controls over Reporting Compliance: 2 CFR 200.333 requires that financial records, supporting documents, statistical records, and all other non-federal entity records pertinent to a federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the federal awarding agency or pass-through entity in the case of a subrecipient. Performance Progress Report (PPR) Underlying Data: The audit objective for the Reporting compliance requirement stated in the 2 CFR Part 200, appendix XI Compliance Supplement is as follows: Determine whether required reports for Federal awards include all activity of the reporting period, are supported by applicable accounting or performance records, and are fairly presented in accordance with governing requirements. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – During our testing of the reporting compliance requirement, we noted the following: • FFR Controls over Reporting Compliance: DBH’s control over compliance for financial reporting is as follows: “All reports are reviewed by the Accounting Officer or Agency Fiscal Officer prior to submission to the Federal government. DBH Program and Fiscal Services staff review programmatic and financial reports.” We noted DBH did not timely review and approve the annual Financial Reporting Report (FFR or SF-425) prior to submission to the Federal government. Total population is one (1) report and sample selected is one (1). • PPR Reporting Compliance: We noted DBH did not have documentation for the information, as well as the source of the information, it used in the Opioid STR’s Performance Progress Report. Information as reported in the reports was unsupported as management did not retain the underlying data. Total population is two (2) reports and sample selected is one (1). • SEFA Reporting Compliance: During our testing for the SEFA, we noted that DBH incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2024, DBH incurred $12.0 million in subrecipient expenditures for this program and incorrectly reported that there were no subrecipient expenditures on the initial SEFA. While the subrecipient expenditures amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with specified reporting requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure that correct amounts were reported and were properly reviewed as it relates to the Opioid STR program: • FFR Controls over Reporting Compliance: There is an increased risk of errors occurring and being undetected, or errors being present in reports if no review and approval occurred. • PPR Reporting Compliance: DBH cannot be assured that it reported complete and accurate information to enable the Substance Abuse and Mental Health Services Administration (SAMHSA), an operating division of the Department of Health and Human Services (HHS), to assess the outcomes of the State’s use of Opioid program funding. • SEFA Reporting Compliance: The effect of the condition is that the SEFA was not accurately prepared. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that the amounts on the FFR and SEFA were properly reported, and the reports were properly reviewed and approved. Recommendation – We recommend the following: • FFR Controls over Reporting Compliance: We recommend DBH strengthen its internal control to ensure timely review and approval of the FFR before report submission. • PPR Reporting Compliance: We recommend DBH develop formal, written procedures to identify the sources of information necessary and steps needed to compile accurate and complete information for the Opioid program performance reports; and retain in a central location all documentation that it used to support information included in each performance report it submits to the federal government. • SEFA Reporting Compliance: We recommend DBH ensure that agency personnel receive proper training on subrecipient versus vendor determination; as well as review existing policies and procedures for preparing the Schedule of Expenditures of Federal Awards to ensure that it is complete and accurate. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-031 Prior Year Finding Number: 2023-036 Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Year: 09/30/2020 – 09/29/2024 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Earmarking Requirements for Subrecipients: Award recipients must comply with the requirements for subrecipients monitoring and management as outlined in the provisions of 45 CFR Section 75.351-352 and should ensure written subaward/subcontract agreements are in place. The written agreement must require that subrecipients comply with the same terms and conditions as the prime recipient, as applicable (i.e., financial management requirements, audit requirements, etc.) and should describe the scope of work, deliverables, etc. The grant agreements provide that the District may use no more than ten (10) percent of the total grant award for administrative costs and developing the infrastructure necessary for expansion of services. Also, no more than ten (10) percent of the total grant award may be used for data collection, performance measurement, and performance assessment, including incentives for participating in the required data collection follow-up. Condition – During our testing of the Subrecipient Monitoring compliance requirement, we noted the following: Earmarking Requirements for Subrecipients: During our testing of the State Targeted Response to the Opioid Crisis Program, we noted that the agency used a different established indirect cost rate in monitoring the earmarking of awardees than the maximum administrative costs/indirect costs. For two (2) out of eleven (11) samples selected for testing, the awardees exceeded the ten (10) percent funding limitation for administrative costs/indirect costs. In addition, DBH does not have a process to monitor the ten (10) percent earmarking requirement for costs of developing the infrastructure necessary for expansion of services; and for data collection, performance measurement, and performance assessment, including incentives for participating in the required data collection follow-up. Total amount of population is $11,977,624, and the total amount of exceptions for two (2) samples is $524,658. Questioned Costs – Not determinable. Context – This is a condition identified per review of DBH’s compliance with specified subrecipient monitoring requirements using a statistically valid sample. Effect – Subrecipients may not be properly monitored, which may result in subawards being used for unauthorized purposes in violation of the terms and conditions of the subawards or that the subaward performance goals were not achieved. Cause – There is lack of sufficient documentary evidence to support that the controls are operating as designed related to subrecipient monitoring compliance. Recommendation – We recommend that DBH maintain sufficient documentation to evidence its internal controls over the risk assessment and monitoring of subrecipients. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-032 Prior Year Finding Number: N/A Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services HIV Care Formula Grants ALN: 93.917 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health (DC Health) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. To be eligible to receive assistance in the form of therapeutics, an individual must meet the following requirement: 42 U.S. Code Section 300ff-26 - Provision of treatments: (b) Eligible individual. To be eligible to receive assistance from a State under this section an individual shall— (1) have a medical diagnosis of HIV/AIDS; and (2) be a low-income individual, as defined by the State. Condition – During our review of forty (40) participant eligibility files out of population of 875, under the HIV Care Formula Grants, we noted the following: • For all forty (40) participant eligibility files tested, we noted absence of secondary supervisory review as required. Specifically, eligibility determinations are made solely by the eligibility specialist without documented supervisory review or sign-off. • For two (2) participant files reviewed, we noted that there was no documentation pertaining to the proof of HIV diagnosis, verification of income and/or residency in the Ramsell Eligibility System. Questioned Costs – Not determinable. Context – This is a condition identified per review of DC Health’s compliance with specified requirements for eligibility using a statistically valid sample. Effect – The lack of a secondary review or maintenance of eligibility documents increases the risk of noncompliance with federal eligibility requirements, potentially leading to questioned costs. Cause – DC Health does not have a formal supervisory review process in place to verify the completeness and accuracy of eligibility determinations. Recommendation – We recommend that DC Health strengthen its existing policies and procedures by establishing a formal supervisory review process that includes a documented secondary review and approval of all eligibility files prior to participant enrollment. Additionally, we recommend that DC Health enhance its internal control procedures to ensure that all documentation supporting eligibility determinations is properly maintained in accordance with program requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DC Health concurs with the finding. The HIV/AIDS, Hepatitis, STD and TB Administration (HAHSTA) has done a preliminary assessment of the root cause and conditions that created the exceptions noted in the testing of eligibility samples. DC Health agrees that the infrequency of reviews and lack of documented secondary supervisory reviews are contributing factors. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-033 Prior Year Finding Number: N/A Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Health and Human Services HIV Care Formula Grants ALN: 93.917 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health (DC Health) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Matching States and territories (excluding Puerto Rico) with greater than one percent of the aggregate number of national cases of HIV/AIDS in the two-year period preceding the federal fiscal year in which the state is applying for a grant must, depending on the number of years in which this threshold requirement has been met, provide matching funds as follows (42 USC 300ff-27(d)): All recipients are subject to a matching requirement for ADAP supplemental funds in an amount equal to $1 for every $4 of federal funds (42 USC 300ff-28(a)(2)(F)(ii)(III)). Those recipients that are required to match the base formula funds may request and receive a waiver from this additional matching requirement. Level of Effort The state/territory will maintain HIV-related activities at a level that is equal to not less than the level of such expenditures by the state/territory for the one-year period preceding the fiscal year for which the state/territory is applying for RWHAP Part B funds (42 USC 300ff- 27(b)(7)(E)). Maintenance of Effort (MOE) requirement: The recipient must maintain non-federal funding for HIV-related activities at a level that is not less than the expenditures for such activities during the fiscal year prior to receiving the award (see Section 2617(b)(7)(E) of the PHS Act). Condition – DC Health did not provide the necessary documentation to support the computation of the required matching and level of effort amounts. As a result, we were unable to verify whether DC Health met the required thresholds or performed the appropriate calculations. Questioned Costs – Not determinable. Context – This is a condition identified per review of DC Health’s compliance with specified requirements. Effect – Without adequate internal controls to ensure proper documentation of the requirements, it may increase the risk that matching costs will be questioned. Cause – DC Health does not have adequate internal controls requiring the retention of documentation related to matching and level of effort compliance. Recommendation – We recommend that DC Health strengthen its policies and procedures to ensure that all matching contributions and level of effort requirements thresholds are properly documented. DC Health should ensure that detailed reconciliations, expenditure reports, and applicable source documents are maintained for audit purposes. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DC Health concurs with the finding. While DC Health reported match and level of effort expenditures in total, there was not sufficient documentation to distinguish 100% of the components of the match and LOE required. This detail included account-types/classifications, account numbers, allocation amounts and service areas needed to total the match and LOE requirements. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-034 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.430 Compensation – Personal Services: “Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the establish written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity’s laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable.” 2 CFR Section 200.430 (g): Standards for Documentation of Personnel Expenses. (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient; (iii) Reasonably reflect the total activity for which the employee is compensated by the recipient or subrecipient, not exceeding 100 percent of compensated activities; (iv) Encompass federally-assisted and all other activities compensated by the recipient or subrecipient on an integrated basis but may include the use of subsidiary records as defined in the recipient's or subrecipient's written policy; (v) Comply with the established accounting policies and procedures of the recipient or subrecipient; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition – We noted that the DBH allocated payroll expenditures to the Block Grants for Substance Use Prevention, Treatment and Recovery Services (SUPTRS) during fiscal year 2024 based on budgeted percentages. These percentages were entered into the PeopleSoft Human Resources/Payroll System (PeopleSoft) at the beginning of the fiscal year and were based on management’s estimate of the respective employee’s level of effort for each program. PeopleSoft calculated the payroll costs every payroll cycle for each employee and program based on the predetermined percentage, and reported it through the Labor Distribution Report (485 Report). However, management cannot provide supporting documentation regarding the periodic comparison of actual costs to the budgeted costs as required by 2 CFR Section 200.430. Specifically, 17 out of 60 sampled payroll items tested for the SUPTRS program were recorded based on estimated hours and not actual hours. For the other 43 sampled items, these individuals worked 100% of their time on SUPTRS, therefore, there is no possibility of error. Questioned Costs – Known amount is $43,235. Context – This is a condition identified per review of DBH’s compliance with specified requirements using a statistically valid sample. Payroll costs, including fringe benefits, for the SUPTRS program in fiscal year 2024 totaled $4,667,478. Effect – DBH was unable to demonstrate that the payroll expenditures charged to the SUPTRS program accurately reflected the actual time incurred on the program and such expenditures were properly supported in accordance with 2 CFR Section 200.430, Compensation – Personal Services. Cause – DBH does not have policies and procedures in place to review and reconcile the estimated amount of payroll expenditures charged to the SUPTRS Program to the actual expenditures incurred. Recommendation – We recommend that DBH deploy policies and procedures to periodically compare employees’ estimated hours per the 485 Report to the actual hours incurred, and make any necessary adjustments as required by 2 CFR Section 200.430. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH agrees with the findings and will put controls in place to resolve the issue. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-035 Prior Year Finding Number: N/A Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Earmarking requirement: a) The state shall expend not less than 20 percent of Substance Use Prevention, Treatment and Recovery Services Block Grant (SUPTRS BG) for primary prevention programs for individuals who do not require treatment for Substance Use Disorder (SUD). The programs should educate and counsel the individuals on such SUD and provide for activities to reduce the risk of such SUD by the individuals (42 USC 300x-22; 45 CFR Sections 96.124 (b)(1) and 96.125). b) Designated states (i.e., any state whose cases of Acquired Immunodeficiency Syndrome (AIDS) is 10 or more per 100,000 individuals (as indicated by the number of such cases reported to and confirmed by the Centers for Disease Control and Prevention for the most recent calendar year for which data are available)), shall expend not less than two percent and not more than five percent of the award amount to carry out one or more projects to make available to individuals early intervention services for HIV disease (EIS HIV) at the sites where the individuals are undergoing SUD treatment. c) The state may not expend more than five percent of the grant to pay the costs of administering the grant (42 USC 300x-31; 45 CFR Section 96.135 (b)(1)). Condition – DBH did not provide the necessary documentation to support compliance with earmarking requirements as described above. As a result, we were unable to verify whether DBH met the required thresholds. Questioned Costs – Not determinable. Context – This is a condition identified per review of DBH’s compliance with earmarking requirements. Effect – Without adequate internal controls to ensure proper documentation of the requirements, it may increase the risk that earmarking requirements may not be met. Cause – DBH does not have adequate internal controls requiring the retention of documentation related to earmarking compliance requirements. Recommendation – We recommend that DBH strengthen its policies and procedures to ensure that all earmarking requirements thresholds are properly documented. DBH should ensure that detailed reconciliations, expenditure reports, and applicable source documents are maintained for audit purposes. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-036 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Subrecipient expenditures, totaling approximately $1.1 million, which are required to be presented in the Schedule of Expenditures of Federal Awards (SEFA), were improperly excluded from the initial SEFA prepared by management. Subsequently, the SEFA was adjusted by DBH to reflect the subrecipient expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – DBH did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that DBH adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Homeland Security Homeland Security Grant Program ALN: 97.067 Award #: EMW-2021-SS-00078-S01, EMW-2022-SS-00084-S01, EMW-2023-SS-00056-S01 Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Homeland Security and Emergency Management Agency (HSEMA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – For all nine (9) first tier subawards samples selected for FFATA testing, we noted that HSEMA failed to provide evidence that it reported the subaward information through the FSRS or sam.gov website to fulfill the FFATA requirements. Questioned Costs – None. Context – This is a condition identified per review of HSEMA’s compliance with reporting requirements using a statistically valid sample. Effect – Failure to properly submit the FFATA report results in noncompliance for the Homeland Security Grant program. Cause – HSEMA did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that HSEMA evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – HSEMA concurs that the subaward reporting required by FFATA is not currently complete and up to date in sam.gov website. Due to the transition to sam.gov and the FSRS system being terminated, the record of prior FFATA reports submitted that encountered errors and were left in partially complete status is no longer retrievable from the FSRS system to demonstrate that the report had been submitted. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-022 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Child Care and Development Fund Cluster ALN: 93.575, 93.596 Award #: 2401DCCDD; 2101DCCDC6 Award Years: 10/01/2023 – 09/30/2026 10/01/2020 – 09/30/2024 Government Department/Agency: Office of the State Superintendent of Education (OSSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – For one (1) subaward sample selected for FFATA testing, we noted that OSSE failed to provide evidence that it reported the subaward information through the FSRS or sam.gov website to fulfill the FFATA requirements. Questioned Costs – None. Context – This is a condition identified per review of OSSE’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report results in noncompliance for the Child Care and Development Block Grant program. Cause – OSSE did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that OSSE evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – OSSE concurs with the auditor’s finding and recommendations related to this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-027 Prior Year Finding Number: 2023-032 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CRF Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CRF Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CRF Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CRF Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination totaling 283,898 total population during the fiscal year 2024 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exception: • For three (3) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-027 Prior Year Finding Number: 2023-032 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CRF Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CRF Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CRF Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CRF Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination totaling 283,898 total population during the fiscal year 2024 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exception: • For three (3) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-034 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.430 Compensation – Personal Services: “Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the establish written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity’s laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable.” 2 CFR Section 200.430 (g): Standards for Documentation of Personnel Expenses. (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient; (iii) Reasonably reflect the total activity for which the employee is compensated by the recipient or subrecipient, not exceeding 100 percent of compensated activities; (iv) Encompass federally-assisted and all other activities compensated by the recipient or subrecipient on an integrated basis but may include the use of subsidiary records as defined in the recipient's or subrecipient's written policy; (v) Comply with the established accounting policies and procedures of the recipient or subrecipient; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition – We noted that the DBH allocated payroll expenditures to the Block Grants for Substance Use Prevention, Treatment and Recovery Services (SUPTRS) during fiscal year 2024 based on budgeted percentages. These percentages were entered into the PeopleSoft Human Resources/Payroll System (PeopleSoft) at the beginning of the fiscal year and were based on management’s estimate of the respective employee’s level of effort for each program. PeopleSoft calculated the payroll costs every payroll cycle for each employee and program based on the predetermined percentage, and reported it through the Labor Distribution Report (485 Report). However, management cannot provide supporting documentation regarding the periodic comparison of actual costs to the budgeted costs as required by 2 CFR Section 200.430. Specifically, 17 out of 60 sampled payroll items tested for the SUPTRS program were recorded based on estimated hours and not actual hours. For the other 43 sampled items, these individuals worked 100% of their time on SUPTRS, therefore, there is no possibility of error. Questioned Costs – Known amount is $43,235. Context – This is a condition identified per review of DBH’s compliance with specified requirements using a statistically valid sample. Payroll costs, including fringe benefits, for the SUPTRS program in fiscal year 2024 totaled $4,667,478. Effect – DBH was unable to demonstrate that the payroll expenditures charged to the SUPTRS program accurately reflected the actual time incurred on the program and such expenditures were properly supported in accordance with 2 CFR Section 200.430, Compensation – Personal Services. Cause – DBH does not have policies and procedures in place to review and reconcile the estimated amount of payroll expenditures charged to the SUPTRS Program to the actual expenditures incurred. Recommendation – We recommend that DBH deploy policies and procedures to periodically compare employees’ estimated hours per the 485 Report to the actual hours incurred, and make any necessary adjustments as required by 2 CFR Section 200.430. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH agrees with the findings and will put controls in place to resolve the issue. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-035 Prior Year Finding Number: N/A Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Earmarking requirement: a) The state shall expend not less than 20 percent of Substance Use Prevention, Treatment and Recovery Services Block Grant (SUPTRS BG) for primary prevention programs for individuals who do not require treatment for Substance Use Disorder (SUD). The programs should educate and counsel the individuals on such SUD and provide for activities to reduce the risk of such SUD by the individuals (42 USC 300x-22; 45 CFR Sections 96.124 (b)(1) and 96.125). b) Designated states (i.e., any state whose cases of Acquired Immunodeficiency Syndrome (AIDS) is 10 or more per 100,000 individuals (as indicated by the number of such cases reported to and confirmed by the Centers for Disease Control and Prevention for the most recent calendar year for which data are available)), shall expend not less than two percent and not more than five percent of the award amount to carry out one or more projects to make available to individuals early intervention services for HIV disease (EIS HIV) at the sites where the individuals are undergoing SUD treatment. c) The state may not expend more than five percent of the grant to pay the costs of administering the grant (42 USC 300x-31; 45 CFR Section 96.135 (b)(1)). Condition – DBH did not provide the necessary documentation to support compliance with earmarking requirements as described above. As a result, we were unable to verify whether DBH met the required thresholds. Questioned Costs – Not determinable. Context – This is a condition identified per review of DBH’s compliance with earmarking requirements. Effect – Without adequate internal controls to ensure proper documentation of the requirements, it may increase the risk that earmarking requirements may not be met. Cause – DBH does not have adequate internal controls requiring the retention of documentation related to earmarking compliance requirements. Recommendation – We recommend that DBH strengthen its policies and procedures to ensure that all earmarking requirements thresholds are properly documented. DBH should ensure that detailed reconciliations, expenditure reports, and applicable source documents are maintained for audit purposes. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-036 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Subrecipient expenditures, totaling approximately $1.1 million, which are required to be presented in the Schedule of Expenditures of Federal Awards (SEFA), were improperly excluded from the initial SEFA prepared by management. Subsequently, the SEFA was adjusted by DBH to reflect the subrecipient expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – DBH did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that DBH adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-001 Prior Year Finding Number: 2023-002 Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 277.4(b), Federal reimbursement rate, states that the base percentage for Federal payment shall be 50 percent of State agencies’ allowable SNAP administrative costs. Per review of the Settlement Agreement from the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999, the District of Columbia is required to spend an additional $1,620,000 in local funds for the SNAP grant match each year by making an adjustment of $1,620,000 to the expenditures charged to the federal grant. Condition – During the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that two (2) out of four (4) quarterly SF-425 reports tested, which were for quarters ended March 30, 2024 and June 30, 2024, had the issues that resulted in this finding. The SF-425 reports tested were approved and certified, and DHS/ESA exceeded the required SNAP Matching amount of $41,509,067. However, the Office of the Chief Financial Officer (OCFO) for DHS/ESA was unable to provide supporting documentation that would allow us to agree specific amounts reported for (1) Quality Control, (2) Fraud Control, (3) ADP Operations, and (4) Outreach. The total calculated amount by OCFO for DHS/ESA reported as the actual match on the SF-425 report, excluding New Investment, was $43,129,064. However, the total recalculated amount by auditors to be reported as the actual match was $43,199,416. Variance between these two amounts was $70,352. In addition, during the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that the OCFO team for Human Support Services Cluster inadvertently failed to deduct the $1,620,000 adjustment from the Federal Share of Administrative Expenditures on the SEFA to comply with the Settlement Agreement with the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999. The Settlement Agreement requires the District of Columbia to spend $1,620,000 in local funds for the SNAP grant each year, which the Agency decided to reflect as a deduction from the Federal Share of Administrative Expenditures on the SEFA. Furthermore, as a result of the Random Movement Time Study, the Agency needed to move expenses from the SNAP bucket in the DIFS System and the Agency inadvertently moved $158,834 less expenses. Consequently, the Federal Share of Administrative Expenditures on the SEFA is higher compared to the Federal Share of Administrative Expenditures reported on SF-425 report.  Questioned Costs – None. Context – This is a condition identified per review of DHS/ESA’s compliance through the OCFO team with specified requirements using a statistically valid sample. Effect – OCFO for DHS/ESA is not in compliance with the stated provisions. Without adequate internal controls to ensure reconciliation of the amounts reported for the matching requirements and other pertinent information, there is an increased risk that matching and other pertinent information will not be properly reported. Cause – OCFO for DHS/ESA does not appear to have adequate policies and procedures in place to ensure that the amounts reported for the matching requirement and other pertinent information are accurate and supported. Recommendation – We recommend that OCFO for DHS/ESA strengthen its policies and procedures to ensure that amounts for SNAP matching requirements and other pertinent information are properly reported and that related reports are reviewed for compliance with program requirements as well as completeness and accuracy prior to submission. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-002 Prior Year Finding Number: 2023-003 Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Department of Health Care Finance (DHCF) DC Access System (DCAS) Program Management Administration Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 272.10(a), “All State agencies are required to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP.” Per 7 CFR Section 272.10(b), “In order to meet the requirements of the Act and ensure the efficient and effective administration of the program, a SNAP system, at a minimum, shall be automated in each of the following program areas (1) Certification and (2) Issuance Reconciliation and Reporting. Under Certification – States agencies must determine eligibility and calculate benefits or validate the eligibility worker’s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members’ names, addresses, dates of birth, social security numbers, individual household members’ earned and unearned income by source, deductions, resources and household size). Also, State agencies must redetermine or revalidate eligibility and benefits based on notices of change in households’ circumstances.” Condition – The District is self-reporting findings it noted from its ongoing efforts to resolve issues with the ADP system for SNAP. The issues identified and the estimated impact follows: 1. Failure to Send Correct and Timely Notices to SNAP Households - Notices pertaining to SNAP eligibility contain incorrect information, and/or SNAP applicants and recipients fail to receive proper notices. For example, in the Federal Fiscal Year (FFY) 2018 Local Program Access Review (PAR), Food and Nutrition Service (FNS) cited that SNAP applicants did not receive a Notice of Eligibility or notice contained incorrect information, no notice of required verification, and the notice of adverse action was incorrect. 2. Untimely Processing of SNAP Applications and Periodic Reports - On October 23, 2017, FNS advised DHS that its application processing timeliness (APT) rate between October 2016 and March 2017 was 88.45%, which triggered corrective action per FNS policy. Moreover, between that last APT report and now, DHS has disclosed that it has experienced processing backlogs of varying severity and persistence to FNS via ongoing communications and as part of waiver requests. DHS also provided a report to FNS in August 2022 that indicated significant application processing backlogs. 3. Establishment of Duplicate Accounts - DHS discovered that duplicate Product Delivery Cases (PDC) were being created in DCAS. One PDC was active and the other closed, but the closed PDC was still receiving benefits. 4. Issuance of Duplicate Payment - As a result of duplicate accounts in Deficiency 3, duplicate payments may have been issued to the same household when a caseworker reactivated a closed case. There is also a possibility that customers who received duplicate electronic benefits transfer (EBT) cards from different EBT vendors may have received duplicate payments. 5. Failure to Implement Computer Matching System - Based on the FFY18 Program Integrity Management Evaluation (ME) review, DHS failed to process Prisoner Verification System (PVS) matches, deceased matches, and National Directory of New Hires (NDNH) matches in accordance with federal requirements. 6. Failure to Produce System Computations to Support Recipient Claims - DCAS does not have the ability to calculate overpayments or send a demand letter. FNS correspondence letters dated October 18, 2017, and September 20, 2018, advised DHS to suspend the establishment of DCAS claims but allowed DHS to continue servicing ACEDS claims. 7. Treasury Offset Program (TOP) Reporting and Maintenance Decertified - FNS conducted a TOP Technical Review in June 2021 and DHS was decertified from TOP due to the following: • Referral of customers to TOP that are undergoing recoupment. • Incorrect determination of the date of delinquency. • Incorrect debt balance and debt status in TOP. 8. Failure to Initiate Recoupment on Active Households - When DCAS launched in October 2016, more than 3,000 claim cases with outstanding balances originating from SNAP overpayments were converted from ACEDS to DCAS. Some claims were not properly converted or activated in DCAS. As a result, DHS failed to take the required recovery actions, including TOP recovery or activation of the recoupment process through EBT cards. 9. Recipient and Benefit Integrity Report Update Required - DHS must provide an update on the target completion dates for system generation of all SNAP-related reports currently being created through manual intervention. The plan must include the procedures for reviewing and ensuring the accuracy of the data being submitted to Food Programs Reporting System (FPRS) with particular emphasis on the FNS-209 and the FNS-366B reports. DHS experienced some technical challenges in processing and retrieving claim and recoupment information accurately since the launch of DCAS in October 2016, which affected the FNS-209 quarterly reports. The Payment and Collections Division (PCD) and the DCAS report development team have made concerted efforts to improve the ability to generate data for the reports but continue to have difficulties in verifying the accuracy of data due in part to the laborious manual processes involved. Based on the FFY 2018 Program Integrity ME review, lines 3b, 10, and 14 of the FNS-209 failed to reconcile with the detailed documentation. 10. Work Requirements Have Not Been Properly Implemented - DHS is not in compliance with the requirement to accurately report on the FNS 583. DHS is unprepared to implement the work requirement and time limit for able-bodied adults without dependents when the current suspension mandated by the Families First Coronavirus Response Act ends and/or its waiver ends. Additionally, the District is not prepared to apply the Able-Bodied Adults Without Dependents (ABAWD) time limits when their ABAWD waiver expires. 11. Failure to Analyze Client Complaints and Include in the State’s Corrective Action Plans (CAP) Where Appropriate - DHS is failing to analyze client complaints and include in the State’s CAP where appropriate, per 7 CFR 271.6(a)(3) and 275.16. 12. The SNAP Application Does Not Clearly Explain Which Questions Are Required for SNAP - FNS reviewers found that the District’s SNAP application does not provide clear directions about which questions are required for SNAP, versus Cash or Medical Assistance. For example, Step 5 of the application asks “Does anyone in your household (including non-applicants) have any income? Yes – complete below; No – skip to step 6 (Complete if you are applying for Food, Medical, or Cash Assistance).” The directions are confusing and may be difficult to understand. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements resulting from a system implementation. Effect – Without an effectively designed and operated system in place, ineligible beneficiaries may receive benefits under the SNAP grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Inaccurate beneficiary allotment payments could result in participants receiving benefits that they are not entitled to receive under the program. Cause – DHS did not effectively design and operate the ADP system for SNAP which resulted to inaccurate benefit payments. Recommendation – We recommend that DHS continue to evaluate and improve the new ADP system for SNAP to ensure that it addresses all the administration requirements of the SNAP program. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS and DHCF DCAS team agree with the findings noted in this report. DHS self-reported these findings as part of the agency’s ongoing effort to maintain integrity with all eligibility determinations. The root cause of each of the twelve (12) case issues with the ADP system for SNAP varied. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-003 Prior Year Finding Number: 2023-004 Compliance Requirement: Special Tests and Provisions – EBT Card Security Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Office of the Chief Financial Officer/Office of Finance and Treasury (OCFO/OFT) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 274.8(b)(3), As an addition to or component of the Security Program required of Automated Data Processing (ADP) systems, the State agency shall ensure that the following electronic benefits transfer (EBT) security requirements are established: (i) Storage and control measures to control blank unissued EBT cards and PINs, and unused or spare POS devices; (ii) Measures to ensure communication access control. Communication controls shall include the transmission of transaction data and issuance information from POS terminals to work-stations and terminals at the data processing center; (iii) Message validation; (iv) Administrative and operational procedures; (v) A separate EBT security component shall be incorporated into the State agency Security Program for ADP systems. The periodic risk analyses required by the Security Program shall address the following items specific to an EBT system – (B) Completeness and timeliness of the reconciliation system; and (vi) The State agency shall incorporate the contingency plan approved by FNS into the Security Program. Condition – OCFO/OFT for DHS are required to maintain adequate security over, and documentation/records for EBT cards, to prevent their theft, embezzlement, loss damage, destruction, unauthorized transfer, negotiation, or use. OCFO/OFT have contracted with Fidelity National Information Service (FIS) for the issuance and security of the EBT cards; however, it is OCFO/OFT’s ultimate responsibility to ensure the contractor has controls in place to maintain adequate security over, and documentation/records of EBT cards in accordance with 7 CFR Section 274.8(b)(3). During our tests of the design and implementation of internal controls and compliance requirements in accordance with 7 CFR Section 274.8(b)(3), we noted the following issues: • For seventeen (17) out of the 60 samples, out of a population of 496 days from two EBT card centers, although both EBT Balance Sheets reconciled with the EBT Card Issuance Logs included in the package, we noted the following deficiencies: o For fourteen (14) out of the samples, we noted various issues including (a) the ID type for identification purposes was missing, (b) the customer case number was missing, (c) the Photo ID Program Referral Form was missing, (d) the identification type was noted as referral on the EBT Intake Form, but no referral form was attached, (e) the UPO EBT Center Intake Form was not signed by staff who created the card, and (f) the EBT Card Destruction log was missing. o For two (2) out of the samples, we noted that the required authorizations by a DHS Supervisor and eligibility staff was missing. o For one (1) out of the samples, we noted that the EBT Card Issuance Log had a wrong date. • In addition, for one (1) out of the 60 samples, we noted that the information on the summary reconciliation sheet did not agree to the Card Issuance Log. The summary reconciliation sheet shows 40 cards issued while the Card Issuance Log shows a total of 39 cards issued. These exceptions resulted in the Agency not being in compliance with 7 CFR Section 274.8(b)(3). Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without adequate internal controls to ensure compliance with EBT Card Security requirements, there is an increased risk that the inventory of EBT cards will not be properly maintained and accounted for, or that the program will not be in compliance with program requirements. Cause – OCFO/OFT for DHS does not have adequate policies and procedures in place to ensure adequate safeguarding, documentation over issuance and monitoring of EBT cards. Recommendation - We recommend that OCFO/OFT for DHS strengthen formal policies and procedures to maintain adequate security over, and documentation/records for EBT Cards. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The OCFO/OFT for DHS concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-001 Prior Year Finding Number: 2023-002 Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 277.4(b), Federal reimbursement rate, states that the base percentage for Federal payment shall be 50 percent of State agencies’ allowable SNAP administrative costs. Per review of the Settlement Agreement from the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999, the District of Columbia is required to spend an additional $1,620,000 in local funds for the SNAP grant match each year by making an adjustment of $1,620,000 to the expenditures charged to the federal grant. Condition – During the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that two (2) out of four (4) quarterly SF-425 reports tested, which were for quarters ended March 30, 2024 and June 30, 2024, had the issues that resulted in this finding. The SF-425 reports tested were approved and certified, and DHS/ESA exceeded the required SNAP Matching amount of $41,509,067. However, the Office of the Chief Financial Officer (OCFO) for DHS/ESA was unable to provide supporting documentation that would allow us to agree specific amounts reported for (1) Quality Control, (2) Fraud Control, (3) ADP Operations, and (4) Outreach. The total calculated amount by OCFO for DHS/ESA reported as the actual match on the SF-425 report, excluding New Investment, was $43,129,064. However, the total recalculated amount by auditors to be reported as the actual match was $43,199,416. Variance between these two amounts was $70,352. In addition, during the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that the OCFO team for Human Support Services Cluster inadvertently failed to deduct the $1,620,000 adjustment from the Federal Share of Administrative Expenditures on the SEFA to comply with the Settlement Agreement with the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999. The Settlement Agreement requires the District of Columbia to spend $1,620,000 in local funds for the SNAP grant each year, which the Agency decided to reflect as a deduction from the Federal Share of Administrative Expenditures on the SEFA. Furthermore, as a result of the Random Movement Time Study, the Agency needed to move expenses from the SNAP bucket in the DIFS System and the Agency inadvertently moved $158,834 less expenses. Consequently, the Federal Share of Administrative Expenditures on the SEFA is higher compared to the Federal Share of Administrative Expenditures reported on SF-425 report.  Questioned Costs – None. Context – This is a condition identified per review of DHS/ESA’s compliance through the OCFO team with specified requirements using a statistically valid sample. Effect – OCFO for DHS/ESA is not in compliance with the stated provisions. Without adequate internal controls to ensure reconciliation of the amounts reported for the matching requirements and other pertinent information, there is an increased risk that matching and other pertinent information will not be properly reported. Cause – OCFO for DHS/ESA does not appear to have adequate policies and procedures in place to ensure that the amounts reported for the matching requirement and other pertinent information are accurate and supported. Recommendation – We recommend that OCFO for DHS/ESA strengthen its policies and procedures to ensure that amounts for SNAP matching requirements and other pertinent information are properly reported and that related reports are reviewed for compliance with program requirements as well as completeness and accuracy prior to submission. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-002 Prior Year Finding Number: 2023-003 Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Department of Health Care Finance (DHCF) DC Access System (DCAS) Program Management Administration Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 272.10(a), “All State agencies are required to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP.” Per 7 CFR Section 272.10(b), “In order to meet the requirements of the Act and ensure the efficient and effective administration of the program, a SNAP system, at a minimum, shall be automated in each of the following program areas (1) Certification and (2) Issuance Reconciliation and Reporting. Under Certification – States agencies must determine eligibility and calculate benefits or validate the eligibility worker’s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members’ names, addresses, dates of birth, social security numbers, individual household members’ earned and unearned income by source, deductions, resources and household size). Also, State agencies must redetermine or revalidate eligibility and benefits based on notices of change in households’ circumstances.” Condition – The District is self-reporting findings it noted from its ongoing efforts to resolve issues with the ADP system for SNAP. The issues identified and the estimated impact follows: 1. Failure to Send Correct and Timely Notices to SNAP Households - Notices pertaining to SNAP eligibility contain incorrect information, and/or SNAP applicants and recipients fail to receive proper notices. For example, in the Federal Fiscal Year (FFY) 2018 Local Program Access Review (PAR), Food and Nutrition Service (FNS) cited that SNAP applicants did not receive a Notice of Eligibility or notice contained incorrect information, no notice of required verification, and the notice of adverse action was incorrect. 2. Untimely Processing of SNAP Applications and Periodic Reports - On October 23, 2017, FNS advised DHS that its application processing timeliness (APT) rate between October 2016 and March 2017 was 88.45%, which triggered corrective action per FNS policy. Moreover, between that last APT report and now, DHS has disclosed that it has experienced processing backlogs of varying severity and persistence to FNS via ongoing communications and as part of waiver requests. DHS also provided a report to FNS in August 2022 that indicated significant application processing backlogs. 3. Establishment of Duplicate Accounts - DHS discovered that duplicate Product Delivery Cases (PDC) were being created in DCAS. One PDC was active and the other closed, but the closed PDC was still receiving benefits. 4. Issuance of Duplicate Payment - As a result of duplicate accounts in Deficiency 3, duplicate payments may have been issued to the same household when a caseworker reactivated a closed case. There is also a possibility that customers who received duplicate electronic benefits transfer (EBT) cards from different EBT vendors may have received duplicate payments. 5. Failure to Implement Computer Matching System - Based on the FFY18 Program Integrity Management Evaluation (ME) review, DHS failed to process Prisoner Verification System (PVS) matches, deceased matches, and National Directory of New Hires (NDNH) matches in accordance with federal requirements. 6. Failure to Produce System Computations to Support Recipient Claims - DCAS does not have the ability to calculate overpayments or send a demand letter. FNS correspondence letters dated October 18, 2017, and September 20, 2018, advised DHS to suspend the establishment of DCAS claims but allowed DHS to continue servicing ACEDS claims. 7. Treasury Offset Program (TOP) Reporting and Maintenance Decertified - FNS conducted a TOP Technical Review in June 2021 and DHS was decertified from TOP due to the following: • Referral of customers to TOP that are undergoing recoupment. • Incorrect determination of the date of delinquency. • Incorrect debt balance and debt status in TOP. 8. Failure to Initiate Recoupment on Active Households - When DCAS launched in October 2016, more than 3,000 claim cases with outstanding balances originating from SNAP overpayments were converted from ACEDS to DCAS. Some claims were not properly converted or activated in DCAS. As a result, DHS failed to take the required recovery actions, including TOP recovery or activation of the recoupment process through EBT cards. 9. Recipient and Benefit Integrity Report Update Required - DHS must provide an update on the target completion dates for system generation of all SNAP-related reports currently being created through manual intervention. The plan must include the procedures for reviewing and ensuring the accuracy of the data being submitted to Food Programs Reporting System (FPRS) with particular emphasis on the FNS-209 and the FNS-366B reports. DHS experienced some technical challenges in processing and retrieving claim and recoupment information accurately since the launch of DCAS in October 2016, which affected the FNS-209 quarterly reports. The Payment and Collections Division (PCD) and the DCAS report development team have made concerted efforts to improve the ability to generate data for the reports but continue to have difficulties in verifying the accuracy of data due in part to the laborious manual processes involved. Based on the FFY 2018 Program Integrity ME review, lines 3b, 10, and 14 of the FNS-209 failed to reconcile with the detailed documentation. 10. Work Requirements Have Not Been Properly Implemented - DHS is not in compliance with the requirement to accurately report on the FNS 583. DHS is unprepared to implement the work requirement and time limit for able-bodied adults without dependents when the current suspension mandated by the Families First Coronavirus Response Act ends and/or its waiver ends. Additionally, the District is not prepared to apply the Able-Bodied Adults Without Dependents (ABAWD) time limits when their ABAWD waiver expires. 11. Failure to Analyze Client Complaints and Include in the State’s Corrective Action Plans (CAP) Where Appropriate - DHS is failing to analyze client complaints and include in the State’s CAP where appropriate, per 7 CFR 271.6(a)(3) and 275.16. 12. The SNAP Application Does Not Clearly Explain Which Questions Are Required for SNAP - FNS reviewers found that the District’s SNAP application does not provide clear directions about which questions are required for SNAP, versus Cash or Medical Assistance. For example, Step 5 of the application asks “Does anyone in your household (including non-applicants) have any income? Yes – complete below; No – skip to step 6 (Complete if you are applying for Food, Medical, or Cash Assistance).” The directions are confusing and may be difficult to understand. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements resulting from a system implementation. Effect – Without an effectively designed and operated system in place, ineligible beneficiaries may receive benefits under the SNAP grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Inaccurate beneficiary allotment payments could result in participants receiving benefits that they are not entitled to receive under the program. Cause – DHS did not effectively design and operate the ADP system for SNAP which resulted to inaccurate benefit payments. Recommendation – We recommend that DHS continue to evaluate and improve the new ADP system for SNAP to ensure that it addresses all the administration requirements of the SNAP program. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS and DHCF DCAS team agree with the findings noted in this report. DHS self-reported these findings as part of the agency’s ongoing effort to maintain integrity with all eligibility determinations. The root cause of each of the twelve (12) case issues with the ADP system for SNAP varied. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-003 Prior Year Finding Number: 2023-004 Compliance Requirement: Special Tests and Provisions – EBT Card Security Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Office of the Chief Financial Officer/Office of Finance and Treasury (OCFO/OFT) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 274.8(b)(3), As an addition to or component of the Security Program required of Automated Data Processing (ADP) systems, the State agency shall ensure that the following electronic benefits transfer (EBT) security requirements are established: (i) Storage and control measures to control blank unissued EBT cards and PINs, and unused or spare POS devices; (ii) Measures to ensure communication access control. Communication controls shall include the transmission of transaction data and issuance information from POS terminals to work-stations and terminals at the data processing center; (iii) Message validation; (iv) Administrative and operational procedures; (v) A separate EBT security component shall be incorporated into the State agency Security Program for ADP systems. The periodic risk analyses required by the Security Program shall address the following items specific to an EBT system – (B) Completeness and timeliness of the reconciliation system; and (vi) The State agency shall incorporate the contingency plan approved by FNS into the Security Program. Condition – OCFO/OFT for DHS are required to maintain adequate security over, and documentation/records for EBT cards, to prevent their theft, embezzlement, loss damage, destruction, unauthorized transfer, negotiation, or use. OCFO/OFT have contracted with Fidelity National Information Service (FIS) for the issuance and security of the EBT cards; however, it is OCFO/OFT’s ultimate responsibility to ensure the contractor has controls in place to maintain adequate security over, and documentation/records of EBT cards in accordance with 7 CFR Section 274.8(b)(3). During our tests of the design and implementation of internal controls and compliance requirements in accordance with 7 CFR Section 274.8(b)(3), we noted the following issues: • For seventeen (17) out of the 60 samples, out of a population of 496 days from two EBT card centers, although both EBT Balance Sheets reconciled with the EBT Card Issuance Logs included in the package, we noted the following deficiencies: o For fourteen (14) out of the samples, we noted various issues including (a) the ID type for identification purposes was missing, (b) the customer case number was missing, (c) the Photo ID Program Referral Form was missing, (d) the identification type was noted as referral on the EBT Intake Form, but no referral form was attached, (e) the UPO EBT Center Intake Form was not signed by staff who created the card, and (f) the EBT Card Destruction log was missing. o For two (2) out of the samples, we noted that the required authorizations by a DHS Supervisor and eligibility staff was missing. o For one (1) out of the samples, we noted that the EBT Card Issuance Log had a wrong date. • In addition, for one (1) out of the 60 samples, we noted that the information on the summary reconciliation sheet did not agree to the Card Issuance Log. The summary reconciliation sheet shows 40 cards issued while the Card Issuance Log shows a total of 39 cards issued. These exceptions resulted in the Agency not being in compliance with 7 CFR Section 274.8(b)(3). Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without adequate internal controls to ensure compliance with EBT Card Security requirements, there is an increased risk that the inventory of EBT cards will not be properly maintained and accounted for, or that the program will not be in compliance with program requirements. Cause – OCFO/OFT for DHS does not have adequate policies and procedures in place to ensure adequate safeguarding, documentation over issuance and monitoring of EBT cards. Recommendation - We recommend that OCFO/OFT for DHS strengthen formal policies and procedures to maintain adequate security over, and documentation/records for EBT Cards. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The OCFO/OFT for DHS concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-001 Prior Year Finding Number: 2023-002 Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 277.4(b), Federal reimbursement rate, states that the base percentage for Federal payment shall be 50 percent of State agencies’ allowable SNAP administrative costs. Per review of the Settlement Agreement from the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999, the District of Columbia is required to spend an additional $1,620,000 in local funds for the SNAP grant match each year by making an adjustment of $1,620,000 to the expenditures charged to the federal grant. Condition – During the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that two (2) out of four (4) quarterly SF-425 reports tested, which were for quarters ended March 30, 2024 and June 30, 2024, had the issues that resulted in this finding. The SF-425 reports tested were approved and certified, and DHS/ESA exceeded the required SNAP Matching amount of $41,509,067. However, the Office of the Chief Financial Officer (OCFO) for DHS/ESA was unable to provide supporting documentation that would allow us to agree specific amounts reported for (1) Quality Control, (2) Fraud Control, (3) ADP Operations, and (4) Outreach. The total calculated amount by OCFO for DHS/ESA reported as the actual match on the SF-425 report, excluding New Investment, was $43,129,064. However, the total recalculated amount by auditors to be reported as the actual match was $43,199,416. Variance between these two amounts was $70,352. In addition, during the testing of the SNAP Matching, Level of Effort, Earmarking compliance requirement, we noted that the OCFO team for Human Support Services Cluster inadvertently failed to deduct the $1,620,000 adjustment from the Federal Share of Administrative Expenditures on the SEFA to comply with the Settlement Agreement with the U.S. Department of Health and Human Services Departmental Appeals Board dated September 13, 1999. The Settlement Agreement requires the District of Columbia to spend $1,620,000 in local funds for the SNAP grant each year, which the Agency decided to reflect as a deduction from the Federal Share of Administrative Expenditures on the SEFA. Furthermore, as a result of the Random Movement Time Study, the Agency needed to move expenses from the SNAP bucket in the DIFS System and the Agency inadvertently moved $158,834 less expenses. Consequently, the Federal Share of Administrative Expenditures on the SEFA is higher compared to the Federal Share of Administrative Expenditures reported on SF-425 report.  Questioned Costs – None. Context – This is a condition identified per review of DHS/ESA’s compliance through the OCFO team with specified requirements using a statistically valid sample. Effect – OCFO for DHS/ESA is not in compliance with the stated provisions. Without adequate internal controls to ensure reconciliation of the amounts reported for the matching requirements and other pertinent information, there is an increased risk that matching and other pertinent information will not be properly reported. Cause – OCFO for DHS/ESA does not appear to have adequate policies and procedures in place to ensure that the amounts reported for the matching requirement and other pertinent information are accurate and supported. Recommendation – We recommend that OCFO for DHS/ESA strengthen its policies and procedures to ensure that amounts for SNAP matching requirements and other pertinent information are properly reported and that related reports are reviewed for compliance with program requirements as well as completeness and accuracy prior to submission. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-002 Prior Year Finding Number: 2023-003 Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Department of Health Care Finance (DHCF) DC Access System (DCAS) Program Management Administration Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 272.10(a), “All State agencies are required to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP.” Per 7 CFR Section 272.10(b), “In order to meet the requirements of the Act and ensure the efficient and effective administration of the program, a SNAP system, at a minimum, shall be automated in each of the following program areas (1) Certification and (2) Issuance Reconciliation and Reporting. Under Certification – States agencies must determine eligibility and calculate benefits or validate the eligibility worker’s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members’ names, addresses, dates of birth, social security numbers, individual household members’ earned and unearned income by source, deductions, resources and household size). Also, State agencies must redetermine or revalidate eligibility and benefits based on notices of change in households’ circumstances.” Condition – The District is self-reporting findings it noted from its ongoing efforts to resolve issues with the ADP system for SNAP. The issues identified and the estimated impact follows: 1. Failure to Send Correct and Timely Notices to SNAP Households - Notices pertaining to SNAP eligibility contain incorrect information, and/or SNAP applicants and recipients fail to receive proper notices. For example, in the Federal Fiscal Year (FFY) 2018 Local Program Access Review (PAR), Food and Nutrition Service (FNS) cited that SNAP applicants did not receive a Notice of Eligibility or notice contained incorrect information, no notice of required verification, and the notice of adverse action was incorrect. 2. Untimely Processing of SNAP Applications and Periodic Reports - On October 23, 2017, FNS advised DHS that its application processing timeliness (APT) rate between October 2016 and March 2017 was 88.45%, which triggered corrective action per FNS policy. Moreover, between that last APT report and now, DHS has disclosed that it has experienced processing backlogs of varying severity and persistence to FNS via ongoing communications and as part of waiver requests. DHS also provided a report to FNS in August 2022 that indicated significant application processing backlogs. 3. Establishment of Duplicate Accounts - DHS discovered that duplicate Product Delivery Cases (PDC) were being created in DCAS. One PDC was active and the other closed, but the closed PDC was still receiving benefits. 4. Issuance of Duplicate Payment - As a result of duplicate accounts in Deficiency 3, duplicate payments may have been issued to the same household when a caseworker reactivated a closed case. There is also a possibility that customers who received duplicate electronic benefits transfer (EBT) cards from different EBT vendors may have received duplicate payments. 5. Failure to Implement Computer Matching System - Based on the FFY18 Program Integrity Management Evaluation (ME) review, DHS failed to process Prisoner Verification System (PVS) matches, deceased matches, and National Directory of New Hires (NDNH) matches in accordance with federal requirements. 6. Failure to Produce System Computations to Support Recipient Claims - DCAS does not have the ability to calculate overpayments or send a demand letter. FNS correspondence letters dated October 18, 2017, and September 20, 2018, advised DHS to suspend the establishment of DCAS claims but allowed DHS to continue servicing ACEDS claims. 7. Treasury Offset Program (TOP) Reporting and Maintenance Decertified - FNS conducted a TOP Technical Review in June 2021 and DHS was decertified from TOP due to the following: • Referral of customers to TOP that are undergoing recoupment. • Incorrect determination of the date of delinquency. • Incorrect debt balance and debt status in TOP. 8. Failure to Initiate Recoupment on Active Households - When DCAS launched in October 2016, more than 3,000 claim cases with outstanding balances originating from SNAP overpayments were converted from ACEDS to DCAS. Some claims were not properly converted or activated in DCAS. As a result, DHS failed to take the required recovery actions, including TOP recovery or activation of the recoupment process through EBT cards. 9. Recipient and Benefit Integrity Report Update Required - DHS must provide an update on the target completion dates for system generation of all SNAP-related reports currently being created through manual intervention. The plan must include the procedures for reviewing and ensuring the accuracy of the data being submitted to Food Programs Reporting System (FPRS) with particular emphasis on the FNS-209 and the FNS-366B reports. DHS experienced some technical challenges in processing and retrieving claim and recoupment information accurately since the launch of DCAS in October 2016, which affected the FNS-209 quarterly reports. The Payment and Collections Division (PCD) and the DCAS report development team have made concerted efforts to improve the ability to generate data for the reports but continue to have difficulties in verifying the accuracy of data due in part to the laborious manual processes involved. Based on the FFY 2018 Program Integrity ME review, lines 3b, 10, and 14 of the FNS-209 failed to reconcile with the detailed documentation. 10. Work Requirements Have Not Been Properly Implemented - DHS is not in compliance with the requirement to accurately report on the FNS 583. DHS is unprepared to implement the work requirement and time limit for able-bodied adults without dependents when the current suspension mandated by the Families First Coronavirus Response Act ends and/or its waiver ends. Additionally, the District is not prepared to apply the Able-Bodied Adults Without Dependents (ABAWD) time limits when their ABAWD waiver expires. 11. Failure to Analyze Client Complaints and Include in the State’s Corrective Action Plans (CAP) Where Appropriate - DHS is failing to analyze client complaints and include in the State’s CAP where appropriate, per 7 CFR 271.6(a)(3) and 275.16. 12. The SNAP Application Does Not Clearly Explain Which Questions Are Required for SNAP - FNS reviewers found that the District’s SNAP application does not provide clear directions about which questions are required for SNAP, versus Cash or Medical Assistance. For example, Step 5 of the application asks “Does anyone in your household (including non-applicants) have any income? Yes – complete below; No – skip to step 6 (Complete if you are applying for Food, Medical, or Cash Assistance).” The directions are confusing and may be difficult to understand. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements resulting from a system implementation. Effect – Without an effectively designed and operated system in place, ineligible beneficiaries may receive benefits under the SNAP grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Inaccurate beneficiary allotment payments could result in participants receiving benefits that they are not entitled to receive under the program. Cause – DHS did not effectively design and operate the ADP system for SNAP which resulted to inaccurate benefit payments. Recommendation – We recommend that DHS continue to evaluate and improve the new ADP system for SNAP to ensure that it addresses all the administration requirements of the SNAP program. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS and DHCF DCAS team agree with the findings noted in this report. DHS self-reported these findings as part of the agency’s ongoing effort to maintain integrity with all eligibility determinations. The root cause of each of the twelve (12) case issues with the ADP system for SNAP varied. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-003 Prior Year Finding Number: 2023-004 Compliance Requirement: Special Tests and Provisions – EBT Card Security Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program (SNAP) Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Office of the Chief Financial Officer/Office of Finance and Treasury (OCFO/OFT) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 274.8(b)(3), As an addition to or component of the Security Program required of Automated Data Processing (ADP) systems, the State agency shall ensure that the following electronic benefits transfer (EBT) security requirements are established: (i) Storage and control measures to control blank unissued EBT cards and PINs, and unused or spare POS devices; (ii) Measures to ensure communication access control. Communication controls shall include the transmission of transaction data and issuance information from POS terminals to work-stations and terminals at the data processing center; (iii) Message validation; (iv) Administrative and operational procedures; (v) A separate EBT security component shall be incorporated into the State agency Security Program for ADP systems. The periodic risk analyses required by the Security Program shall address the following items specific to an EBT system – (B) Completeness and timeliness of the reconciliation system; and (vi) The State agency shall incorporate the contingency plan approved by FNS into the Security Program. Condition – OCFO/OFT for DHS are required to maintain adequate security over, and documentation/records for EBT cards, to prevent their theft, embezzlement, loss damage, destruction, unauthorized transfer, negotiation, or use. OCFO/OFT have contracted with Fidelity National Information Service (FIS) for the issuance and security of the EBT cards; however, it is OCFO/OFT’s ultimate responsibility to ensure the contractor has controls in place to maintain adequate security over, and documentation/records of EBT cards in accordance with 7 CFR Section 274.8(b)(3). During our tests of the design and implementation of internal controls and compliance requirements in accordance with 7 CFR Section 274.8(b)(3), we noted the following issues: • For seventeen (17) out of the 60 samples, out of a population of 496 days from two EBT card centers, although both EBT Balance Sheets reconciled with the EBT Card Issuance Logs included in the package, we noted the following deficiencies: o For fourteen (14) out of the samples, we noted various issues including (a) the ID type for identification purposes was missing, (b) the customer case number was missing, (c) the Photo ID Program Referral Form was missing, (d) the identification type was noted as referral on the EBT Intake Form, but no referral form was attached, (e) the UPO EBT Center Intake Form was not signed by staff who created the card, and (f) the EBT Card Destruction log was missing. o For two (2) out of the samples, we noted that the required authorizations by a DHS Supervisor and eligibility staff was missing. o For one (1) out of the samples, we noted that the EBT Card Issuance Log had a wrong date. • In addition, for one (1) out of the 60 samples, we noted that the information on the summary reconciliation sheet did not agree to the Card Issuance Log. The summary reconciliation sheet shows 40 cards issued while the Card Issuance Log shows a total of 39 cards issued. These exceptions resulted in the Agency not being in compliance with 7 CFR Section 274.8(b)(3). Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without adequate internal controls to ensure compliance with EBT Card Security requirements, there is an increased risk that the inventory of EBT cards will not be properly maintained and accounted for, or that the program will not be in compliance with program requirements. Cause – OCFO/OFT for DHS does not have adequate policies and procedures in place to ensure adequate safeguarding, documentation over issuance and monitoring of EBT cards. Recommendation - We recommend that OCFO/OFT for DHS strengthen formal policies and procedures to maintain adequate security over, and documentation/records for EBT Cards. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The OCFO/OFT for DHS concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-004 Prior Year Finding Number: 2023-011 Compliance Requirement: Reporting Program: U.S. Department of the Treasury COVID-19 – Emergency Rental Assistance (ERA) Program ALN: 21.023 Award #: N/A Award Year: 12/27/2020 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Subrecipient expenditures, totaling approximately $29.8 million, which are required to be presented in the Schedule of Expenditures of Federal Awards (SEFA), were improperly excluded from the initial SEFA prepared by management. Subsequently, the SEFA was adjusted by DHS to reflect the subrecipient expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – DHS did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that DHS adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS Office of the Chief Financial Officer (OCFO) concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-005 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of the Treasury COVID-19 - Homeowner Assistance Fund ALN: 21.026 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Housing and Community Development (DHCD) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 2 CFR Section 200.406(a) defines credits as transactions that offset or reduce direct or indirect costs allocable to a Federal award. Examples of such transactions are purchase discounts, rebates or allowances, recoveries or indemnities on losses, insurance refunds or rebates, and adjustments of overpayments or erroneous charges. To the extent that such credits accruing to or received by the recipient or subrecipient relate to allowable costs, they must be credited to the Federal award either as a cost reduction or cash refund, as appropriate. Condition – During the review of benefit payments for the sixty (60) eligibility samples, we noted the following: • One payment made to the utility company where it was later determined that the homeowner was not eligible when additional information became available. • One instance where a duplicate payment was issued to the mortgage loan servicer. • One instance where the mortgage loan servicer noted the payment was no longer needed. For the conditions noted above, refunds are due to DHCD. Questioned Costs – Known amount is $42,289. Context – This is a condition identified per review of DHCD’s compliance with specified requirements using a statistically valid sample. Effect – Without adequate internal controls in place to ensure overpayments are identified and tracked by program and accounting personnel, DHCD could be noncompliant with the requirement to refund the agency for credits. Cause – DHCD did not have a process in place to identify and track credits. Recommendation – We recommend that DHCD implement a control to identify and track credits, such as refunds and duplicate payments, so that these amounts can be refunded to the agency. This includes strengthening communication between the program and accounting teams to ensure an awareness of possible refunds so adjustments can be made if necessary. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHCD concurs with the findings. DHCD will review and pursue repayment from these expenditures. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-006 Prior Year Finding Number: 2023-013 Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of the Treasury COVID-19 - Homeowner Assistance Fund ALN: 21.026 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Housing and Community Development (DHCD) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Additionally, 2 CFR Section 200.332 specifies that pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Based upon the pass-through entity's assessment of risk posed by the subrecipient, auditee management determined that onsite reviews of the subrecipient’s program operations were appropriate and designed the following control: DHCD performs desk audits, scheduled site visits and unscheduled site visits during the fiscal year. Reports are prepared at the site visits and properly documented. The reports include deficiencies, recommendations, and proposed corrective action and are reviewed and approved by the Project Managers, Program Managers, and Supervisory Program Managers. Condition – During our review of four (4) subrecipient samples from a total population of seven (7) subrecipients, we noted the following: • For one (1) subrecipient, DHCD provided plans to perform a review, but was unable to provide evidence of the review or a finalized report. • For three (3) subrecipients, DHCD neither performed an onsite review nor a desk audit. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHCD’s compliance with the subrecipient monitoring requirements using a statistically valid sample. Effect – DHCD did not comply with the subrecipient monitoring requirements of the Homeowner Assistance Fund program. Cause – DHCD does not have fully effective internal controls over compliance with respect to the onsite review process. Recommendation – We recommend that DHCD strictly adhere to its policies and procedures to ensure that onsite reviews are properly performed and documented for subrecipients. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHCD concurs with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-007 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of the Treasury COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Year: 10/01/2021 – 09/20/2024 Government Department/Agency: Office of the Deputy Mayor for Planning and Economic Development (DMPED); Office of the State Superintendent of Education (OSSE); Department of Employment Services (DOES); Department of Energy and Environment (DOEE); Department of Behavioral Health (DBH); Office of Neighborhood Safety and Engagement (ONSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – During the audit, of the total amounts passed through to subrecipients of $69.6 million, we noted that certain grant expenditures totaling approximately $14.8 million were erroneously reflected as amounts passed through to subrecipients on the initial Schedule of Expenditures Federal Awards (SEFA) under ALN 21.027, COVID-19 - Coronavirus State and Local Fiscal Recovery Funds. Total amounts passed through to subrecipients should have been $54.8 million. OCFO subsequently adjusted the SEFA to reflect the correct amounts passed through to subrecipients for the major program. Questioned Costs – None. Context – This is a condition identified per review of various agencies’ compliance with specified requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – The District agencies did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that the District agencies adhere to instituted policies and procedures to ensure accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The District agencies agree with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-008 Prior Year Finding Number: 2023-015 Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of the Treasury COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Year: 10/01/2021 – 09/20/2024 Government Department/Agency: Office of the Deputy Mayor for Public Safety and Justice (DMPSJ); Office of Neighborhood Safety and Engagement (ONSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with the Uniform Guidance in 2 CFR Section 200.331(a) Requirements for Pass-Through Entities requires that pass-through entities must: Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information outlined in the section noted above, pre-award assessment, indirect cost rated for the award, assistance listing number, finding and award follow-up and other pertinent actions. In accordance with the Uniform Guidance in 2 CFR Section 200.332 Requirements for Pass-Through Entities requires that pass-through entities Verify that the subrecipient is not excluded or disqualified in accordance with Section 180.300. Verification methods are provided in Section 180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. In accordance with the Uniform Guidance in 2 CFR Section 200.332(e) Requirements for Pass-Through Entities requires that pass-through entities must: Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: • Review financial and performance reports • Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. • Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by Section 200.521. • Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section Section 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Condition – The program’s documented subrecipient monitoring requirements includes risk assessments, monitoring of subrecipients and the submission and review of monthly financial and performance reports. During our testing of the subrecipient’s compliance requirements, we noted the following issues: • Our testing of the program’s subrecipient monitoring requirements includes submission and review of monthly financial and performance reports. We noted for one (1) out of 17 samples, the subrecipient failed to submit their monthly financial and performance reports. • For one (1) out of 17 samples, the agency had no evidence to support it had performed the mandatory follow up on reported audit findings in the subrecipient’s audit report for the Corrective Action taken by the subrecipient to remediate the finding. • For one (1) out of 17 samples, the agency had no evidence that a debarment check was performed before the contract was entered into. The agency’s documented policies and the procurement procedures mandate a debarment check before entering into new contracts. Questioned Costs – Not determinable. Context – This is a condition identified per review of various District agencies’ compliance with specified monitoring requirements on the program’s subrecipients using a statistically valid sample. Effect – Subrecipients may not be properly monitored, which may result in subawards being used for unauthorized purposes in violation of the terms and conditions of the subawards or that the subaward performance goals were not achieved. Cause – There is lack of sufficient documentary evidence to support that the controls are operating as designed related to subrecipient monitoring compliance. Recommendation – We recommend that the agencies maintain sufficient documentation to evidence its internal controls over the risk assessment and monitoring of subrecipients. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – While DMPSJ doesn’t agree that it is out of compliance, DMPSJ will ensure documentation is maintained regarding its oversight of grant management. ONSE acknowledges and accepts the finding that the subrecipient failed to submit their monthly and performance reports. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section. BDO’s Response – We have reviewed management’s response and our finding remains as indicated.

Finding Number: 2024-009 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: Office of the Deputy Mayor for Planning and Economic Development (DMPED) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.403, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented.” In addition, the U.S. Department of Treasury, Guidance for the Coronavirus Capital Projects Fund For States, Territories & Freely Associated States (CPF), Section D. Eligible and Ineligible Cost: states that “Allowable costs are determined in accordance with the cost principles identified in 2 CFR Part 200, Subpart E. Federal funds committed to an award may only be used to cover allowable costs incurred during the period of performance and for allowable closeout costs incurred during the grant closeout process. Cost sharing is not a requirement for the use of these funds” Section C. Project Eligibility: also states the following, “Capital Project or Project means the construction, purchase, and installation of, and/or improvements to capital assets where the costs of such assets are capitalized or depreciated, including ancillary costs necessary to put the capital asset to use. Examples of capital assets include buildings, towers, digital devices and equipment, fiber-optic lines, and broadband networks. Examples of ancillary costs include project costs related to project planning and feasibility, broadband installation, and community engagement, broadband adoption, digital literacy, and training associated with a planned or completed Project funded by the Capital Projects Fund program.” Condition – During our examination of Activities Allowed or Unallowed and Allowable Costs/Cost Principles, we observed that the agency used federal funds to reimburse their subrecipient for lease rent of $3,242,953 invoiced from August 2023 through May 2024. This amount was reported to the Federal agency as ancillary costs. However, upon reviewing the supporting documentation, it was found that the rent charged to the grant pertained to the period following the substantial completion of the capital project's construction. Additionally, the leased rent does not appear to align with the definition of ancillary costs as outlined by the CFP guidance mentioned earlier. Furthermore, the agency was unable to provide documentation from the U.S. Treasury approving the leased rent or indicating its knowledge that it was included as part of ancillary costs. Based on the procedures performed and the review of relevant guidance, BDO notes that these costs do not meet the requirements to be considered allowable under the program. Questioned Costs – Known amount $3,242,953. Context – This is a condition identified per review of DMPED’s compliance with specified requirements using a statistically valid sample. Total subrecipient expenditures reported as allowable costs were $14,400,000. Effect – DMPED was unable to demonstrate that the rent charged was approved by the Department of Treasury and was an allowable cost under the guidance. Cause – DMPED did not have proper internal controls and policies and procedures in place to identify allowable costs and activities. Recommendation – We recommend that DMPED evaluate its procedures to ensure only allowable expenses are charged to the program as required under 2 CFR Section 200.403. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DMPED does not concur with the auditor’s finding regarding the allowability of rent per the CPF guidance. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section. BDO’s Response – We have reviewed management’s response and our finding remains as indicated.

Finding Number: 2024-010 Prior Year Finding Number: N/A Compliance Requirement: Procurement and Suspension and Debarment Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: District of Columbia Public Library (DCPL) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Section 200.318(a), General Procurement Standards, the non-federal entity must use its own documented procurement procedures which reflect applicable State, local, and tribal laws and regulations, provided that the procurements conform to applicable federal law and the standards identified in General Procurement Standards. Additionally, 2 CFR Section 200.318(i) states that the non-federal entity must maintain records sufficient to detail the history of the procurement. These records are required to include but are not necessarily limited to the following: rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. All procurement transactions must be conducted in a manner providing full and open competition consistent in accordance with 2 CFR Section 200.319 and must be performed using the appropriate procurement method as outlined in 2 CFR Section 200.320. In accordance with 2 CFR Section 200.320(c), Noncompetitive procurement. There are specific circumstances in which the recipient or subrecipient may use a noncompetitive procurement method. The noncompetitive procurement method may only be used if one of the following circumstances applies: (1) The aggregate amount of the procurement transaction does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section); (2) The procurement transaction can only be fulfilled by a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from providing public notice of a competitive solicitation; (4) The recipient or subrecipient requests in writing to use a noncompetitive procurement method, and the Federal agency or pass-through entity provides written approval; or (5) After soliciting several sources, competition is determined inadequate. Condition – During our testing of procurement and suspension and debarment requirements, we examined the two (2) procurement contracts that comprised the entire procurement population. Based on the procedures performed, we identified one (1) contract, valued at $278,259, out of the two (2) contracts totaling $8,185,708, in which DCPL used a single source or sole source justification for the selection rationale. However, this justification did not comply with the requirements set forth in 2 CFR Section 200.320(c). Questioned Costs – Not determinable. Context – This is a condition identified per review of DCPL’s compliance with the specified requirements using a statistically valid sample. Effect – Failure to adhere to the procurement procedures specified in the Uniform Administrative Requirements may lead to the Federal agency disallowing the procurement and associated costs. Cause – While DCPL adhered to their policies and procedures for private expenditures, the agency did not adhere to federal procurement requirements (2 CFR Section 200.320(c)) listed above to support noncompetitive procurement on the requirements to use sole source. Recommendation – We recommend that management establish the requisite internal control policies and procedures to ensure that all procurements reported under the federal program are in compliance. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DCPL concurs with the auditor’s findings and recommendations. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-011 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: Office of the Deputy Mayor for Planning and Economic Development (DMPED) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – DMPED had a single subrecipient through which $14.4 million in grant funds was expended. During our audit, we noted that DMPED did not submit the required FFATA report for its subrecipient through the FSRS or the sam.gov website for the one subaward issued in fiscal year 2024. Questioned Costs – None. Context – This is a condition identified per review of DMPED’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report results in noncompliance for the Coronavirus Capital Projects Fund program. Cause – DMPED did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that DMPED evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DMPED concurs with the auditor’s findings and recommendations related to Grant Reporting. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-012 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Credit Balances) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.164(h) outlines the following compliance requirements for Title IV credit balances: (6) Title IV, HEA credit balances. (1) A title IV, HEA credit balance occurs whenever the amount of title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period as provided under paragraph (c) of this section. (2) A title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than— (i) Fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (ii) Fourteen (14) days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition – During our testing, we noted the following issues: • For eight (8) of twenty-five (25) credit balances selected for testing, the credit balance created by the disbursement of Title IV awards was not refunded to the student within the required 14-day timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over credit balances from student financial assistance. Cause – Insufficient internal control and administrative oversight with respect to the disbursement of federal awards. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that Title IV credit balances are paid timely to students. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-013 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.173(b)(1) outlines the following compliance requirements for Title IV refunds. (b) Timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if— (1) The institution deposits or transfers the funds into the bank account it maintains under Section 668.163 no later than 45 days after the date it determines that the student withdrew. Condition – During our testing, we noted the following exception: • For one (1) of nineteen (19) students selected for Title IV refund calculation testing, the required Title IV refund was not adjusted in the U.S. Department of Education's Common Origination and Disbursement (COD) system within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not compliant with the Return of Title IV Funds compliance requirements. Cause – Insufficient administrative oversight with respect to Return of Title IV Funds requirements. Recommendation – We recommend that UDC enhance its process surrounding the disbursement of federal student aid to ensure compliance with the Return of Title IV Funds requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-014 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Enrollment Reporting Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Institutions are required to report enrollment information under the Pell grant and the Direct and Federal Family Education Loan (“FFEL”) loan programs via the National Student Loan Data System (“NSLDS”) (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the Student Financial Assistance Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (“NSLDSFAP”) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • Enrollment Effective Date – The date that the current enrollment status reported for a student was first effective. (See 4.4.2 of the NSLDS Enrollment Reporting Guide for the specific requirements for reporting the Enrollment Effective Date. Also see 4.4.3 of the NSLDS Enrollment Reporting Guide for additional guidance on effective dates for Withdrawal versus Graduation and Electronic Announcement titled – NSLDS Enrollment Reporting – Submission Dates, Effective Dates and Certification Dates, dated April 20, 2017, for additional information and examples at https://fsapartners.ed.gov/knowledge¬center/library/electronic-announcements/2017-04-20/general-subject-nslds¬enrollment-reporting-submission-dates-effective-dates-and-certification-dates.) • Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Certification Date – The Date enrollment certified by institution. At a minimum, institutions are required to certify enrollment every 60 days or every other month. Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • CIP Code – The Classification of Instructional Programs (CIP) is a set of codes that define fields of study. CIP Codes are maintained by ED's National Center for Education Statistics (NCES). They were most recently updated in 2020 and are usually updated every ten years. A listing of current CIP codes is available at: https://nces.ed.gov/ipeds/cipcode/resources.aspx?y=56. • CIP Year – Year for the corresponding CIP code. The CIP Year for the codes currently used by NSLDS is 2020. • Credential Level – Indicates the level of a credential the student will receive for the program the student is attending, for example undergraduate certificate, associate degree, or bachelor’s degree. (See 4.4.7 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting the Credential Level.) • Published Program Length Measurement – The institution identifies whether the Published Program Length is in days, weeks, or years. • Published Program Length - Published Program Length should be reported based on the definition of “normal time” to completion in the regulations at 34 CFR 668.41(a), • Program Begin Date – The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. (See 4.4.8 of the NSLDS Enrollment Reporting Guide for additional guidance.) • Program Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Program Enrollment Effective Date – The date when the student's current program status first took effect. Condition – UDC did not submit an accurate status change notification or failed to submit timely notification to the NSLDS website for certain students who graduated, withdrew or had a change in their enrollment status (full time, half time or less than half time) during the year. BDO selected a random sample of twenty-five (25) students used to evaluate both campus and program level enrollment reporting compliance requirements. For campus level enrollment, we noted the following exceptions: • For five (5) of twenty-five (25) campus level records tested, UDC did not certify the students’ enrollment data within 60 days. • For ten (10) of twenty-five (25) campus level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) campus level records tested, UDC did not correctly report the students’ enrollment status. For program level enrollment, we noted the following exceptions: • For one (1) of twenty-five (25) program level records tested, UDC did not accurately report the Published Program Length. • For ten (10) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment Status. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified enrollment requirements using a statistically valid sample. Effect – UDC is not in compliance with enrollment reporting requirements. Failure to promptly report accurate and timely changes in enrollment status may adversely impact the repayment status for student loan borrowers. Cause – Insufficient internal controls and administrative oversight with respect to enrollment reporting requirements. Recommendation – We recommend that UDC enhance its procedures and internal controls over enrollment reporting to ensure that significant data elements under both campus-level and program-level records are reported accurately and timely to NSLDS. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-012 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Credit Balances) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.164(h) outlines the following compliance requirements for Title IV credit balances: (6) Title IV, HEA credit balances. (1) A title IV, HEA credit balance occurs whenever the amount of title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period as provided under paragraph (c) of this section. (2) A title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than— (i) Fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (ii) Fourteen (14) days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition – During our testing, we noted the following issues: • For eight (8) of twenty-five (25) credit balances selected for testing, the credit balance created by the disbursement of Title IV awards was not refunded to the student within the required 14-day timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over credit balances from student financial assistance. Cause – Insufficient internal control and administrative oversight with respect to the disbursement of federal awards. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that Title IV credit balances are paid timely to students. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-013 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.173(b)(1) outlines the following compliance requirements for Title IV refunds. (b) Timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if— (1) The institution deposits or transfers the funds into the bank account it maintains under Section 668.163 no later than 45 days after the date it determines that the student withdrew. Condition – During our testing, we noted the following exception: • For one (1) of nineteen (19) students selected for Title IV refund calculation testing, the required Title IV refund was not adjusted in the U.S. Department of Education's Common Origination and Disbursement (COD) system within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not compliant with the Return of Title IV Funds compliance requirements. Cause – Insufficient administrative oversight with respect to Return of Title IV Funds requirements. Recommendation – We recommend that UDC enhance its process surrounding the disbursement of federal student aid to ensure compliance with the Return of Title IV Funds requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-014 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Enrollment Reporting Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Institutions are required to report enrollment information under the Pell grant and the Direct and Federal Family Education Loan (“FFEL”) loan programs via the National Student Loan Data System (“NSLDS”) (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the Student Financial Assistance Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (“NSLDSFAP”) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • Enrollment Effective Date – The date that the current enrollment status reported for a student was first effective. (See 4.4.2 of the NSLDS Enrollment Reporting Guide for the specific requirements for reporting the Enrollment Effective Date. Also see 4.4.3 of the NSLDS Enrollment Reporting Guide for additional guidance on effective dates for Withdrawal versus Graduation and Electronic Announcement titled – NSLDS Enrollment Reporting – Submission Dates, Effective Dates and Certification Dates, dated April 20, 2017, for additional information and examples at https://fsapartners.ed.gov/knowledge¬center/library/electronic-announcements/2017-04-20/general-subject-nslds¬enrollment-reporting-submission-dates-effective-dates-and-certification-dates.) • Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Certification Date – The Date enrollment certified by institution. At a minimum, institutions are required to certify enrollment every 60 days or every other month. Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • CIP Code – The Classification of Instructional Programs (CIP) is a set of codes that define fields of study. CIP Codes are maintained by ED's National Center for Education Statistics (NCES). They were most recently updated in 2020 and are usually updated every ten years. A listing of current CIP codes is available at: https://nces.ed.gov/ipeds/cipcode/resources.aspx?y=56. • CIP Year – Year for the corresponding CIP code. The CIP Year for the codes currently used by NSLDS is 2020. • Credential Level – Indicates the level of a credential the student will receive for the program the student is attending, for example undergraduate certificate, associate degree, or bachelor’s degree. (See 4.4.7 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting the Credential Level.) • Published Program Length Measurement – The institution identifies whether the Published Program Length is in days, weeks, or years. • Published Program Length - Published Program Length should be reported based on the definition of “normal time” to completion in the regulations at 34 CFR 668.41(a), • Program Begin Date – The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. (See 4.4.8 of the NSLDS Enrollment Reporting Guide for additional guidance.) • Program Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Program Enrollment Effective Date – The date when the student's current program status first took effect. Condition – UDC did not submit an accurate status change notification or failed to submit timely notification to the NSLDS website for certain students who graduated, withdrew or had a change in their enrollment status (full time, half time or less than half time) during the year. BDO selected a random sample of twenty-five (25) students used to evaluate both campus and program level enrollment reporting compliance requirements. For campus level enrollment, we noted the following exceptions: • For five (5) of twenty-five (25) campus level records tested, UDC did not certify the students’ enrollment data within 60 days. • For ten (10) of twenty-five (25) campus level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) campus level records tested, UDC did not correctly report the students’ enrollment status. For program level enrollment, we noted the following exceptions: • For one (1) of twenty-five (25) program level records tested, UDC did not accurately report the Published Program Length. • For ten (10) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment Status. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified enrollment requirements using a statistically valid sample. Effect – UDC is not in compliance with enrollment reporting requirements. Failure to promptly report accurate and timely changes in enrollment status may adversely impact the repayment status for student loan borrowers. Cause – Insufficient internal controls and administrative oversight with respect to enrollment reporting requirements. Recommendation – We recommend that UDC enhance its procedures and internal controls over enrollment reporting to ensure that significant data elements under both campus-level and program-level records are reported accurately and timely to NSLDS. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-012 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Credit Balances) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.164(h) outlines the following compliance requirements for Title IV credit balances: (6) Title IV, HEA credit balances. (1) A title IV, HEA credit balance occurs whenever the amount of title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period as provided under paragraph (c) of this section. (2) A title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than— (i) Fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (ii) Fourteen (14) days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition – During our testing, we noted the following issues: • For eight (8) of twenty-five (25) credit balances selected for testing, the credit balance created by the disbursement of Title IV awards was not refunded to the student within the required 14-day timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over credit balances from student financial assistance. Cause – Insufficient internal control and administrative oversight with respect to the disbursement of federal awards. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that Title IV credit balances are paid timely to students. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-013 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.173(b)(1) outlines the following compliance requirements for Title IV refunds. (b) Timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if— (1) The institution deposits or transfers the funds into the bank account it maintains under Section 668.163 no later than 45 days after the date it determines that the student withdrew. Condition – During our testing, we noted the following exception: • For one (1) of nineteen (19) students selected for Title IV refund calculation testing, the required Title IV refund was not adjusted in the U.S. Department of Education's Common Origination and Disbursement (COD) system within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not compliant with the Return of Title IV Funds compliance requirements. Cause – Insufficient administrative oversight with respect to Return of Title IV Funds requirements. Recommendation – We recommend that UDC enhance its process surrounding the disbursement of federal student aid to ensure compliance with the Return of Title IV Funds requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-014 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Enrollment Reporting Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Institutions are required to report enrollment information under the Pell grant and the Direct and Federal Family Education Loan (“FFEL”) loan programs via the National Student Loan Data System (“NSLDS”) (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the Student Financial Assistance Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (“NSLDSFAP”) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • Enrollment Effective Date – The date that the current enrollment status reported for a student was first effective. (See 4.4.2 of the NSLDS Enrollment Reporting Guide for the specific requirements for reporting the Enrollment Effective Date. Also see 4.4.3 of the NSLDS Enrollment Reporting Guide for additional guidance on effective dates for Withdrawal versus Graduation and Electronic Announcement titled – NSLDS Enrollment Reporting – Submission Dates, Effective Dates and Certification Dates, dated April 20, 2017, for additional information and examples at https://fsapartners.ed.gov/knowledge¬center/library/electronic-announcements/2017-04-20/general-subject-nslds¬enrollment-reporting-submission-dates-effective-dates-and-certification-dates.) • Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Certification Date – The Date enrollment certified by institution. At a minimum, institutions are required to certify enrollment every 60 days or every other month. Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • CIP Code – The Classification of Instructional Programs (CIP) is a set of codes that define fields of study. CIP Codes are maintained by ED's National Center for Education Statistics (NCES). They were most recently updated in 2020 and are usually updated every ten years. A listing of current CIP codes is available at: https://nces.ed.gov/ipeds/cipcode/resources.aspx?y=56. • CIP Year – Year for the corresponding CIP code. The CIP Year for the codes currently used by NSLDS is 2020. • Credential Level – Indicates the level of a credential the student will receive for the program the student is attending, for example undergraduate certificate, associate degree, or bachelor’s degree. (See 4.4.7 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting the Credential Level.) • Published Program Length Measurement – The institution identifies whether the Published Program Length is in days, weeks, or years. • Published Program Length - Published Program Length should be reported based on the definition of “normal time” to completion in the regulations at 34 CFR 668.41(a), • Program Begin Date – The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. (See 4.4.8 of the NSLDS Enrollment Reporting Guide for additional guidance.) • Program Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Program Enrollment Effective Date – The date when the student's current program status first took effect. Condition – UDC did not submit an accurate status change notification or failed to submit timely notification to the NSLDS website for certain students who graduated, withdrew or had a change in their enrollment status (full time, half time or less than half time) during the year. BDO selected a random sample of twenty-five (25) students used to evaluate both campus and program level enrollment reporting compliance requirements. For campus level enrollment, we noted the following exceptions: • For five (5) of twenty-five (25) campus level records tested, UDC did not certify the students’ enrollment data within 60 days. • For ten (10) of twenty-five (25) campus level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) campus level records tested, UDC did not correctly report the students’ enrollment status. For program level enrollment, we noted the following exceptions: • For one (1) of twenty-five (25) program level records tested, UDC did not accurately report the Published Program Length. • For ten (10) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment Status. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified enrollment requirements using a statistically valid sample. Effect – UDC is not in compliance with enrollment reporting requirements. Failure to promptly report accurate and timely changes in enrollment status may adversely impact the repayment status for student loan borrowers. Cause – Insufficient internal controls and administrative oversight with respect to enrollment reporting requirements. Recommendation – We recommend that UDC enhance its procedures and internal controls over enrollment reporting to ensure that significant data elements under both campus-level and program-level records are reported accurately and timely to NSLDS. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-012 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Credit Balances) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.164(h) outlines the following compliance requirements for Title IV credit balances: (6) Title IV, HEA credit balances. (1) A title IV, HEA credit balance occurs whenever the amount of title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period as provided under paragraph (c) of this section. (2) A title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than— (i) Fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (ii) Fourteen (14) days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition – During our testing, we noted the following issues: • For eight (8) of twenty-five (25) credit balances selected for testing, the credit balance created by the disbursement of Title IV awards was not refunded to the student within the required 14-day timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over credit balances from student financial assistance. Cause – Insufficient internal control and administrative oversight with respect to the disbursement of federal awards. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that Title IV credit balances are paid timely to students. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-013 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.173(b)(1) outlines the following compliance requirements for Title IV refunds. (b) Timely return of title IV, HEA program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if— (1) The institution deposits or transfers the funds into the bank account it maintains under Section 668.163 no later than 45 days after the date it determines that the student withdrew. Condition – During our testing, we noted the following exception: • For one (1) of nineteen (19) students selected for Title IV refund calculation testing, the required Title IV refund was not adjusted in the U.S. Department of Education's Common Origination and Disbursement (COD) system within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not compliant with the Return of Title IV Funds compliance requirements. Cause – Insufficient administrative oversight with respect to Return of Title IV Funds requirements. Recommendation – We recommend that UDC enhance its process surrounding the disbursement of federal student aid to ensure compliance with the Return of Title IV Funds requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-014 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Enrollment Reporting Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Institutions are required to report enrollment information under the Pell grant and the Direct and Federal Family Education Loan (“FFEL”) loan programs via the National Student Loan Data System (“NSLDS”) (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the Student Financial Assistance Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (“NSLDSFAP”) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • Enrollment Effective Date – The date that the current enrollment status reported for a student was first effective. (See 4.4.2 of the NSLDS Enrollment Reporting Guide for the specific requirements for reporting the Enrollment Effective Date. Also see 4.4.3 of the NSLDS Enrollment Reporting Guide for additional guidance on effective dates for Withdrawal versus Graduation and Electronic Announcement titled – NSLDS Enrollment Reporting – Submission Dates, Effective Dates and Certification Dates, dated April 20, 2017, for additional information and examples at https://fsapartners.ed.gov/knowledge¬center/library/electronic-announcements/2017-04-20/general-subject-nslds¬enrollment-reporting-submission-dates-effective-dates-and-certification-dates.) • Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Certification Date – The Date enrollment certified by institution. At a minimum, institutions are required to certify enrollment every 60 days or every other month. Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • CIP Code – The Classification of Instructional Programs (CIP) is a set of codes that define fields of study. CIP Codes are maintained by ED's National Center for Education Statistics (NCES). They were most recently updated in 2020 and are usually updated every ten years. A listing of current CIP codes is available at: https://nces.ed.gov/ipeds/cipcode/resources.aspx?y=56. • CIP Year – Year for the corresponding CIP code. The CIP Year for the codes currently used by NSLDS is 2020. • Credential Level – Indicates the level of a credential the student will receive for the program the student is attending, for example undergraduate certificate, associate degree, or bachelor’s degree. (See 4.4.7 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting the Credential Level.) • Published Program Length Measurement – The institution identifies whether the Published Program Length is in days, weeks, or years. • Published Program Length - Published Program Length should be reported based on the definition of “normal time” to completion in the regulations at 34 CFR 668.41(a), • Program Begin Date – The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. (See 4.4.8 of the NSLDS Enrollment Reporting Guide for additional guidance.) • Program Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Program Enrollment Effective Date – The date when the student's current program status first took effect. Condition – UDC did not submit an accurate status change notification or failed to submit timely notification to the NSLDS website for certain students who graduated, withdrew or had a change in their enrollment status (full time, half time or less than half time) during the year. BDO selected a random sample of twenty-five (25) students used to evaluate both campus and program level enrollment reporting compliance requirements. For campus level enrollment, we noted the following exceptions: • For five (5) of twenty-five (25) campus level records tested, UDC did not certify the students’ enrollment data within 60 days. • For ten (10) of twenty-five (25) campus level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) campus level records tested, UDC did not correctly report the students’ enrollment status. For program level enrollment, we noted the following exceptions: • For one (1) of twenty-five (25) program level records tested, UDC did not accurately report the Published Program Length. • For ten (10) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of twenty-five (25) program level records tested, UDC did not accurately report the students’ enrollment Status. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified enrollment requirements using a statistically valid sample. Effect – UDC is not in compliance with enrollment reporting requirements. Failure to promptly report accurate and timely changes in enrollment status may adversely impact the repayment status for student loan borrowers. Cause – Insufficient internal controls and administrative oversight with respect to enrollment reporting requirements. Recommendation – We recommend that UDC enhance its procedures and internal controls over enrollment reporting to ensure that significant data elements under both campus-level and program-level records are reported accurately and timely to NSLDS. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-015 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Annual Report Card, High School Graduation Rate Program: U.S. Department of Education Title I Grants to Local Educational Agencies ALN: 84.010 Award #: S010A230051; S010A220051-22A Award Year: 07/01/2023 – 09/30/2024 Government Department/Agency: District of Columbia Public Schools (DCPS) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. A State Educational Agency (SEA) and its Local Educational Agencies (LEAs) must report graduation rate data for all public high schools at the school, LEA, and state levels using the four-year adjusted cohort rate and, at an SEA’s or LEA’s discretion, one or more extended-year adjusted cohort rates. Graduation rate data must be reported both in the aggregate and disaggregated by the subgroups in Section 1111(c)(2) of the Elementary and Secondary Act of 1965 (ESEA), homeless status, status as a child in foster care using a four-year adjusted cohort graduation rate (and any extended-year adjusted cohort rates) (ESEA sections 1111(h)(1)(C)(iii)(II) and 8101(23), (25) (20 USC 6311(h)(1)(C)(iii)(II) and 7801(23), (25))). To remove a student from the cohort, a school or LEA must confirm, in writing, that the student transferred out, emigrated to another country, transferred to a prison or juvenile facility, or is deceased. To confirm that a student transferred out, the school or LEA must have official written documentation that the student enrolled in another school or in an educational program that culminates in the award of a regular high school diploma. A student who is retained in grade, enrolls in a General Education Development program, or leaves school for any other reason may not be counted as having transferred out for the purpose of calculating graduation rate and must remain in the adjusted cohort (ESEA sections 1111(h)(1)(C)(iii)(II) and 8101(23), (25) (20 USC 6311(h)(1)(C)(iii)(II) and 7801(23), (25))). Condition – During the audit, we noted the following out of forty (40) samples tested: • For two (2) samples, there were no supporting documentation for the removal from the cohort of students who voluntarily dropped their enrollment. • For two (2) samples, students who graduated under DCPS school were incorrectly removed from the cohort. • For ten (10) samples, there were no evidence of review and approval on the documentation maintained for the removal of the student from the cohort. Questioned Costs – Not determinable. Context – This is a condition identified per review of DCPS’ compliance with specified requirements using a statistically valid sample. Effect – Failure to maintain appropriate documentation supporting the approval and removal of a student from the cohort report results in noncompliance for the Title I Part A Grants to LEA program. Cause – DCPS is unable to consistently apply existing policy on documenting review and approval of written documentation supporting the removal of students from the cohort due to lack of consistent communication, coordination and oversight over this process. Recommendation – We recommend that DCPS strengthen its policies, procedures and controls to ensure review and approval are documented and maintained with regards to removal of students from the cohort. We also recommend that training is conducted for employees to ensure that the process is implemented and consistently applied across all DCPS schools. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DCPS agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-016 Prior Year Finding Number: 2023-020 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. For TANF, per 45 CFR Section 205.60 (a), “The State agency will maintain or supervise the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of financial assistance, and the use of any information obtained under Section 205.55, with respect to individual applications denied, recipients whose benefits have been terminated, recipients whose benefits have been modified, and the dollar value of these denials, terminations and modifications. Under this requirement, the agency will keep individual records which contain pertinent facts about each applicant and recipient. The records will include information concerning the date of application and the date and basis of its disposition; facts essential to the determination of initial and continuing eligibility (including the individual's social security number, need for, and provision of financial assistance); and the basis for discontinuing assistance.” Condition – During our testing over beneficiary eligibility compliance requirements of the Temporary Assistance for Needy Families (TANF) program, we selected a sample of 60 beneficiaries in fiscal year 2024 to test DHS’ compliance with TANF eligibility requirements. Total number of payments in the population is 46,856, and total dollar amount from which we selected the samples is $34,639,375. We noted the following: • For ten (10) out of 60 samples, DHS was unable to provide support that would allow us to test that cash assistance was not provided to an individual during the 10-year period that began on the date the individual was convicted in Federal or State court of having made a fraudulent statement or representation with respect to place of residence. In addition, one (1) of these ten (10) samples, DHS was unable to include the individual’s Social Security Number (SSN) in DCAS. Consequently, we were unable to verify the following information in DCAS: household composition, income, proof of residency, and SSNs for all individuals included in the application. Further, one (1) of these ten (10) samples, DHS was unable to provide support that would allow us to test that assistance was not provided to any individual who was fleeing to avoid prosecution, or custody or confinement after conviction, for a felony or attempt to commit a felony, or who is violating a condition of probation or parole imposed under Federal or State law. These exceptions happened due to inadequate review of application for cash assistance by the Social Service Representatives. The questioned costs for the above issues amounted to $107,137, which represents 26.22% of the total eligibility amounts tested related to the 60 sampled items of $408,555. Questioned Costs – Known amount is $107,137. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support eligibility determinations, ineligible beneficiaries may receive benefits under the TANF grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation supporting participant eligibility. Recommendation - We recommend that DHS strengthen its existing policies and procedures over the review and maintenance of appropriate documentation to ensure compliance with eligibility requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS/ESA concur with the findings. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-017 Prior Year Finding Number: 2023-021 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. According to Title IV-A, Section 411 of the Social Security Act (the Act), 45 CFR 265.3, and the American Recovery and Reinvestment Act (ARRA) of 2009, (Public Law 111-5), each State must file an annual report containing information on the TANF program and the State’s maintenance-of-effort (MOE) program(s) for that year, including strategies to implement the Family Violence Option, State diversion programs, and other program characteristics. States are required to submit the ACF-196R report quarterly, beginning in Federal Fiscal Year (FFY) 2015, in lieu of the SF-425, Federal Financial Report (financial status). Each State files quarterly expenditure data on the State’s use of Federal TANF funds, State TANF MOE expenditures, and State expenditures of MOE funds in separate State programs. If a State is expending Federal TANF funds received in prior fiscal years, it must file a separate quarterly TANF Financial Report for each fiscal year that provides information on the expenditures of that year’s TANF funds. This form must be used for reporting regular TANF grant funds, Contingency Funds, and ARRA-Emergency Fund for TANF State Programs funds. See TANF-ACF-PI-2014-02, available at http://www.acf.hhs.gov/programs/ofa/resource/tanf-acf-pi-2014-02, for more information. Condition – During our test work over the quarterly ACF-196R report, we noted that for Grant Identifying numbers G-2101DCTANF, G-2201DCTANF and G-2301DCTANF, the ACF-196R filed for 4th quarter in fiscal year 2024 showed a variance of $86,958, $375,033 and $2,648,441, respectively, between the amounts reported on the ACF-196R and the amounts included in DIFS. In addition, for Grant Identifying number G-2401DCTANF, we noted that there was a variance of ($4,637,270) between the amount included in the SEFA detail including Indirect Costs ($64,708,667) and the cumulative amount reported on the ACF-196R for the fiscal year 2024 grant for the sum of federal and contingency funds ($60,071,397). DHS was unable to provide support for the variance. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure that correct amounts were reported and were properly reviewed, DHS may report incorrect amounts on the quarterly ACF-196R reports. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that the amounts on the ACF-196R were properly reported and the reports were properly reviewed and approved. Recommendation - We recommend that DHS implement policies, procedures and controls that will enable an accurate reconciliation between the data sources used in the preparation of the ACF-196R reports to ensure proper reporting of TANF expenditures. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS OCFO concurs with the finding. The variances identified specifically relate to administrative costs incurred on the fiscal year 2024 grant that were moved to prior year grants. The fiscal year 2024 TANF administrative expenditure exceeded the TANF administrative cap for fiscal year 2024 and to correct the issue, the excess administrative cost was reallocated to prior open fiscal years (fiscal years 2021, 2022 and 2023). The administrative cap limit for fiscal years 2021, 2022 and 2023 were not fully utilized and so the Agency decided to charge the excess fiscal year 2024 administrative expenses to those grants. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-018 Prior Year Finding Number: 2023-022 Compliance Requirement: Reporting; Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/ Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 261.60 (a), “A State must report the actual hours that an individual participates in an activity, subject to the qualifications in paragraphs (b) and (c) of this section and Section 261.61(c). It is not sufficient to report the hours an individual is scheduled to participate in an activity. (b) For the purposes of calculating the work participation rates for a month, actual hours may include the hours for which an individual was paid, including paid holidays and sick leave. For participation in unpaid work activities, it may include excused absences for hours missed due to a maximum of 10 holidays in the preceding 12-month period and up to 80 hours of additional excused absences in the preceding 12-month period, no more than 16 of which may occur in a month, for each work-eligible individual. Each State must designate the days that it wishes to count as holidays for those in unpaid activities in its Work Verification Plan. It may designate no more than 10 such days. In order to count an excused absence as actual hours of participation, the individual must have been scheduled to participate in a countable work activity for the period of the absence that the State reports as participation. A State must describe its excused absence policies and definitions as part of its Work Verification Plan, specified at Section 261.62. (c) For unsubsidized employment, subsidized employment, and OJT, a State may report projected actual hours of employment participation for up to six months based on current, documented actual hours of work. Any time a State receives information that the client's actual hours of work have changed, or no later than the end of any six-month period, the State must re-verify the client's current actual average hours of work, and may report these projected actual hours of participation for another six-month period. (d) A State may not count more hours toward the participation rate for a self-employed individual than the number derived by dividing the individual's self-employment income (gross income less business expenses) by the Federal minimum wage. A State may propose an alternative method of determining self-employment hours as part of its Work Verification Plan. (e) A State may count supervised homework time and up to one hour of unsupervised homework time for each hour of class time. Total homework time counted for participation cannot exceed the hours required or advised by a particular educational program.” Per 45 CFR Section 261.61 (a), “A State must support each individual’s hours of participation with documentation in the case file. In accordance with Section 261.62, a State must describe in its Work Verification Plan the documentation it uses to verify hours of participation in each activity.”   According to the DC State Verification Plan, the D.C. Department of Human Services (DHS), Department of Human Services Monitoring Unit reviews and audits all documentation submitted by vendors reflecting the activities of recipients in TANF Employment program. This documentation includes time sheets, activity logs, school records, pay stubs, and verification of employment, work experience and on-the-job training. The Monitoring Unit completes this audit process to determine if sufficient documentation exists to substantiate reported time and attendance data, to warrant a payment to TANF Employment program vendors, and submission of countable hours for federal reporting purposes. The District projects hours of participation in unsubsidized, self-employment for six months or until the recipient's next scheduled recertification, whichever is sooner. Per 45 CFR Section 265.7 (a)-(c), “Each State’s quarterly reports (the TANF Data Report, the TANF Financial Report (or Territorial Financial Report), and the SSP-MOE Data Report) must be complete and accurate and filed by the due date.” For disaggregated data report, ‘a complete and accurate report’ means that: (1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems, and include correction of the quarterly data by the end of the fiscal year reporting period; (2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so); (3) The State reports data for all required elements (i.e., no data are missing); (4)(i) The State provides data on all families; or (ii) if the State opts to use sampling, the State reports data on all families selected in a sample that meets the specification and procedures in the TANF Sampling Manual (except for families listed in error); and (5) Where estimates are necessary (e.g., some types of assistance may require cost estimates), the State uses reasonable methods to develop these estimates. For an aggregated data report, “a complete and accurate report” means that: (1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems; (2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so); (3) The State reports data on all applicable elements; and (4) Monthly totals are unduplicated counts for all families (e.g., the number of families and the number of out-of-wedlock births are unduplicated counts).” 45 CFR Section 265.7 (f) states that “States must maintain records to adequately support any report, in accordance with Section 75.361 through 75.370 of this title.” Condition – During our test work over a sample of 60 participants for Special Tests and Provisions - Penalty for Failure to Comply with Work Verification Plan and Reporting, we noted: • For six (6) instances, we noted that although the hours reported on the ACF-199 report met or exceeded the required hours, the hours reported did not agree with the average hours reported in CATCH. • For seven (7) instances, we noted that although participant work activity was adequately documented and properly supported by audited timesheets, the participant did not meet the work participation weekly hours requirement. In addition, for four (4) of these samples, we noted that the hours reported on the ACF-199 report do not agree with the average hours in CATCH. • For nine (9) instances, we noted that for a customer with unsubsidized employment, although the hours reported on the ACF-199 report met or exceeded the required hours, the hours reported did not agree with the projected hours per the support. • For ten (10) instances, we noted that although the reported hours met or exceeded the required hours, no documentation support was provided to support the ACF-199 report. • For one (1) instance, we noted that although the hours on the support provided met or exceeded the required hours and the hours reported in the ACF-199 report agree with the average hours reported in CATCH, the hours entered in CATCH should initially have been denied by TANF Office of Performance Monitoring and then re-entered by provider because the hours were entered incorrectly. • For one (1) instance, we noted that the number of audited hours per timesheet did not agree with the approved hours in CATCH. In addition, although the hours reported on the ACF-199 report met or exceeded the required hours, the hours reported did not agree with the actual hours per the CATCH support. • For one (1) instance, we noted that for a customer with unsubsidized employment, the support provided was for more than six months before the sample month. Therefore, the hours reported were not properly supported. In addition, although the hours reported on the ACF-199 report met or exceeded the required hours, the hours reported did not agree with the projected hours per the support. • For one (1) instance, we noted that although the hours reported in the ACF-199 report met or exceeded the required hours, a review of the Work documentation support provided detailing employment, noted no hours were included on the documentation. Therefore, the hours reported and projected were not supported. The information tested in our sample represents the underlying data used in Reporting for the 2nd and 4th quarters of fiscal year 2024. Consequently, DHS incorrectly reported data in the ACF-199 report for the 2nd and 4th quarters of fiscal year 2024. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Data within the ACF-199 report may not be complete and accurate. Specifically, if the work participation data is not substantiated, or inconsistencies are noted, it may result in inaccurate data being reported and may lead to an incorrect ACF-199 report and could result in an incorrect allocation of Federal Funds to the state. Cause – Controls are not operating effectively over the documentation of work participation data to ensure that adequate evidence of the work participation is maintained. Recommendation - We recommend that DHS enforce existing policies and procedures and implement additional controls to ensure that adequate documentation is maintained to substantiate the work participation data reported in the ACF-199 report in accordance with the District of Columbia Work Verification Plan. We also recommend that DHS implement policies, procedures and controls that will enable an accurate reconciliation between the data sources used in the preparation of the ACF-199 report to ensure proper reporting of data elements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS agrees with the findings and will work with the DC Access System (DCAS) and Division of Innovation and Change Management (DICM) teams to mitigate the causes of the findings. These findings are mostly residual issues with the tables in DHS/ESA DCAS system. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-019 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Child Support Non-Cooperation Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 264.30 (a) (1) The State agency must refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency (i.e., the IV-D agency). (2) Referred individuals must cooperate in establishing paternity and in establishing, modifying, or enforcing a support order with respect to the child. Per 45 CFR Section 264.30 (c) The IV-A agency must then take appropriate action by: (1) Deducting from the assistance that would otherwise be provided to the family of the individual an amount equal to not less than 25 percent of the amount of such assistance; or (2) Denying the family any assistance under the program. Per the Code of the District of Columbia - Section 4–205.55. (a) The Mayor shall give timely and adequate notice in cases of intended action to discontinue, withhold, terminate, suspend, reduce assistance, or make assistance subject to additional conditions, or to change the manner or form of payment to a protective, vendor, or 2-party payment. (1) “Timely” means that the notice is postmarked at least 15 days before the date upon which the action would become effective, except as provided in Section 4-205.54(d). (2) “Adequate” means that the written notice includes a statement of what action the Mayor intends to take, the reasons for the intended action, the specific law and regulations supporting the action, an explanation of the individual’s right to request a hearing, and the circumstances under which assistance will be continued if a hearing is requested. Condition – During our compliance test work for the Special Tests and Provisions – Child Support Non-Cooperation compliance requirement, we tested forty (40) out of a population of 295 child support cases referred by Child Support Enforcement (CSE) to the TANF program as having not cooperated with Child Support. We noted that for four (4) out of 40 samples, DHS was unable to provide support why the individual was not sanctioned. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support not imposing sanctions to individuals may result to noncompliance with TANF Child Support Non-Cooperation compliance requirements. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation supporting compliance with TANF Child Support Non-Cooperation compliance requirements. Recommendation - We recommend that DHS strengthen its existing policies and procedures over enforcement of sanctions and maintenance of appropriate documentation to ensure compliance with TANF Child Support Non-Cooperation compliance requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS/ESA agree with the auditor’s findings regarding the lack of completion of requests from the Child Support Enforcement (CSE) to the TANF program to impose a child support on parents who have not cooperated with child support compliance requirements. The incomplete work was due to staff transitions occurring during the review period which impacted the oversight and productivity of DHS/ESA staff working on the child support sanction process. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-020 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Penalty for Refusal to Work Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 261.14 (a) and (b) “(a) If an individual refuses to engage in work required under section 407 of the Act, the State must reduce or terminate the amount of assistance payable to the family, subject to any good cause or other exceptions the State may establish. Such a reduction is governed by the provisions of Section 261.16. The State must, at a minimum, reduce the amount of assistance otherwise payable to the family pro rata with respect to any period during the month in which the individual refuses to work. The State may impose a greater reduction, including terminating assistance.” Condition – During our testing of Special Tests and Provisions – Penalty for Refusal to Work, we selected a sample of 60 cases in fiscal year 2024 to test DHS’ compliance with specified requirements. Total population is comprised of 4,812 case numbers for individuals that received payments for months where they did not meet the work requirements. Total dollar amount is $19,993,065. We noted the following: • For eight (8) instances, we noted that an individual had no participation hours in CATCH for various dates during fiscal year 2024 and DHS/ESA was unable to provide supporting exemptions or justifications for not sanctioning the individual during the period in question. • For one (1) instance, we noted that an individual had no participation hours reported in CATCH for period October 2023 through April 2024 but a review of DCAS showed that the individual was partially engaged during this period. The individual’s required hours increased to 30 but was coded to Outreach rather than Noncompliance, thus, there was miscoding of hours. Consequently, the individual was not sanctioned as required, and the benefits were not properly reduced. • For one (1) instance, we noted that an individual had no participation hours reported in CATCH for period April 2024 through September 2024 and a review of DCAS showed that the individual was paid twice for period March 2024 to September 2024, which resulted to potential overpayment of $3,528. DHS-ESA was unable to provide support to confirm whether the duplicate payment was necessary or was properly reversed. Total payments made to these ten (10) individuals during the periods in question was $59,874. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support exemptions or justifications for not imposing sanctions to individuals, individuals may be given full benefits instead of reduced federal benefits under the TANF program. In addition, miscoding of hours or amounts paid may result to providing inappropriate benefits to individuals. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation to support exemptions or justifications for individuals who refuse to fulfill the minimum working requirements to receive or maintain benefits under the TANF program. In addition, controls are not operating effectively over the supervisory review of transactions posted in DCAS to ensure accuracy. Recommendation - We recommend that DHS enforce existing policies and procedures over review and maintenance of appropriate documentation to ensure compliance with Penalty for Refusal to Work compliance requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS agrees with the findings and will work within the Division of Customer Workforce Employment and Training (DCWET) team to mitigate the causes of the findings. These findings are mostly residual issues caused by inconsistency of caseload management practices. Another mitigating factor is attributable to inadequate training of staff involved in the sanction process. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-021 Prior Year Finding Number: 2023-024 Compliance Requirement: Special Tests and Provisions – Lack of Child Care for Single Custodial Parent of Child Under Age Six Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 261.15 “Can a family be penalized if a parent refuses to work because he or she cannot find child care? (a) No, the State may not reduce or terminate assistance based on an individual’s refusal to engage in required work if the individual is a single custodial parent caring for a child under age six who has a demonstrated inability to obtain needed child care, as specified at Section 261.56.” Per 45 CFR Section 261.16 “Does the imposition of a penalty affect an individual’s work requirement? A penalty imposed by a State against the family of an individual by reason of the failure of the individual to comply with a requirement under TANF shall not be construed to be a reduction in any wage paid to the individual.” Per 45 CFR Section 261.56 “What happens if a parent cannot obtain needed child care? (a)(1) If the individual is a single custodial parent caring for a child under age six, the State may not reduce or terminate assistance based on the parent's refusal to engage in required work if he or she demonstrates an inability to obtain needed child care for one or more of the following reasons: (i) Appropriate child care within a reasonable distance from the home or work site is unavailable; (ii) Informal child care by a relative or under other arrangements is unavailable or unsuitable; or (iii) Appropriate and affordable formal child care arrangements are unavailable. (2) Refusal to work when an acceptable form of child care is available is not protected from sanctioning. Per 45 CFR Section 261.57 What happens if a State sanctions a single parent of a child under six who cannot get needed child care? (a) If we determine that a State has not complied with the requirements of Section 261.56, we will reduce the SFAG payable to the State by no more than five percent for the immediately succeeding fiscal year unless the State demonstrates to our satisfaction that it had reasonable cause or it achieves compliance under a corrective compliance plan pursuant to Section 262.5 and 262.6 of this chapter. (b) We will impose the maximum penalty if: (1) The State does not have a statewide process in place to inform parents about the exception to the work requirement and enable them to demonstrate that they have been unable to obtain child care; or (2) There is a pattern of substantiated complaints from parents or organizations verifying that a State has reduced or terminated assistance in violation of this requirement. (c) We may impose a reduced penalty if the State demonstrates that the violations were isolated or that they affected a minimal number of families. Condition – During our test work over a sample of twenty-nine (29) out of a population of 275 childcare cases reviewed by supervisors and included on two quarterly reports submitted to the DC Office of the State Superintendent of Education (OSSE), for Special Tests and Provisions - Lack of Child Care of Single Custodial Parent of Child under Age Six, we noted that all files sampled were reviewed by the supervisors. However, for one child care case, we noted the following: (1) the Date the discussion was held with the Eligibility worker, the date the Eligibility worker made corrections, and Eligibility Review completed date were not included; and (2) no comments were included by the supervisor to explain the “No” responses on various questions, or the status of the “No” responses. Consequently, we were unable to verify that the required follow-up occurred for this one sample. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without following the internal controls and policies and procedures already in place to ensure that eligibility for child care is being properly determined by staff, it may result in inaccurate decisions for child care cases or inaccurate information being reported to OSSE. Cause – Controls are not operating effectively over the documentation of the supervisory review of child care cases before submission of the quarterly report to OSSE. Recommendation - We recommend that DHS/ESA enforce existing policies and procedures and implement additional controls to ensure that all Supervisory Case Record Review forms are properly completed and reviewed, signed and dated by the supervisor before the report is submitted to OSSE. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS agrees with the findings that appropriate actions were taken to approve the case, however, the reviewing supervisor failed to update the Supervisory Case Review form with 1) date the discussion was held with the eligibility worker, the date the eligibility worker made corrections, and the date the eligibility worker review was completed and 2) failed to enter comments on “No” responses on various questions. DHS will enforce current policies and procedures and will ensure that Supervisory Case Reviews are updated and double-checked by the supervisor once the eligibility worker make the corrections prior to OSSE’s report being submitted to reflect the accurate information. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-022 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Child Care and Development Fund Cluster ALN: 93.575, 93.596 Award #: 2401DCCDD; 2101DCCDC6 Award Years: 10/01/2023 – 09/30/2026 10/01/2020 – 09/30/2024 Government Department/Agency: Office of the State Superintendent of Education (OSSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – For one (1) subaward sample selected for FFATA testing, we noted that OSSE failed to provide evidence that it reported the subaward information through the FSRS or sam.gov website to fulfill the FFATA requirements. Questioned Costs – None. Context – This is a condition identified per review of OSSE’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report results in noncompliance for the Child Care and Development Block Grant program. Cause – OSSE did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that OSSE evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – OSSE concurs with the auditor’s finding and recommendations related to this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-022 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Child Care and Development Fund Cluster ALN: 93.575, 93.596 Award #: 2401DCCDD; 2101DCCDC6 Award Years: 10/01/2023 – 09/30/2026 10/01/2020 – 09/30/2024 Government Department/Agency: Office of the State Superintendent of Education (OSSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – For one (1) subaward sample selected for FFATA testing, we noted that OSSE failed to provide evidence that it reported the subaward information through the FSRS or sam.gov website to fulfill the FFATA requirements. Questioned Costs – None. Context – This is a condition identified per review of OSSE’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report results in noncompliance for the Child Care and Development Block Grant program. Cause – OSSE did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that OSSE evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – OSSE concurs with the auditor’s finding and recommendations related to this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-023 Prior Year Finding Number: 2023-027 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Based on CFSA’s Human Resources Administration Issuance: HR-06-1 dated May 12, 2006, staff must seek and receive advance written approval prior to working overtime. It also indicates that in emergency situations requiring an immediate response, the employee shall make every reasonable attempt to obtain advance approval by an appropriate manager or supervisor. Per District Personnel Issuance No. 2018-00 (Annual Leave) effective April 21, 2018 “Using Annual Leave” - An employee may use accrued annual leave at any time during the leave year if they receive approval from their immediate supervisor or the agency head responsible for the employee’s timesheet. If an employee wishes to use their accrued annual leave, they must: 1. Submit a request in advance to use annual leave to their manager or supervisor. 2. Receive approval from the manager or supervisor; and 3. Record the approved leave taken on their timesheet in PeopleSoft. CFSA uses a Random Moment Study (RMS) to allocate the administrative costs to the Foster Care program. The study entails selecting a sample of social workers on a quarterly basis to participate in the RMS study where the social workers are required to notate what they were doing at the sample moment. Subsequently, the supervisors of these social workers review and validate their responses. validation of the responses adds an extra layer of reliability to the data collected. It ensures that the information provided by social workers is accurate and reflective of their actual activities. This validation process helps maintain the integrity of the study and ensures that the results are trustworthy in making decisions when determining the RMS percentage utilization in the allocation of the administrative costs. Condition – The following issues were observed: 1. Our procedures revealed that CFSA had erroneously included fiscal year 2025 expenditures totaling $2,571,560 in the fiscal year 2024 cost allocation, thereby overstating expenses reported and claimed. The financial impact based on the allocation calculation to the Foster Care program was $724,724. 2. During our review of the payroll process regarding the review and approval of time and attendance, we noted the following in our sample of 60 payroll items: • For two (2) samples, CFSA failed to provide documentation evidencing the approval of overtime paid and annual leave taken. • For three (3) samples, we noted that there were differences between the approved hours of overtime and annual leave paid and the actual hours taken. CFSA failed to provide documentation for the actual hours taken. • For one (1) sample, validation of the Random Moment Study was not performed. Questioned Costs – Known amount is $724,724. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample and review of the detail expenses database compared to the SEFA. Effect – CFSA reported and claimed fiscal year 2025 costs, which resulted into questioned costs. Additionally, without adequate internal controls and procedures for record maintenance, there is a risk of disputes between the agency and its employee’s accuracy of leave and overtime. Furthermore, failing to validate the Random Moment Study (RMS) may result in inaccurate outcomes, compromising the study's effectiveness in allocating administrative costs. Cause – CFSA did not have proper internal controls and policies and procedures in place to ensure that the correct fiscal year costs were submitted and claimed, and that authorization forms evidencing the preapproval of overtime and annual leave were maintained. Additionally, CFSA did not follow its internal controls, policies, and procedures to ensure the accuracy and consistent documentation of the RMS validation. Recommendation - We recommend that CFSA strengthen its policies, procedures, and controls to ensure that costs are accurately reported and claimed. We also recommend that pre-authorization of overtime and annual leave is maintained. Furthermore, we recommend that CFSA enhance its procedures to ensure the verification process is performed and maintained and the supervisors maintain consistent documentation of the RMS validation. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with the findings as stated. Regarding Condition 2 above, Differences in pre-approved leave or overtime and actual leave or overtime taken are not uncommon in light of changing circumstances. CFSA notes that for one sample involving overtime charges, the situation involved a social worker performing field work and the difference between pre-approved overtime and actual overtime taken was 30 minutes. Regarding the RMS, CFSA notes that the statistical standard for supervisory validation of RMS responses is 10%. Across fiscal year 2024 as a whole, CFSA’s validation rate of accepted responses was 10% and therefore met this standard. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-024 Prior Year Finding Number: 2023-028 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. 29 CFR Section 97.20(b)(2), Accounting records. “Grantees and sub grantees must maintain records which adequately identify the source and application of funds provided for financially assisted activities. These records must contain information pertaining to grant or subgrant awards and authorizations, obligations, unobligated balances, assets, liabilities, outlays or expenditures, and income.” Per 45 CFR Section 1356.30(b), “The Title IV-E agency may not approve or license any prospective foster or adoptive parent, nor may the Title IV-E agency claim Federal Financial Participation (FFP) for any foster care maintenance or adoption assistance payment made on behalf of a child placed in a foster home operated under the auspices of a child placing agency or on behalf of a child placed in an adoptive home through a private adoption agency, if the Title IV-E agency finds that, based on a criminal records check conducted in accordance with paragraph (a) of this section, a court of competent jurisdiction has determined that the prospective foster or adoptive parent has been convicted of a felony involving: (1) Child abuse or neglect; (2) Spousal abuse; (3) A crime against a child or children (including child pornography); or, (4) A crime involving violence, including rape, sexual assault, or homicide, but not including other physical assault or battery.” Per 45 CFR Section 1356.30(f), "In order for a childcare institution to be eligible for Title IV-E funding, the licensing file for the institution must contain documentation which verifies that safety considerations with respect to the staff of the institution have been addressed.” Furthermore, per 45 CFR Section 1356.21(a), “Statutory and regulatory requirements of the Federal foster care program, To implement the foster care maintenance payments program provisions of the Title IV-E plan and to be eligible to receive FFP for foster care maintenance payments under this part, a Title IV-E agency must meet the requirements of this section, 45 CFR 1356.22, 45 CFR 1356.30, and Parts 472, 475(1), 475(4), 475(5), 475(6).” Per CFSA policy 6008.1, “As part of the home study process, an agency shall ensure that each applicant and any other person eighteen (18) years of age or older residing in the home comply with the requirements for a criminal records check established by the Adoption and Safe Families Amendment Act of 2000, effective June 27, 2000, D.C. Law 13-136.” Condition – For the fiscal year 2024, the Foster Care program had total disbursements of $2,390,443 for 3,008 maintenance payments. We selected a sample of 60 participants representing disbursed federal funds totaling $43,656, we noted the following deficiencies: • For one (1) of 60 samples, CFSA was unable to provide valid providers licenses as required by CFR 1356.30 (b) and background check information. • For one (1) of 60 samples, CFSA did not provide copy of the registry check which is part of the criminal records check required by CFR 1356.30 (b) and CFSA policy 6008.1. • For one (1) of 60 samples, CFSA did not provide complete documentation for adult member that resided in the home; therefore, we were unable to determine whether background checks such as criminal record checks and fingerprint-based checks from the national crime information databases was properly performed as required by the District of Columbia as detailed in CFSA policy 6008.1. These deficiencies represent 4% of the total disbursements tested. Questioned Costs – Known amount is $1,583. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – CFSA was not in compliance with the eligibility requirements of the Foster Care program. Cause – CFSA does not have adequate controls in place to ensure that the required eligibility documentation is maintained to evidence compliance with eligibility requirements. Recommendation - We recommend CFSA reevaluate and strengthen its existing policies and procedures over the review and maintenance of appropriate documentation to ensure compliance with eligibility requirements in accordance with the program. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with the findings. The licensure issue involved a provider who was in process of permanently closing her home as a foster care provider (and the existing license expired in the meantime), and the other item involved a brief lapse in the child protection register check. Corrective action will involve improved automation within the claiming process. CFSA also acknowledges that the third bullet regarding the legibility of the background criminal check document for the “other adult in the home” is an internal control issue for which there are no questioned costs.   The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-025 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per OMB No. 0970-0205, Form CB-496, Title IV-E Programs Quarterly Financial Report, “is required to be submitted at the end of each fiscal quarter by each State or Tribe with an approved plan under the Title IV-E of the Social Security act to administer the Foster Care, Adoption Assistance, and Guardianship Assistance programs. In submitting this form, each State or Tribal grantee meets its statutory and regulatory requirements to report actual program expenditures made in the preceding fiscal quarter and to provide an estimate of program expenditures anticipate in the upcoming fiscal quarter. Condition – The following conditions were observed: 1. Based on reconciliation review of Form CB-496 for all the quarterly reports in fiscal year 2024, it was observed that CFSA incorrectly calculated the family-based rate adjustment claims for quarters 2, 3 & 4. CFSA failed to apply the Federal Medical Assistance Percentage (FMAP) rate of 76.2% to net adjusted IV-E maintenance costs. Instead, the gross amount was reported and claimed, resulting in an overstatement of $412,808 for claims reported - $140,209 related to quarter 2, $135,819 related to quarter 3, and $136,780 related to quarter 4. 2. During the reconciliation of the SEFA to the claimed program expenditures, as reported on Form CB-496, we noted that expenditures totaling $791,224 were charged to the incorrect grant years for the Title IV-E Foster Care grant. Although these costs were not claimed by the agency, as a result of the error relating to the incorrect grant years, the SEFA did not reconcile to the submitted CB-496 reports. Questioned Costs – Known amount is $412,808. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure that correct amounts were reported, CFSA can report incorrect amounts on the quarterly federal claims submissions. Cause – CFSA did not have proper internal controls and policies and procedures in place to ensure that the amounts on the quarterly claims submissions were properly reported. Recommendation - We recommend that CFSA implement policies, procedures and controls that will enable an accurate preparation of quarterly reporting. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with the findings. The finding involved a recurring formula error in the workbook CFSA uses to calculate its lapsing quarter family-based rate adjustment. The issue stemmed from the pandemic-era stimulus funding that increased the District’s FMAP percentage from the standard 70% to 76.2%, which CFSA accommodated in its family-based rate adjustment claiming tools with manual entries. Corrective action is outlined in the Management’s Section, but in the meantime the District has returned to the standard 70% FMAP, which precludes recurrence. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-026 Prior Year Finding Number: 2023-029 Compliance Requirement: Special Tests and Provisions – Payment Rate Setting and Application Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per CFSA’s internal policies and procedures, providers must submit quarterly reports within 45 days of the end of each Federal fiscal year quarter. Upon receipt of quarterly reports from the provider, the Business Services Administration Program Manager reviews each Expenditure Detail Spreadsheet for compliance, accuracy and reasonableness. Condition – Our assessment of the special tests and provisions requirement, revealed that while the selected providers’ quarterly reports displayed no deficiencies, CFSA was unable to provide documentation evidencing the review and approval of the quarterly reports relating to all 40 transactions that were tested. Questioned Costs – Not determinable. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – The absence of documentation specifying who reviews and approves the quarterly reports compromises accountability and creates ambiguity in identifying the responsible parties in instances of errors or discrepancies. Cause – CFSA does not have adequate controls in place to ensure that review and approval of provider’s quarterly reports are documented. Recommendation - We recommend CFSA strengthen its policies and procedures to address the review and approval process for the provider’s quarterly reports. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with this finding as stated. The analysis of provider quarterly reports was performed consistently, but CFSA was inconsistent in demonstrating through formal correspondence back to the provider community that their quarterly reports were acceptable and approved as submitted. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-027 Prior Year Finding Number: 2023-032 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CRF Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CRF Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CRF Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CRF Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination totaling 283,898 total population during the fiscal year 2024 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exception: • For three (3) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-027 Prior Year Finding Number: 2023-032 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CRF Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CRF Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CRF Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CRF Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination totaling 283,898 total population during the fiscal year 2024 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exception: • For three (3) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-027 Prior Year Finding Number: 2023-032 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CRF Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CRF Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CRF Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CRF Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination totaling 283,898 total population during the fiscal year 2024 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exception: • For three (3) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-028 Prior Year Finding Number: 2023-033 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Year: 09/30/2020 – 09/29/2024 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.403, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented.” Condition – During our testwork over nonpayroll transactions for the Activities Allowed or Unallowed and Allowable Costs/Cost Principles, we noted that for one (1) out of sixty-two (62) samples, the transaction was charged twice to the program. Total amount of nonpayroll transactions is $19,095,189, and the amount of exception is $122,311. Questioned Costs – Known amount is $122,311. Context – This is a condition identified per review of DBH’s compliance with specified requirements using a statistically valid sample. Total amount of samples selected for testing amounted to $5,633,513. Effect – Lack of proper review of expenditures could result to unallowable costs charged to the program. Cause – DBH does not have adequate controls in place to ensure that only allowable costs are charged to the program. Recommendation – We recommend that DBH strengthen internal control procedures to ensure that expenditures are allowable, and that sufficient documentation is retained to support that allowability. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-029 Prior Year Finding Number: N/A Compliance Requirement: Cash Management Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Year: 09/30/2020 – 09/29/2024 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. When entities are funded on a reimbursement basis, program costs must be incurred prior to the date of the reimbursement request (2 CFR Section 200.305(b)(3)). US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Condition – During our testing of individual draws of federal funds, we noted that for one (1) sample selected and tested, the review of drawdown was made after it has been requested. Questioned Costs – Not determinable. Context – This is a condition identified per review of DBH’s compliance with specified requirements using a statistically valid sample. The sample drawdown, which is related to expenditures incurred during fiscal year 2024, was requested on December 24, 2024 but the review of the drawdown request did not happen until January 28, 2025. The total drawdown selected for testing amounted to $19,381,854. Effect – DBH is not in compliance with cash management requirements. Failure to timely review cash draw requests could result in cash draws that do not accurately reflect eligible program costs. Cause – DBH did not appear to adhere to internal control procedures to ensure the timely review of cash draws. Recommendation – We recommend DBH evaluate its existing cash management control procedures and ensure all federal draw requests are reviewed timely. We also recommend DBH establish procedures to periodically monitor its compliance with the cash management requirements and initiate necessary actions to resolve any noncompliance that results. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH concurs with the finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-030 Prior Year Finding Number: 2023-035 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Year: 09/30/2020 – 09/29/2024 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Federal Financial Report (FFR) Controls over Reporting Compliance: 2 CFR 200.333 requires that financial records, supporting documents, statistical records, and all other non-federal entity records pertinent to a federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the federal awarding agency or pass-through entity in the case of a subrecipient. Performance Progress Report (PPR) Underlying Data: The audit objective for the Reporting compliance requirement stated in the 2 CFR Part 200, appendix XI Compliance Supplement is as follows: Determine whether required reports for Federal awards include all activity of the reporting period, are supported by applicable accounting or performance records, and are fairly presented in accordance with governing requirements. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – During our testing of the reporting compliance requirement, we noted the following: • FFR Controls over Reporting Compliance: DBH’s control over compliance for financial reporting is as follows: “All reports are reviewed by the Accounting Officer or Agency Fiscal Officer prior to submission to the Federal government. DBH Program and Fiscal Services staff review programmatic and financial reports.” We noted DBH did not timely review and approve the annual Financial Reporting Report (FFR or SF-425) prior to submission to the Federal government. Total population is one (1) report and sample selected is one (1). • PPR Reporting Compliance: We noted DBH did not have documentation for the information, as well as the source of the information, it used in the Opioid STR’s Performance Progress Report. Information as reported in the reports was unsupported as management did not retain the underlying data. Total population is two (2) reports and sample selected is one (1). • SEFA Reporting Compliance: During our testing for the SEFA, we noted that DBH incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2024, DBH incurred $12.0 million in subrecipient expenditures for this program and incorrectly reported that there were no subrecipient expenditures on the initial SEFA. While the subrecipient expenditures amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with specified reporting requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure that correct amounts were reported and were properly reviewed as it relates to the Opioid STR program: • FFR Controls over Reporting Compliance: There is an increased risk of errors occurring and being undetected, or errors being present in reports if no review and approval occurred. • PPR Reporting Compliance: DBH cannot be assured that it reported complete and accurate information to enable the Substance Abuse and Mental Health Services Administration (SAMHSA), an operating division of the Department of Health and Human Services (HHS), to assess the outcomes of the State’s use of Opioid program funding. • SEFA Reporting Compliance: The effect of the condition is that the SEFA was not accurately prepared. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that the amounts on the FFR and SEFA were properly reported, and the reports were properly reviewed and approved. Recommendation – We recommend the following: • FFR Controls over Reporting Compliance: We recommend DBH strengthen its internal control to ensure timely review and approval of the FFR before report submission. • PPR Reporting Compliance: We recommend DBH develop formal, written procedures to identify the sources of information necessary and steps needed to compile accurate and complete information for the Opioid program performance reports; and retain in a central location all documentation that it used to support information included in each performance report it submits to the federal government. • SEFA Reporting Compliance: We recommend DBH ensure that agency personnel receive proper training on subrecipient versus vendor determination; as well as review existing policies and procedures for preparing the Schedule of Expenditures of Federal Awards to ensure that it is complete and accurate. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-031 Prior Year Finding Number: 2023-036 Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Year: 09/30/2020 – 09/29/2024 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Earmarking Requirements for Subrecipients: Award recipients must comply with the requirements for subrecipients monitoring and management as outlined in the provisions of 45 CFR Section 75.351-352 and should ensure written subaward/subcontract agreements are in place. The written agreement must require that subrecipients comply with the same terms and conditions as the prime recipient, as applicable (i.e., financial management requirements, audit requirements, etc.) and should describe the scope of work, deliverables, etc. The grant agreements provide that the District may use no more than ten (10) percent of the total grant award for administrative costs and developing the infrastructure necessary for expansion of services. Also, no more than ten (10) percent of the total grant award may be used for data collection, performance measurement, and performance assessment, including incentives for participating in the required data collection follow-up. Condition – During our testing of the Subrecipient Monitoring compliance requirement, we noted the following: Earmarking Requirements for Subrecipients: During our testing of the State Targeted Response to the Opioid Crisis Program, we noted that the agency used a different established indirect cost rate in monitoring the earmarking of awardees than the maximum administrative costs/indirect costs. For two (2) out of eleven (11) samples selected for testing, the awardees exceeded the ten (10) percent funding limitation for administrative costs/indirect costs. In addition, DBH does not have a process to monitor the ten (10) percent earmarking requirement for costs of developing the infrastructure necessary for expansion of services; and for data collection, performance measurement, and performance assessment, including incentives for participating in the required data collection follow-up. Total amount of population is $11,977,624, and the total amount of exceptions for two (2) samples is $524,658. Questioned Costs – Not determinable. Context – This is a condition identified per review of DBH’s compliance with specified subrecipient monitoring requirements using a statistically valid sample. Effect – Subrecipients may not be properly monitored, which may result in subawards being used for unauthorized purposes in violation of the terms and conditions of the subawards or that the subaward performance goals were not achieved. Cause – There is lack of sufficient documentary evidence to support that the controls are operating as designed related to subrecipient monitoring compliance. Recommendation – We recommend that DBH maintain sufficient documentation to evidence its internal controls over the risk assessment and monitoring of subrecipients. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-032 Prior Year Finding Number: N/A Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services HIV Care Formula Grants ALN: 93.917 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health (DC Health) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. To be eligible to receive assistance in the form of therapeutics, an individual must meet the following requirement: 42 U.S. Code Section 300ff-26 - Provision of treatments: (b) Eligible individual. To be eligible to receive assistance from a State under this section an individual shall— (1) have a medical diagnosis of HIV/AIDS; and (2) be a low-income individual, as defined by the State. Condition – During our review of forty (40) participant eligibility files out of population of 875, under the HIV Care Formula Grants, we noted the following: • For all forty (40) participant eligibility files tested, we noted absence of secondary supervisory review as required. Specifically, eligibility determinations are made solely by the eligibility specialist without documented supervisory review or sign-off. • For two (2) participant files reviewed, we noted that there was no documentation pertaining to the proof of HIV diagnosis, verification of income and/or residency in the Ramsell Eligibility System. Questioned Costs – Not determinable. Context – This is a condition identified per review of DC Health’s compliance with specified requirements for eligibility using a statistically valid sample. Effect – The lack of a secondary review or maintenance of eligibility documents increases the risk of noncompliance with federal eligibility requirements, potentially leading to questioned costs. Cause – DC Health does not have a formal supervisory review process in place to verify the completeness and accuracy of eligibility determinations. Recommendation – We recommend that DC Health strengthen its existing policies and procedures by establishing a formal supervisory review process that includes a documented secondary review and approval of all eligibility files prior to participant enrollment. Additionally, we recommend that DC Health enhance its internal control procedures to ensure that all documentation supporting eligibility determinations is properly maintained in accordance with program requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DC Health concurs with the finding. The HIV/AIDS, Hepatitis, STD and TB Administration (HAHSTA) has done a preliminary assessment of the root cause and conditions that created the exceptions noted in the testing of eligibility samples. DC Health agrees that the infrequency of reviews and lack of documented secondary supervisory reviews are contributing factors. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-033 Prior Year Finding Number: N/A Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Health and Human Services HIV Care Formula Grants ALN: 93.917 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health (DC Health) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Matching States and territories (excluding Puerto Rico) with greater than one percent of the aggregate number of national cases of HIV/AIDS in the two-year period preceding the federal fiscal year in which the state is applying for a grant must, depending on the number of years in which this threshold requirement has been met, provide matching funds as follows (42 USC 300ff-27(d)): All recipients are subject to a matching requirement for ADAP supplemental funds in an amount equal to $1 for every $4 of federal funds (42 USC 300ff-28(a)(2)(F)(ii)(III)). Those recipients that are required to match the base formula funds may request and receive a waiver from this additional matching requirement. Level of Effort The state/territory will maintain HIV-related activities at a level that is equal to not less than the level of such expenditures by the state/territory for the one-year period preceding the fiscal year for which the state/territory is applying for RWHAP Part B funds (42 USC 300ff- 27(b)(7)(E)). Maintenance of Effort (MOE) requirement: The recipient must maintain non-federal funding for HIV-related activities at a level that is not less than the expenditures for such activities during the fiscal year prior to receiving the award (see Section 2617(b)(7)(E) of the PHS Act). Condition – DC Health did not provide the necessary documentation to support the computation of the required matching and level of effort amounts. As a result, we were unable to verify whether DC Health met the required thresholds or performed the appropriate calculations. Questioned Costs – Not determinable. Context – This is a condition identified per review of DC Health’s compliance with specified requirements. Effect – Without adequate internal controls to ensure proper documentation of the requirements, it may increase the risk that matching costs will be questioned. Cause – DC Health does not have adequate internal controls requiring the retention of documentation related to matching and level of effort compliance. Recommendation – We recommend that DC Health strengthen its policies and procedures to ensure that all matching contributions and level of effort requirements thresholds are properly documented. DC Health should ensure that detailed reconciliations, expenditure reports, and applicable source documents are maintained for audit purposes. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DC Health concurs with the finding. While DC Health reported match and level of effort expenditures in total, there was not sufficient documentation to distinguish 100% of the components of the match and LOE required. This detail included account-types/classifications, account numbers, allocation amounts and service areas needed to total the match and LOE requirements. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-034 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.430 Compensation – Personal Services: “Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the establish written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity’s laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable.” 2 CFR Section 200.430 (g): Standards for Documentation of Personnel Expenses. (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient; (iii) Reasonably reflect the total activity for which the employee is compensated by the recipient or subrecipient, not exceeding 100 percent of compensated activities; (iv) Encompass federally-assisted and all other activities compensated by the recipient or subrecipient on an integrated basis but may include the use of subsidiary records as defined in the recipient's or subrecipient's written policy; (v) Comply with the established accounting policies and procedures of the recipient or subrecipient; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition – We noted that the DBH allocated payroll expenditures to the Block Grants for Substance Use Prevention, Treatment and Recovery Services (SUPTRS) during fiscal year 2024 based on budgeted percentages. These percentages were entered into the PeopleSoft Human Resources/Payroll System (PeopleSoft) at the beginning of the fiscal year and were based on management’s estimate of the respective employee’s level of effort for each program. PeopleSoft calculated the payroll costs every payroll cycle for each employee and program based on the predetermined percentage, and reported it through the Labor Distribution Report (485 Report). However, management cannot provide supporting documentation regarding the periodic comparison of actual costs to the budgeted costs as required by 2 CFR Section 200.430. Specifically, 17 out of 60 sampled payroll items tested for the SUPTRS program were recorded based on estimated hours and not actual hours. For the other 43 sampled items, these individuals worked 100% of their time on SUPTRS, therefore, there is no possibility of error. Questioned Costs – Known amount is $43,235. Context – This is a condition identified per review of DBH’s compliance with specified requirements using a statistically valid sample. Payroll costs, including fringe benefits, for the SUPTRS program in fiscal year 2024 totaled $4,667,478. Effect – DBH was unable to demonstrate that the payroll expenditures charged to the SUPTRS program accurately reflected the actual time incurred on the program and such expenditures were properly supported in accordance with 2 CFR Section 200.430, Compensation – Personal Services. Cause – DBH does not have policies and procedures in place to review and reconcile the estimated amount of payroll expenditures charged to the SUPTRS Program to the actual expenditures incurred. Recommendation – We recommend that DBH deploy policies and procedures to periodically compare employees’ estimated hours per the 485 Report to the actual hours incurred, and make any necessary adjustments as required by 2 CFR Section 200.430. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH agrees with the findings and will put controls in place to resolve the issue. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-035 Prior Year Finding Number: N/A Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Earmarking requirement: a) The state shall expend not less than 20 percent of Substance Use Prevention, Treatment and Recovery Services Block Grant (SUPTRS BG) for primary prevention programs for individuals who do not require treatment for Substance Use Disorder (SUD). The programs should educate and counsel the individuals on such SUD and provide for activities to reduce the risk of such SUD by the individuals (42 USC 300x-22; 45 CFR Sections 96.124 (b)(1) and 96.125). b) Designated states (i.e., any state whose cases of Acquired Immunodeficiency Syndrome (AIDS) is 10 or more per 100,000 individuals (as indicated by the number of such cases reported to and confirmed by the Centers for Disease Control and Prevention for the most recent calendar year for which data are available)), shall expend not less than two percent and not more than five percent of the award amount to carry out one or more projects to make available to individuals early intervention services for HIV disease (EIS HIV) at the sites where the individuals are undergoing SUD treatment. c) The state may not expend more than five percent of the grant to pay the costs of administering the grant (42 USC 300x-31; 45 CFR Section 96.135 (b)(1)). Condition – DBH did not provide the necessary documentation to support compliance with earmarking requirements as described above. As a result, we were unable to verify whether DBH met the required thresholds. Questioned Costs – Not determinable. Context – This is a condition identified per review of DBH’s compliance with earmarking requirements. Effect – Without adequate internal controls to ensure proper documentation of the requirements, it may increase the risk that earmarking requirements may not be met. Cause – DBH does not have adequate internal controls requiring the retention of documentation related to earmarking compliance requirements. Recommendation – We recommend that DBH strengthen its policies and procedures to ensure that all earmarking requirements thresholds are properly documented. DBH should ensure that detailed reconciliations, expenditure reports, and applicable source documents are maintained for audit purposes. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-036 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Subrecipient expenditures, totaling approximately $1.1 million, which are required to be presented in the Schedule of Expenditures of Federal Awards (SEFA), were improperly excluded from the initial SEFA prepared by management. Subsequently, the SEFA was adjusted by DBH to reflect the subrecipient expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – DBH did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that DBH adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Homeland Security Homeland Security Grant Program ALN: 97.067 Award #: EMW-2021-SS-00078-S01, EMW-2022-SS-00084-S01, EMW-2023-SS-00056-S01 Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Homeland Security and Emergency Management Agency (HSEMA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – For all nine (9) first tier subawards samples selected for FFATA testing, we noted that HSEMA failed to provide evidence that it reported the subaward information through the FSRS or sam.gov website to fulfill the FFATA requirements. Questioned Costs – None. Context – This is a condition identified per review of HSEMA’s compliance with reporting requirements using a statistically valid sample. Effect – Failure to properly submit the FFATA report results in noncompliance for the Homeland Security Grant program. Cause – HSEMA did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that HSEMA evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – HSEMA concurs that the subaward reporting required by FFATA is not currently complete and up to date in sam.gov website. Due to the transition to sam.gov and the FSRS system being terminated, the record of prior FFATA reports submitted that encountered errors and were left in partially complete status is no longer retrievable from the FSRS system to demonstrate that the report had been submitted. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-022 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Child Care and Development Fund Cluster ALN: 93.575, 93.596 Award #: 2401DCCDD; 2101DCCDC6 Award Years: 10/01/2023 – 09/30/2026 10/01/2020 – 09/30/2024 Government Department/Agency: Office of the State Superintendent of Education (OSSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – For one (1) subaward sample selected for FFATA testing, we noted that OSSE failed to provide evidence that it reported the subaward information through the FSRS or sam.gov website to fulfill the FFATA requirements. Questioned Costs – None. Context – This is a condition identified per review of OSSE’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report results in noncompliance for the Child Care and Development Block Grant program. Cause – OSSE did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that OSSE evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – OSSE concurs with the auditor’s finding and recommendations related to this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-027 Prior Year Finding Number: 2023-032 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CRF Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CRF Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CRF Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CRF Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination totaling 283,898 total population during the fiscal year 2024 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exception: • For three (3) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-027 Prior Year Finding Number: 2023-032 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2023 – 09/30/2024 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CRF Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CRF Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CRF Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CRF Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination totaling 283,898 total population during the fiscal year 2024 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exception: • For three (3) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-034 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.430 Compensation – Personal Services: “Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the establish written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity’s laws and/or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable.” 2 CFR Section 200.430 (g): Standards for Documentation of Personnel Expenses. (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient; (iii) Reasonably reflect the total activity for which the employee is compensated by the recipient or subrecipient, not exceeding 100 percent of compensated activities; (iv) Encompass federally-assisted and all other activities compensated by the recipient or subrecipient on an integrated basis but may include the use of subsidiary records as defined in the recipient's or subrecipient's written policy; (v) Comply with the established accounting policies and procedures of the recipient or subrecipient; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into the records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after-the-fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. Condition – We noted that the DBH allocated payroll expenditures to the Block Grants for Substance Use Prevention, Treatment and Recovery Services (SUPTRS) during fiscal year 2024 based on budgeted percentages. These percentages were entered into the PeopleSoft Human Resources/Payroll System (PeopleSoft) at the beginning of the fiscal year and were based on management’s estimate of the respective employee’s level of effort for each program. PeopleSoft calculated the payroll costs every payroll cycle for each employee and program based on the predetermined percentage, and reported it through the Labor Distribution Report (485 Report). However, management cannot provide supporting documentation regarding the periodic comparison of actual costs to the budgeted costs as required by 2 CFR Section 200.430. Specifically, 17 out of 60 sampled payroll items tested for the SUPTRS program were recorded based on estimated hours and not actual hours. For the other 43 sampled items, these individuals worked 100% of their time on SUPTRS, therefore, there is no possibility of error. Questioned Costs – Known amount is $43,235. Context – This is a condition identified per review of DBH’s compliance with specified requirements using a statistically valid sample. Payroll costs, including fringe benefits, for the SUPTRS program in fiscal year 2024 totaled $4,667,478. Effect – DBH was unable to demonstrate that the payroll expenditures charged to the SUPTRS program accurately reflected the actual time incurred on the program and such expenditures were properly supported in accordance with 2 CFR Section 200.430, Compensation – Personal Services. Cause – DBH does not have policies and procedures in place to review and reconcile the estimated amount of payroll expenditures charged to the SUPTRS Program to the actual expenditures incurred. Recommendation – We recommend that DBH deploy policies and procedures to periodically compare employees’ estimated hours per the 485 Report to the actual hours incurred, and make any necessary adjustments as required by 2 CFR Section 200.430. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH agrees with the findings and will put controls in place to resolve the issue. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-035 Prior Year Finding Number: N/A Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Earmarking requirement: a) The state shall expend not less than 20 percent of Substance Use Prevention, Treatment and Recovery Services Block Grant (SUPTRS BG) for primary prevention programs for individuals who do not require treatment for Substance Use Disorder (SUD). The programs should educate and counsel the individuals on such SUD and provide for activities to reduce the risk of such SUD by the individuals (42 USC 300x-22; 45 CFR Sections 96.124 (b)(1) and 96.125). b) Designated states (i.e., any state whose cases of Acquired Immunodeficiency Syndrome (AIDS) is 10 or more per 100,000 individuals (as indicated by the number of such cases reported to and confirmed by the Centers for Disease Control and Prevention for the most recent calendar year for which data are available)), shall expend not less than two percent and not more than five percent of the award amount to carry out one or more projects to make available to individuals early intervention services for HIV disease (EIS HIV) at the sites where the individuals are undergoing SUD treatment. c) The state may not expend more than five percent of the grant to pay the costs of administering the grant (42 USC 300x-31; 45 CFR Section 96.135 (b)(1)). Condition – DBH did not provide the necessary documentation to support compliance with earmarking requirements as described above. As a result, we were unable to verify whether DBH met the required thresholds. Questioned Costs – Not determinable. Context – This is a condition identified per review of DBH’s compliance with earmarking requirements. Effect – Without adequate internal controls to ensure proper documentation of the requirements, it may increase the risk that earmarking requirements may not be met. Cause – DBH does not have adequate internal controls requiring the retention of documentation related to earmarking compliance requirements. Recommendation – We recommend that DBH strengthen its policies and procedures to ensure that all earmarking requirements thresholds are properly documented. DBH should ensure that detailed reconciliations, expenditure reports, and applicable source documents are maintained for audit purposes. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2024-036 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2024; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Condition – Subrecipient expenditures, totaling approximately $1.1 million, which are required to be presented in the Schedule of Expenditures of Federal Awards (SEFA), were improperly excluded from the initial SEFA prepared by management. Subsequently, the SEFA was adjusted by DBH to reflect the subrecipient expenditures incurred for the program. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – DBH did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that DBH adhere to instituted policies and procedures to ensure the accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.