Audit 369219

Federal Agency: United States Department of Agriculture (USDA) Federal Program: 10.553 School Breakfast Program 2022 - 223MO304N1099 2023 - 233MO304N1099 2024 - 243MO304N1099 10.555 COVID-19 - National School Lunch Program 2020 - 203MO531N8503 10.555 National School Lunch Program 2022 - 223MO304N1099 2023 - 233MO304N1099 2024 - 243MO304N1099 10.556 Special Milk Program for Children 2022 - 223MO304N1099 2023 - 233MO304N1099 2024 - 243MO304N1099 10.582 Fresh Fruit and Vegetable Program 2022 - 223MO375L1903 2023 - 233MO375L1903 2024 - 243MO375L1903 State Agency: Department of Elementary and Secondary Education (DESE) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirement: Reporting As similarly noted in our 3 previous audits, during state fiscal year 2024, the DESE did not comply with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for any of the 1,398 first-tier subawards, totaling approximately $330 million, for the Child Nutrition Cluster programs administered by the DESE. First-tier subaward payments accounted for 84 percent of the DESE Child Nutrition Cluster expenditures. The DESE needs to strengthen internal controls related to FFATA reporting for the Child Nutrition Cluster to help ensure compliance with the reporting requirements. The FFATA requires comprehensive reporting for certain federal awards to promote transparency and accountability over the use of the federal funds. Regulation 2 CFR Part 170, Appendix A, requires the DESE to report first-tier subawards of $30,000 or more to the FFATA Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward was made. Information entered into the FSRS is publicly available at USASpending.gov. FFATA reporting The DESE did not comply with FFATA reporting requirements for the Child Nutrition Cluster. DESE personnel did not report any of the 1,398 first-tier subawards, totaling approximately $330 million, requiring FFATA reporting during state fiscal year 2024, in the FSRS. After we brought this to their attention, DESE personnel began the process of preparing and submitting the FFATA reports. DESE personnel indicated the FFATA reporting errors occurred due to an oversight. In addition to noncompliance with federal requirements, not reporting subawards to the FSRS accurately and timely increases the risk that those using the reports could rely on incomplete information. Internal controls During state fiscal year 2024, DESE personnel did not ensure the Child Nutrition Cluster FFATA information was prepared and uploaded to the FSRS. The DESE's FFATA reporting policies and procedures require the Chief Operating Officer (COO) to verify information is accurately uploaded to the FSRS. The COO delegated these duties for some programs to various program liaisons within the DESE. For state fiscal year 2024, the Child Nutrition Cluster FFATA reporting responsibilities were delegated to the Nutrition Finance Manager and the Food and Nutrition Services Coordinator. The Nutrition Finance Manager was responsible for preparing the FFATA reporting information and the Food and Nutrition Services Coordinator was responsible for reviewing and uploading the information to the FSRS. However, as previously noted, the required FFATA reporting was not performed for the Child Nutrition Cluster programs administered by the DESE during the state fiscal year 2024. None of the individuals responsible ensured this information was prepared and uploaded to the FSRS. Adherence to policies and procedures is necessary to ensure FFATA reporting is completed accurately and timely. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DESE complete FFATA reporting in accordance with the applicable requirements and strengthen internal controls to ensure information is accurately uploaded to the FSRS for the Child Nutrition Cluster. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: United States Department of Agriculture (USDA) Federal Program: 10.558 Child and Adult Care Food Program (CACFP) 2022, 2023, 2024 - CACFP 2022, 2023, 2024 - CACFP-CIL 2023 and 2024 - CACFP-SPON State Agency: Department of Health and Senior Services (DHSS) - Bureau of Community Food and Nutrition Assistance (BCFNA) Type of Finding: Internal Control (Material Weakness) and Material Noncompliance Questioned Costs: $0 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Subrecipient Monitoring As noted in our previous audit, during the year ended June 30, 2024, the BCFNA did not have sufficient controls and procedures to ensure CACFP reimbursements to subrecipients were allowable and supported with sufficient documentation, as required by federal regulations. As a result, significant unallowable and unsupported reimbursements were made without being prevented or detected timely. The BCFNA administers the CACFP through contracts with child and adult care centers and sponsors of centers (subrecipients) that provide meals to eligible children and adults under their care. The facilities/sponsors determine eligibility of each participant for free or reduced price meals, and are reimbursed at fixed rates for the number and type of meals served. During the year ended June 30, 2024, the BCFNA paid over 780 facilities/sponsors approximately $67.6 million for meal services. Disbursements to facilities/sponsors represented approximately 98 percent of the program's expenditures. To receive reimbursement for meals provided to eligible participants, CACFP facilities/sponsors submit monthly claims through the CNPWeb (CNP) claim system. The CNP system has edit checks to prevent and detect certain claim errors, such as meal claims that exceed facility/sponsor total enrollment and/or license capacity, or claims for types of meals the facility/sponsor was not approved to serve. Claims that pass the edit checks are reviewed by a BCFNA Public Health Program Associate, while claims that do not pass the edit checks are returned to the facility/sponsor for revision. Facilities/sponsors are not required to provide supporting documentation with their claim but are required to maintain and retain detailed records, including meal count, attendance, enrollment and eligibility determination records, receipt slips, menus, and other documentation to support meals claimed. Facility/sponsor records are maintained on a monthly basis, thus reviews or verifications of those records generally cover the entire month as opposed to a shorter period of time. BCFNA nutritionists perform periodic monitoring reviews of the facilities/sponsors and disallow costs associated with claim errors identified. These reviews have identified significant issues and claim errors, including some potentially fraudulent activity, and led to over 15 contract terminations in recent years. Since meal reimbursements are made without any supporting documentation, the BCFNA relies on system edit checks and subrecipient monitoring procedures to prevent and detect meal reimbursement claim errors. However, these edits and procedures alone were not sufficient to prevent and detect unallowable and unsupported meal reimbursement claims on a timely basis. The BCFNA has not implemented procedures to review supporting documentation, on a test basis, except for testing performed during routine monitoring reviews generally conducted once every 1 to 3 years for each facility/sponsor, and technical assistance reviews performed at the request of the facility/sponsor. Additionally, as noted in finding number 2024-009, weaknesses in the BCFNA monitoring procedures and noncompliance with subrecipient monitoring requirements were identified. Our review of documentation supporting a randomly-selected sample of 60 BCFNA monitoring reviews conducted for 60 CACFP facilities/sponsors during the year ended June 30, 2024, noted BCFNA disallowances (overclaims/underclaims) in 43 of 59 (73 percent) reviews for which meal reimbursement claims were tested. Overclaims totaled $48,508 (40 reviews) and underclaims totaled $10,144 (3 reviews), with a net overclaim of $38,364, or at least 7 percent of claims tested by the BCFNA. Disallowances resulted from various errors including incorrect or unsupported eligibility determinations, meal counts, attendance records, or noncompliance associated with menus and food purchases. The BCFNA adjusted subsequent claims to recoup or reimburse for the identified overclaims/underclaims. Erroneous and unsupported reimbursements represent at least 7 percent of meal reimbursements tested. If similar errors were made on the remaining population of CACFP meal reimbursements totaling approximately $67 million, unallowable costs could be significant. Without sufficient controls to ensure the accuracy of facility/sponsor meal reimbursement claims, the BCFNA cannot demonstrate adequate internal controls to ensure CACFP costs are allowable and supported, and the risk of paying unsupported and unallowable claims will continue. Regulation 7 CFR Section 226.7(k) requires the BCFNA to establish procedures for institutions to properly submit claims for reimbursement. Such procedures must include edit checks, including but not limited to, ensuring payments are made only for approved meal types and that the number of meals for which reimbursement is provided does not exceed the product of the total enrollment times operating days times approved meal types. Regulation 2 CFR Section 200.403 (within 2 CFR Part 200, known as the Uniform Guidance), provides that costs charged to federal programs should be necessary and reasonable for the performance of the federal award and adequately documented. Furthermore, 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing that Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." The DHSS Summary Schedule of Prior Audit Findings for prior audit finding number 2023-012, submitted in July 2025, states the DHSS disagreed with the finding and did not take corrective action. However, an April 2025 email from a USDA - Food and Nutrition Service (USDA-FNS) official to the DHSS regarding the prior audit finding, provided to auditors by DHSS officials, indicates some corrective action was taken. The email states to prevent overclaims, the USDA-FNS expects the BCFNA to have internal controls that focus on the areas of subrecipient screening during the application process and training; and the USDA-FNS validated the DHSS's actions to improve internal control processes in these specific areas. The April 2025, USDA-FNS email also states the prior audit finding was not sustained by the FNS because (1) the FNS does not require or expect the BCFNA to validate claims at the time of claim submission, and (2) the BCFNA was in compliance with edit check requirements. While the prior audit finding neither recommended the BCFNA validate claims at the time of submission nor noted noncompliance with edit check requirements, it did recommend the BCFNA strengthen internal controls over meal reimbursements, such as those recommended and validated by the USDA-FNS. Finding classification This finding is classified as a material weakness in internal control and material noncompliance with the federal activities allowed, allowable costs, and subrecipient monitoring requirements. The noncompliance identified in the finding is material based on the results of our audit sample, which identified at least 7 percent of subrecipient meal reimbursements tested by the BCFNA were not in compliance with federal requirements. The 7 percent error rate exceeds our audit materiality threshold of 4 percent. While the errors identified in the finding were corrected, similar material noncompliance in the remainder of the payments not tested is likely. Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits, and the AICPA Audit Guide: Government Auditing Standards and Single Audits (Audit Guide). The Audit Guide provides the following definitions regarding internal control deficiencies: "A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis." "A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis." "A reasonable possibility exists when the likelihood of the event is either reasonably possible or probable …" Reasonably possible is "[t]he chance of the future event or events occurring is more than remote but less than likely." Probable means "[t]he future event or events are likely to occur." The failure to design and implement adequate controls and procedures to ensure CACFP reimbursements to subrecipients are allowable and supported led to material noncompliance with the applicable requirements. The BCFNA's controls failed to prevent the material noncompliance identified. While the BCFNA's controls detected and corrected the payment errors identified, the detection and correction was not timely, occurring up to 3 years after the payments were made. Also, the detection and correction was limited to only 1 test month per subrecipient without any attempt to identify and correct noncompliance that occurred beyond the test month because, as noted at finding number 2024-009, the BCFNA's controls do not provide for expanded testing when significant errors are identified. Therefore, similar, material noncompliance in the remainder of the payments not tested is likely. Further, because the internal control deficiencies have not been corrected, similar, material noncompliance in future payments is likely. For these reasons, the deficiencies are considered a material weakness. Recommendation The DHSS through the BCNFA continue to strengthen internal controls over meal reimbursements to CACFP facilities/sponsors to ensure costs are allowable and supported. Auditee's Response We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement. Auditor's Comment The DHSS Corrective Action Plan (CAP) states the DHSS disagrees with the finding and believes no corrective action is required because the prior year finding (finding number 2023-012) was not sustained by the USDA-FNS. However, as noted in the finding, an April 2025 email from a USDA-FNS official to the DHSS regarding the prior audit finding indicates some corrective action was made and validated by the USDA-FNS. Such corrective action was made after the current (fiscal year 2024) audit period. As noted in the finding, the prior audit finding recommended the BCFNA strengthen internal controls over meal reimbursements, such as those recommended and validated by the USDA-FNS. While the DHSS did not provide the State Auditor's Office information regarding the corrective action taken, any new procedures would have been implemented after the audit period, and will be subject to subsequent audits. Because the DHSS took no corrective action prior to or during the audit period, this finding is valid.

Federal Agency: United States Department of Agriculture (USDA) Federal Program: 10.558 Child and Adult Care Food Program (CACFP) 2022, 2023, 2024 - CACFP 2022, 2023, 2024 - CACFP-CIL 2023 and 2024 - CACFP-SPON State Agency: Department of Health and Senior Services (DHSS) - Bureau of Community Food and Nutrition Assistance (BCFNA) Type of Finding: A - Internal Control (Significant Deficiency) and Nonmaterial Noncompliance B - Internal Control (Material Weakness) and Material Noncompliance Questioned Costs: Unknown Compliance Requirement: Subrecipient Monitoring As noted in our previous audit, during the year ended June 30, 2024, BCFNA subrecipient risk assessment and monitoring procedures were not in compliance with subrecipient monitoring requirements and were not sufficient to ensure CACFP subrecipient compliance with program requirements. During the year ended June 30, 2024, the BCFNA disbursed approximately $67.6 million to over 780 CACFP subrecipients, which consist of child and adult care centers and sponsors of centers. Disbursements to subrecipients represented approximately 98 percent of the program's expenditures. As part of its pass-through responsibilities, 7 CFR Section 226.6(a)(5), the BCFNA is required to ensure subrecipients effectively operate the program. Regulation 2 CFR Section 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Regulation 2 CFR Section 200.332(d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. The BCFNA's subrecipient monitoring process, outlined in the Internal Nutritionist Manual, provides the requirements for monitoring the CACFP facilities/sponsors. The manual provides the planned frequency and type of monitoring activities, monitoring methods, and corrective action requirements. The manual requires the preparation of a risk assessment at the end of each monitoring review that assigns a grade of A, B, B-, or C to the facility/sponsor based on the number and severity of deficiencies and findings. Facilities/sponsors that receive a C grade are determined to be "seriously deficient." The assigned grade determines the required timing of future monitoring reviews of the facility/sponsor. Facilities/sponsors with an A grade will be next monitored in 3 years, a B grade within 2 years, a B- grade within 6 months to 1 year, and a C grade within 90 days. During each monitoring review, BCFNA personnel review documentation supporting a sample of claims during a test month. Any identified errors and associated overclaims/underclaims exceeding established thresholds are recouped/reimbursed in the facility's/sponsor's future claims. When reviews identify noncompliance, facilities/sponsors are required to prepare and submit a Corrective Action Plan (CAP) to the BCFNA. In addition, as noted at finding number 2024-008, the BCFNA relies on these subrecipient monitoring procedures to prevent and detect meal reimbursement claim errors. Monitoring reviews have identified significant issues and claim errors, including some potentially fraudulent activity, and led to over 15 contract terminations in recent years. To test compliance with subrecipient monitoring requirements, and to evaluate the effectiveness of BCFNA monitoring procedures, we reviewed and analyzed a randomly-selected sample of 60 BCFNA monitoring reviews conducted for 60 CACFP facilities/sponsors during the year ended June 30, 2024. While our review found the sample monitoring reviews were performed in accordance with the policies and procedures outlined in the Internal Nutritionist Manual, we identified areas in which these policies and procedures could be strengthened and improved to ensure facilities/sponsors comply with program requirements and submit proper claims. Our review and analysis of the 60 sampled monitoring reviews noted the monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims. Our comparison of the sampled reviews to prior reviews noted deficient facilities/sponsors generally had continued deficiencies and little improvement from prior reviews, as follows: • Of the 60 sampled, 32 facilities/sponsors received an A grade, while 28 received grades of B, B-, or C. • Of the 24 facilities/sponsors that received grades of B, B-, or C, and had a prior review, 21 (88 percent) received the same or lower grade than the prior review. • Of the 4 facilities/sponsors that received a C grade and had a prior review, 2 (50 percent) received the same grade as the prior review, and 2 (50 percent) received a lower grade. • Of the 7 facilities/sponsors that received a C grade, 4 were terminated as a result of the review or as a result of a subsequent 90-day follow-up review. • For 43 of 59 (73 percent) monitoring reviews for which the BCFNA tested claims (with claims totaling $537,466 during the test months), the BCFNA identified overclaims totaling $48,508 and underclaims totaling $10,144, netting to $38,364, or at least 7 percent of the reimbursements tested. A. Risk Assessments The BCFNA prepares and uses risk assessments to determine the extent of monitoring necessary for each facility/sponsor. However, the risk assessments prepared during the year ended June 30, 2024, considered only the previous monitoring review grade (conducted up to 3 years previously), and did not consider other pertinent risk factors outlined in federal regulations. Regulation 2 CFR Section 200.332(b) suggests risk assessments should consider the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially-changed systems, and the extent and results of federal awarding agency monitoring. While federal regulations provide the BCFNA discretion in selecting risk factors to consider, limiting risk assessments to only one risk factor and ignoring other relevant factors hinders the BCFNA's ability to identify red flags and fraud risk factors and properly assess facility/sponsor risk of noncompliance. Sufficient risk assessments are necessary to ensure monitoring reviews are conducted with adequate frequency to help ensure subrecipient compliance with program requirements. Finding classification This finding is classified as a significant deficiency in internal control and nonmaterial noncompliance with the federal subrecipient monitoring requirements regarding risk assessments. As noted in the finding, BCFNA risk assessments prepared during the year ended June 30, 2024, do not meet the spirit of the federal regulation, which suggests the extent and level of monitoring for each subrecipient be based on various risk factors. As a result, there is a risk that monitoring reviews will not be performed as frequently and thoroughly as needed to identify and address subrecipient noncompliance. Because the BCFNA does perform risk assessments for each subrecipient and does monitor the subrecipients with lower grades with more frequency, the finding did not rise to a level of material noncompliance, and was therefore considered nonmaterial noncompliance. Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits and the AICPA Audit Guide: Government Auditing Standards and Single Audits (Audit Guide). In addition to the definitions outlined in part B of this finding, the Audit Guide states "[a] significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with a type of compliance requirement of a federal program that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance." Our evaluation of the deficiencies for the possibility and magnitude of potential noncompliance determined the deficiencies are considered a significant deficiency. B. Subrecipient Monitoring Procedures Our review of BCFNA subrecipient monitoring procedures during the year ended June 30, 2024, noted areas that should be strengthened and improved. Corrective action plans BCFNA CAP review procedures were not adequate to ensure facilities/sponsors made and/or planned sufficient corrective actions to address noncompliance, as required by federal regulations. The Internal Nutritionist Manual requires nutritionists to review subrecipient CAPs outlining corrective actions taken or planned for completeness and to ensure the required action items are adequately addressed. However, during the year ended June 30, 2024, this review was generally performed without verifying the accuracy of the CAP information through review of supporting documentation, testing, or other methods. The BCFNA did not require submission of supporting documentation of corrective actions taken or planned. BCFNA officials indicated they may request supporting documentation on occasion depending on the complexity of the finding, and they verify the CAP during 90-day follow-up reviews of "seriously deficient" facilities/sponsors. Of the 60 monitoring reviews in our sample, 49 required a CAP. The monitoring review documentation indicated the CAP was verified during 7 of the 90-day follow-up reviews, but there was no documentation that the nutritionist verified the CAP information for any of the remaining 42 reviews (86 percent of the 49 reviews that required a CAP). Furthermore, our review of monitoring review documentation noted numerous instances in which the prior year CAP indicated a specific deficiency was addressed, but the same deficiency was again noted in the subsequent review. Regulation 2 CFR Section 200.332(d) provides that monitoring must include following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies identified. The USDA CACFP handbook, Monitoring Handbook for State Agencies (USDA Monitoring Handbook), provides that follow-up reviews (on-site or desk reviews of paperwork) may be conducted any time corrective action is required to ensure the facility/sponsor has completely corrected the review findings, according to its approved corrective action response. Example CAP forms included in the USDA Handbook require facilities/sponsors to submit supporting documentation along with the CAP to verify corrections were made or will be implemented. The USDA CACFP handbook, Serious Deficiency, Suspension, & Appeals for State Agencies & Sponsoring Organizations, provides that facilities/sponsors deemed "seriously deficient," must submit additional supporting documentation with the CAP to document that corrective actions have occurred; this might include copies of income eligibility forms, enrollment rosters, staff training documentation, site monitoring reports, menus, child nutrition labels or manufacturers' product analysis sheets or recipes, attendance records, meal count forms, and itemized food receipts. Without verifying information in CAPs submitted, the BCFNA cannot demonstrate compliance with federal regulations and it lacks assurance the facilities/sponsors took timely and appropriate action on all deficiencies identified during monitoring reviews. In addition, there is increased risk that deficiencies will not be corrected and will continue without detection. In August 2024, the BCFNA implemented an electronic system for facilities/sponsors to upload documentation supporting their CAPs. In May 2025, the BCFNA updated the Internal Nutritionist Manual to provide for reviews of the supporting documentation to verify facilities/sponsors implemented corrective action. Claims testing The Internal Nutritionist Manual and monitoring practices provide for testing of a sample of claims within only 1 test month during each monitoring review, and do not provide for expanded testing when significant errors are identified. BCFNA personnel indicated monitoring reviews are limited to only 1 test month because the USDA Monitoring Handbook does not require expanded testing of records beyond 1 month. While the BCFNA performs additional testing during 90-day follow-up reviews for facilities/sponsors deemed "seriously deficient," additional testing is not performed in any other situation. For example, one facility had a 33 percent overpayment rate and received a B grade while another facility had a 100 percent overpayment rate and received a B- grade; however, additional testing was not performed for either facility. The USDA Monitoring Handbook suggests testing activities during 1 test month, and also suggests the state agency may determine additional review is warranted and review records beyond the test month to determine the extent of the noncompliance. When significant errors are identified, additional testing would help BCFNA nutritionists determine the extent that instances of noncompliance are isolated versus pervasive. Such information would be valuable to the overall conclusions and grade assigned to the review, and in decisions regarding subsequent monitoring. Overclaim recoupment BCFNA subrecipient monitoring procedures do not provide for identification and pursuit of recoupment of all overpayments associated with errors identified during monitoring reviews. When overclaims due to noncompliance with eligibility requirements are identified during monitoring reviews, the BCFNA only identifies and seeks recoupment for the overclaims made during the test month. Overclaims associated with eligibility errors begin at the time the eligibility determination was made and continue until the error is discovered. Although the BCFNA is aware noncompliance occurred during the month(s) before the test month, the BCFNA does not attempt to identify those overclaims. In addition, when a facility/sponsor is terminated, the BCFNA does not always identify or seek recoupment of overclaim amounts. In our sample of 60 monitoring reviews, the contract for 1 sponsor was terminated as a result of a 90-day follow-up review. For this sponsor, in the review prior to the 90-day follow-up review, the BCFNA identified and recouped overclaims totaling $2,278, or 100 percent of total claims tested. In the subsequent 90-day follow-up review significant claim errors were identified in the test month claims, which totaled $1,961; however, the test month claims were not fully tested, and overclaims were not identified or recouped. Any overclaims not identified and recouped from this terminated sponsor would be considered questioned costs; however, those questioned costs are unknown. BCFNA officials indicated they do not pursue recoupment of overclaims beyond the test month because this practice is allowed by the USDA. They indicated they pursue recoupment of overclaims for facilities/sponsors with terminated contracts on a case-by-case basis, considering various factors. However, 7 CFR Section 226.14 provides that state agencies shall disallow and recover any portion of a claim for reimbursement not properly payable, including claims not made in accordance with recordkeeping requirements. Pursuing full recoupment would hold facilities/sponsors accountable for all overclaims and would serve as a deterrent to future errors, noncompliance, and overclaims. Furthermore, without procedures to identify and recoup all overclaims, there is a risk that significant overclaims will go undetected and unrecouped, and questioned costs could be significant. Conclusions In addition to complying with federal requirements, strong subrecipient monitoring procedures are necessary to ensure facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. Without strong internal controls, there is increased risk of noncompliance, errors, fraud, waste, and abuse of federal funds. Strong monitoring procedures would ensure facilities/sponsors are held accountable for, and correct, errors and noncompliance identified. Regulation 2 CFR Section 200.332(g) requires pass-through entities to consider whether the results of the subrecipient's audits, on-site reviews, or other monitoring indicate conditions that necessitate adjustments to the pass-through entity's own records. Furthermore, 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing that Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Finding classification This finding is classified as a material weakness in internal control and material noncompliance with the federal subrecipient monitoring requirements. Our audit of the BCFNA's compliance with federal subrecipient monitoring requirements concluded the BCFNA did not materially comply with federal requirements to ensure subrecipients effectively operate the CACFP and to monitor the activities of the subrecipient as necessary to ensure the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. This conclusion is based on the facts, deficiencies, and noncompliance stated in the finding, including the following: (1) Disbursements to subrecipients represented approximately 98 percent of the CACFP expenditures. (2) BCFNA subrecipient monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims; and deficiencies identified often continued for years with little improvement from review to review. The 7 percent subrecipient payment error rate identified by the BCFNA, which exceeds our audit materiality threshold of 4 percent, along with the high rate of continued noncompliance, serve as indicators of the ineffectiveness of the BCFNA monitoring process. (3) The BCFNA did not comply with specific components of federal subrecipient monitoring requirements, including properly following up and ensuring subrecipients take timely and appropriate action on all deficiencies identified and disallowing and recovering improper payments. (4) Multiple deficiencies in monitoring procedures were identified, including the previously-listed deficiencies and inadequate payment testing. In conducting a single audit in accordance with 2 CFR Part 200 (Uniform Guidance), auditors are required by 2 CFR Section 200.514(d)(1)(2), to determine whether the auditee has complied with federal statutes, regulations, and the terms and conditions of federal awards that may have a direct and material effect on each of its major programs, as outlined in the OMB Compliance Supplement. While compliance with the USDA CACFP handbooks was considered in the our audit, our conclusion on compliance is based on the BCFNA's compliance with the federal statutes and regulations, as required. Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits and the Audit Guide. The Audit Guide provides the following definitions regarding internal control deficiencies: A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis. "A reasonable possibility exists when the likelihood of the event is either reasonably possible or probable…" Reasonably possible is "[t]he chance of the future event or events occurring is more than remote but less than likely." Probable means "[t]he future event or events are likely to occur." The failure to design and implement adequate controls and procedures over subrecipient monitoring led to material noncompliance with the subrecipient monitoring requirements. The BCFNA's controls failed to develop an effective subrecipient monitoring process that ensures subrecipients use subawards for authorized purposes, comply with the terms and conditions of the subawards, and achieve performance goals. Because the internal control deficiencies have not been corrected, it is probable that the material noncompliance will continue. For these reasons, the deficiencies are considered a material weakness. Recommendations The DHSS through the BCFNA: A. Implement a CACFP subrecipient risk assessment process that is consistent with federal regulations. B. Review, strengthen, and enforce subrecipient monitoring procedures to ensure CACFP facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. The BCFNA should enhance procedures to provide for identification and recoupment of overclaims associated with all errors identified during monitoring reviews, as required by federal regulations; expand testing when significant errors are identified; and continue to verify CAP information. The DHSS should identify and recoup the overclaims for the terminated sponsor noted in this finding. Auditee's Response A. We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement. B. We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement. Auditor's Comment The DHSS Corrective Action Plan (CAP) states the DHSS disagrees with the finding because, while the prior year finding (finding number 2023-013) was partially sustained by the USDA - Food and Nutrition Service (USDA-FNS), a corrective action plan was accepted and deemed adequate by the USDA-FNS. The CAP also states in April 2025, the USDA-FNS recommended final action to close the prior year finding. These statements are not accurate. April and June 2025 emails from USDA-FNS officials to the DHSS regarding the prior audit finding, provided to auditors by DHSS officials, indicate the finding was sustained; corrective action was required, taken, and validated by the USFA-FNS; and final action was approved by the USDA-FNS on June 10, 2025. It is unclear why the DHSS considers the prior year finding to be only partially sustained when the Summary Schedule of Prior Audit Findings, which was also prepared by the DHSS, states the finding was sustained. Except for the information mentioned in the audit finding regarding subrecipient corrective action plans, the DHSS did not provide the State Auditor's Office information regarding corrective action taken. Any new procedures would have been implemented after the audit period, and will be subject to subsequent audits. Because the DHSS took no corrective action prior to or during the audit period, this finding is valid.

Federal Agency: Department of Labor (DOL) Federal Program: 17.258 WIOA Adult Program 2023 - 23A55AT000005 17.259 WIOA Youth Activities 2023 - 23A55AY000048 17.278 WIOA Dislocated Worker Formula Grants 2023 - 23A55AW000007 State Agency: Department of Higher Education and Workforce Development (DHEWD) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirement: Reporting The DHEWD needs to strengthen internal controls related to Federal Funding Accountability and Transparency Act (FFATA) reporting for the Workforce Innovation and Opportunity Act (WIOA) Cluster. During state fiscal year 2024, the DHEWD did not comply with FFATA reporting requirements for 4 of 10 subawards reviewed. During state fiscal year 2024, the DHEWD disbursed approximately $26.3 million in first-tier subawards to 13 subrecipients (local workforce development boards) of the WIOA Cluster. First-tier subaward payments accounted for approximately 80 percent of the program's expenditures. The FFATA requires comprehensive reporting for certain federal awards to promote transparency and accountability over the use of the federal funds. Regulation 2 CFR Part 170, Appendix A, requires the DHEWD to report first-tier subawards of $30,000 or more to the FFATA Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward was made. Information entered into the FSRS is publicly available at USASpending.gov. On a monthly basis, DHEWD procedures provide that DHEWD personnel download information pertaining to subrecipient awards from the DHEWD document system, filter the information to identify subawards that require FFATA reporting, enter the information into a spreadsheet, upload the data to the FSRS, notify the supervisor, and subsequently verify the entry appears at USASpending.gov. Various subaward data is uploaded to the FSRS, including the entity name, award amount, and the date issued. DHEWD procedures also require DHEWD personnel record on the spreadsheet the date of FSRS entry and the date the entry was verified at USASpending.gov. Internal controls The DHEWD's policies and procedures over the FFATA reporting process do not require a documented supervisory review of the information uploaded to the FSRS. Procedures require that the supervisor be notified of the FSRS entry, but do not require that a review be documented. Without adequate supervisory review over FFATA reporting, the DHEWD has less assurance the information included in the FFATA reporting for the WIOA Cluster is complete and accurate. Procedures, at a minimum, should define the responsibilities of various program personnel and include procedures for ensuring the accuracy and completeness of all FFATA reporting elements. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." FFATA reporting The DHEWD did not comply with FFATA reporting requirements for the WIOA Cluster. To test compliance with FFATA reporting requirements, we haphazardly selected for review 2 of the 13 subrecipients, and reviewed the 10 subawards to those 2 subrecipients, totaling approximately $2.2 million, awarded during state fiscal year 2024. Of the 10 subawards reviewed, the DHEWD did not upload to the FSRS 4 subawards totaling approximately $987,000. After we brought this to their attention, DHEWD personnel prepared and uploaded information for these subawards in the FSRS. DHEWD personnel indicated the FFATA reporting errors occurred because personnel newly assigned to the process were unfamiliar with the FFATA reporting requirements. In addition to noncompliance with federal requirements, not reporting subawards to the FSRS accurately and timely increases the risk that those using the reports could rely on incomplete information. Recommendation The DHEWD strengthen internal controls related to FFATA reporting to require documented supervisory reviews of the information reported to the FSRS and complete FFATA reporting timely and accurately for the WIOA Cluster, as required. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Transportation Federal Program: 20.205 Highway Planning and Construction (HPC) Various awards State Agency: Missouri Department of Transportation (MoDOT) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirement: Procurement and Suspension and Debarment The MoDOT did not establish policies and procedures to monitor contractor and subrecipient compliance with Build America, Buy America (BABA) domestic preference provisions for Infrastructure Investment and Jobs Act (IIJA)-funded projects of the HPC program. As a result, the MoDOT did not ensure contractors and subrecipients complied with these provisions. During the year ended June 30, 2024, the MoDOT expended approximately $922 million in IIJA funding for the HPC program, which represents approximately 68 percent of total program spending. The MoDOT is responsible for ensuring compliance with BABA domestic preference provisions for all IIJA-funded infrastructure projects. Section 70914(a) of the BABA Act, enacted as part of the IIJA, requires all iron, steel, manufactured products, and construction materials used in IIJA-funded infrastructure projects to be produced in the United States. Regulation 2 CFR Section 200.318(a) requires the MoDOT to maintain documented procurement procedures, and 2 CFR Section 200.318(b) requires the MoDOT to monitor contractor and subrecipient compliance with the terms and conditions of project agreements, including BABA provisions. The MoDOT includes BABA provisions in every contractor and subrecipient project agreement, including IIJA-funded projects. However, the MoDOT did not develop monitoring policies and procedures and did not verify contractors and subrecipients complied with these provisions. MoDOT officials stated specific monitoring procedures had not yet been developed because the requirements were relatively new and took effect in May 2022. In addition to noncompliance with federal requirements, without adequate monitoring policies and procedures, the MoDOT lacks assurance its contractors and subrecipients are in compliance with BABA requirements. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The MoDOT implement and enforce policies and procedures to monitor HPC program IIJA-funded projects to ensure contractor and subrecipient compliance with BABA domestic preference provisions, as required. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of the Treasury (Treasury) Federal Program: 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds SLFRP4542 State Agency: Office of Administration (OA) Type of Finding: A - Internal Control (Material Weakness) and Material Noncompliance B - Internal Control (Material Weakness) and Material Noncompliance Compliance Requirement: Subrecipient Monitoring As noted in our previous audit, the OA has not established policies and procedures regarding monitoring subrecipients of the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program. As a result, the OA did not comply with the Uniform Guidance (UG) requirements regarding identifying and monitoring subrecipients of the SLFRF program. The OA is the lead agency responsible for administering the SLFRF program. The purpose of the SLFRF program is to provide funding to respond to the COVID-19 public health emergency (PHE) or its negative impacts; respond to workers performing essential work during the PHE; provide government services, to the extent of the reduction in revenue due to the PHE (revenue replacement); make necessary investments in water, sewer, or broadband infrastructure; provide emergency relief from natural disasters or the negative economic impacts of natural disasters; and finance certain surface transportation and housing projects. The OA and various state agencies designed projects within the various allowable SLFRF program categories, and are responsible for administering the projects. The OA developed the American Rescue Plan Act Grant Management Portal (portal) to serve as the official repository of information and documentation supporting each SLFRF program project. The state agencies upload supporting documentation to the portal, including contracts, payment requests, and other supporting documentation. Most payments are made on a reimbursement basis. The OA reviews each payment request and processes the payments. Some SLFRF program projects are administered through subawards. The OA establishes contracts with each subrecipient that outline various SLFRF program requirements, terms, and conditions. In the Schedule of Expenditures of Federal Awards (SEFA), the OA reported approximately $186 million was passed through to subrecipients of the SLFRF program during the year ended June 30, 2024. This amount represents approximately 30 percent of the SLFRF program expenditures. These awards were administered through the OA and 7 other state agencies. However, as noted in finding point A., the amounts are not accurate due to subrecipient determination errors. In response to our prior audit finding, the OA held a training for state agency personnel in August 2024 and sent a letter to state agencies in January 2025 (after the current audit period), covering agency responsibilities related to certain SLFRF program subrecipient monitoring requirements, such as subrecipient determinations and single audits. Of the 7 state agencies that administered subawards reported in the SEFA during the year ended June 30, 2024, 4 administered the majority of the subawards, with payments totaling approximately $181 million, or 97 percent of the total subrecipient payments reported in the SEFA. These 4 state agencies were the Department of Mental Health (DMH), Department of Higher Education and Workforce Development (DHEWD), Department of Natural Resources (DNR), and the Department of Economic Development (DED). Our review and testing of subrecipient monitoring procedures focused on the OA and the 4 state agencies. For the 4 state agencies, a total of 212 recipients were identified as subrecipients in the SEFA. However, as noted in finding point A., this count is not accurate due to subrecipient determination errors. To understand the OA and state agency procedures, and to test compliance with subrecipient monitoring requirements, we randomly selected a sample of payments to 21 subrecipients for the 4 state agencies. In addition, we judgmentally selected an additional subrecipient at one of the agencies because we had received citizen concerns regarding the administration of the subrecipient project. The 22 subrecipients were awarded a total of approximately $230 million in SLFRF program funding and were paid a total of approximately $77.9 million during the year ended June 30, 2024. We reviewed records in the portal supporting the subawards and 1 payment for each of the 22 subrecipients. We reviewed payments totaling approximately $5.9 million. For the judgmentally-selected subrecipient, we reviewed documentation of the state agency's monitoring of the subrecipient, including documentation of decisions to terminate (June 2024), not reinstate (December 2024), and reinstate (June 2025) the project. No significant issues were identified in this review. A. Subrecipient Determination The OA has not established policies and procedures to determine whether recipients of the SLFRF program funds are subrecipients or contractors. As a result, some recipients were incorrectly classified, and the OA lacks a complete and accurate listing of subrecipients. Subrecipient monitoring requirements are outlined in the UG. Regulation 2 CFR Section 200.331 states a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. The classification of a subrecipient is dependent on whether the entity is responsible for making eligibility determinations for assistance, has its performance measured in relation to whether the objectives of the federal program were met, has responsibility for programmatic decision-making, is responsible for adherence to federal program requirements, and uses the federal funds to carry out a program for its public purpose. The OA did not evaluate each SLFRF program recipient for the UG criteria, and did not make a determination of whether the entity was a subrecipient or contractor. OA officials assigned responsibility for making these determinations and identifying subrecipients to the applicable state agencies, but did not provide clear guidance to the state agencies or ensure the state agencies properly performed and documented the determinations. One of the 4 state agencies had not documented their determinations for any of their sampled subrecipients and another state agency had not documented its determinations for 2 of 4 sampled subrecipients. Our analysis and review of the population of 212 subrecipients identified in the SEFA for the 4 state agencies revealed 1 state agency incorrectly recorded 2 contractors (office supply and electrical supply companies), with payments totaling $6,509, as subrecipients. The OA is the lead agency responsible for administering the SLFRF program. Without adequate procedures over subrecipient or contractor determinations, the OA lacks assurance that its subrecipients have been identified for subrecipient monitoring purposes. The OA Corrective Action Plan and Summary Schedule of Prior Audit Findings for prior audit finding number 2023-010 state the OA disagrees that it needs to develop policies and procedures regarding subrecipient determinations since the requirements are already stated in the Uniform Guidance and SLFRF program regulations. However, documented policies and procedures are necessary to clearly communicate responsibilities to the state agencies, prevent misunderstandings, and demonstrate adequate internal controls over compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraph 3.10 of the Standards for Internal Control in the Federal Government, also known as the Green Book, states, "[e]ffective documentation assists in management's design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors." Paragraph 12.01 states, "[m]anagement should implement control activities through policies." B. Subrecipient Monitoring The OA did not implement an effective subrecipient monitoring program to monitor the SLFRF subrecipients. As a result, some subrecipient monitoring procedures were not performed as required by the UG. Regulation 2 CFR Section 200.332(b) states that pass-through entities must evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Risk assessments may consider factors such as the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially-changed systems, and the extent and results of federal awarding agency monitoring. Regulation 2 CFR Section 200.332(d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subrecipient is in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity; (2) following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address single audit findings related to the particular subaward; and (3) issuing a management decision for applicable findings pertaining only to the federal award provided to the subrecipient from the pass-through entity. Regulation 2 CFR Section 200.332(f) requires pass-through entities to verify that every subrecipient had a single audit when it is expected that the subrecipient spent $750,000 or more during the subrecipient's fiscal year. To monitor subrecipients of the SLFRF program, the OA relies on its pre-payment monitoring process. The OA does not perform any post-payment monitoring procedures, and relies on the state agencies to perform these procedures. The OA did not establish policies and procedures over the pre-payment review process and these reviews were not always clearly documented. In addition, the OA did not sufficiently communicate with the state agencies regarding subrecipient monitoring responsibilities or ensure the state agencies performed monitoring reviews. The information communicated to the state agencies in memos, emails, and periodic meetings and trainings with state agency personnel were not formalized in a policy and did not cover all relevant compliance requirements. In addition, the OA did not ensure risk assessments were performed or that subrecipients received single audits as required by the UG. Risk assessments The OA did not ensure required risk assessments for subrecipients of the SLFRF program were performed to determine the nature, timing, and extent of monitoring procedures necessary. Two of the 4 state agencies did not perform any risk assessments for the sampled subrecipients. OA officials indicated risk assessment procedures are the responsibility of the state agencies; however, the OA did not provide clear guidance to the state agencies or ensure the state agencies performed and used risk assessments as required. In addition to complying with federal requirements, risk assessments are necessary to ensure monitoring reviews are conducted with adequate frequency to help ensure subrecipient compliance with program requirements. OA pre-payment monitoring procedures The OA has not developed policies and procedures outlining its pre-payment monitoring procedures and did not always clearly document monitoring performed prior to making payments. In their review and approval of each SLFRF subrecipient payment request, OA officials stated they thoroughly review supporting documentation uploaded to the portal by the state agencies, including contracts, bid documentation, invoices, and other supporting documentation. OA officials further stated they review for compliance with certain types of SLFRF program compliance requirements, including allowable activities and allowable costs, procurement, and period of performance. However, the OA does not clearly document review procedures performed. For each of the 22 subrecipients sampled, the portal included documentation pertaining to some, but not all of the applicable compliance requirements. For example, for 5 subrecipient payments reviewed (for 2 state agencies), the portal included summary invoices, but did not include sufficiently detailed documentation showing compliance with the allowable activities and allowable costs and period of performance compliance requirements. Without documented policies and procedures and documentation of prepayment monitoring procedures performed, the OA cannot demonstrate subrecipient monitoring procedures were performed. Additional monitoring procedures The OA does not monitor subrecipients beyond the pre-payment monitoring process previously described. OA officials stated post-payment monitoring procedures are the responsibility of the state agencies; however, the OA did not sufficiently communicate with the agencies regarding subrecipient monitoring responsibilities or ensure the agencies performed monitoring reviews. Our review of subrecipient monitoring procedures at the 4 state agencies noted 3 agencies had developed written policies or procedures regarding subrecipient monitoring. We also noted state agency review procedures varied significantly, did not cover all significant compliance requirements, and were not always documented. While officials of some state agencies indicated they perform detailed pre-payment reviews for compliance with allowable activities and allowable costs, period of performance, and/or local match requirements, officials of some agencies explained they and the OA sometimes review only summary invoices of expenditures from the subrecipients prior to payment. Additionally, officials of all state agencies described various post-payment review procedures such as reviews for compliance with certain requirements, reviews of documentation supporting expenditures of funds advanced to the subrecipient, billing reviews of documentation supporting summary invoices, and/or reviews of the final work product; however, none of the agencies performed all of these procedures. In addition, the agencies could not always provide documentation such reviews had been performed for the sampled items. In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure sufficient monitoring procedures were performed and documented increases the risk that subrecipient noncompliance will not be prevented or detected timely. Subrecipient audits The OA did not ensure the required reviews of single audit reports for applicable SLFRF program subrecipients were conducted. OA officials indicated the state agencies are responsible for ensuring subrecipients had a single audit, and reviewing and following up on the audit reports; however, the OA did not ensure the state agencies performed these procedures. All 4 agencies described procedures to monitor and follow up on single audit reports. Each subrecipient that spent in excess of $750,000 in federal awards during its fiscal year must obtain a single audit in accordance with the UG within 9 months after the end of the fiscal year. In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure subrecipients received required audits and to review and follow up on the related audit reports, increases the risk that subrecipient noncompliance will not be identified and addressed. Conclusions The following table summarizes the results of our sampling at the 4 state agencies, presented in finding points A. and B. Instances in which a criterion was partially met are shown as the applicable number of items sampled. The OA is the lead agency responsible for administering the SLFRF program. OA officials indicated the state agencies were responsible for some of the subrecipient monitoring requirements. However, without clear communication and monitoring of these responsibilities, the OA lacks assurance of compliance with all subrecipient monitoring requirements. Without an established subrecipient monitoring program, the OA cannot provide assurance subrecipients are complying with SLFRF program requirements and there is increased risk that noncompliance with program requirements or subaward terms and conditions will go undetected, or that subaward performance goals will not be achieved. In addition, a subrecipient monitoring program is necessary to demonstrate adequate internal controls over compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing that Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraph 3.10 of the Standards for Internal Control in the Federal Government, also known as the Green Book, states, "[e]ffective documentation assists in management's design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors." Paragraph 12.01 states, "[m]anagement should implement control activities through policies." Recommendations The OA: A. Develop policies and procedures to determine whether recipients of SLFRF program funds are subrecipients or contractors. Continue to work with the state agencies to ensure accurate and documented determinations are prepared for all recipients, and modify subrecipient records as needed. B. Develop a subrecipient monitoring program in accordance with the Uniform Guidance that includes performing risk assessments for each subrecipient for the purposes of determining the appropriate subrecipient monitoring procedures; monitoring for compliance with federal requirements and subaward terms and conditions, and ensuring subaward performance goals are achieved; and reviewing subrecipient single audit reports. Ensure tasks delegated to state agencies are adequately communicated and establish procedures to ensure those tasks are appropriately completed. Auditee's Response A. We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding. B. We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding. Auditor's Comment The OA Corrective Action Plan states the OA partially agrees with Finding point A. because the OA completed training for all agencies regarding agency subrecipient monitoring responsibilities and distributed a memo instructing the agencies to develop subrecipient monitoring policies and procedures. However, as noted in the audit finding, the training was held and letter was sent to state agencies after the current audit period. Because the OA took no corrective action prior to or during the audit period, the internal control weaknesses and noncompliance occurred again in the current audit period.

Federal Agency: Department of the Treasury (Treasury) Federal Program: 21.029 COVID-19 - Coronavirus Capital Projects Fund CPFFN0151 State Agency: Department of Economic Development (DED) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirement: Reporting During state fiscal year 2024, the DED did not comply with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for any of the 47 first-tier subawards, totaling approximately $196.7 million, for the Coronavirus Capital Projects Fund (CPF) program. First-tier subaward payments accounted for 100 percent of the program's expenditures. In addition, the DED has not established internal controls over FFATA reporting for the CPF program. The FFATA requires comprehensive reporting for certain federal awards to promote transparency and accountability over the use of the federal funds. Regulation 2 CFR Part 170, Appendix A, requires the DED to report first-tier subawards of $30,000 or more to the FFATA Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward was made. Information entered into the FSRS is publicly available at USASpending.gov. Due to initial technical difficulties with the FSRS, the Treasury requested CPF program recipients to complete their outstanding FFATA reports by no later than June 30, 2024. The DED is responsible for administering the CPF program. The CPF program grant was initially awarded to the Office of Administration (OA). The DED was authorized under an interagency spending delegation agreement with the OA to access and expend CPF program funds. FFATA reporting The DED did not comply with FFATA reporting requirements for the CPF program. DED personnel did not report any of the 47 subawards, totaling approximately $196.7 million, that required FFATA reporting by June 30, 2024, as required by the Treasury. DED officials indicated they did not complete FFATA reporting because they initially believed the OA would complete FFATA reporting for the DED. Once the DED realized they were responsible for FFATA reporting, in November 2024, DED personnel prepared and uploaded information for these subawards in the FSRS. In addition to noncompliance with federal requirements, not reporting subawards to the FSRS accurately and timely increases the risk that those using the reports could rely on inaccurate information. Internal controls The DED has not established internal controls over FFATA reporting for the CPF program. As a result, the required FFATA reporting was not performed for the CPF program during the year ended June 30, 2024. Without internal controls over the FFATA reporting process, there is less assurance the reporting will be completed accurately and timely. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DED complete FFATA reporting in accordance with the applicable requirements, and establish internal controls related to FFATA reporting for the CPF program. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 93.575 COVID-19 - Child Care and Development Block Grant 2022 - 2102MOCCC5 2022 - 2102MOCSC6 2022 - 2102MOCDC6 93.575 Child Care and Development Block Grant 2022 - 2202MOCCDD 2023 - 2302MOCCDD 93.596 Child Care Mandatory and Matching Funds of the Child Care and Development Fund 2022 - 2202MOCCDF 2023 - 2302MOCCDF 2024 - 2402MOCCDF 2024 - 2402MOCCDM State Agency: Department of Elementary and Secondary Education (DESE) Type of Finding: Internal Control (Material Weakness) and Nonmaterial Noncompliance Questioned Costs: $2,223 Compliance Requirements: Activities Allowed or Unallowed and Allowable Costs/Cost Principles As similarly noted in our prior audit report, DESE controls over the Child Care Development Fund (Child Care) program's subsidy payments to child care providers are not sufficient to ensure payments are in accordance with the Child Care program subsidy state plan and costs are allowable. As a result, the DESE overpaid 29 providers and underpaid 8 providers of the 60 payments sampled. The Child Care program transferred from the Department of Social Services (DSS) to the DESE, and the DESE became the lead agency responsible for all Child Care program policies and procedures effective August 28, 2021. Through June 2024, the DSS continued to perform certain agreed-upon responsibilities of the program. The DESE provides subsidy funds to child care providers who serve eligible clients (parents/caregivers). Prior to January 2024, clients applied to the DSS for participation in the Child Care subsidy program. In January 2024, the DESE implemented the Child Care Data System (CCDS), and the application and eligibility process transferred from the DSS to the DESE. During the year ended June 30, 2024, the DESE's electronic time and attendance reporting system, the Child Care Business Information Solution (CCBIS), interfaced with the CCDS and the DSS's Family Assistance Management Information System (FAMIS), to process payments to child care providers. DESE personnel (previously DSS personnel) enter maximum authorized service units into the CCDS (previously FAMIS) for the amount and type of care that best meets the client's need. Child care providers receive monthly payments based on authorized services and attendance information they submit in the CCBIS and the CCDS. Providers are paid daily rates referenced in the Child Care program subsidy state plan for each child based on the child's age, type of facility, location of facility, daytime versus evening or weekend care, part-time versus half-time versus full-time care, the client's income-based sliding fee, and protective services/income maintenance status. Child care providers receive rate enhancements for various items such as accreditation, providing weekend and evening care, serving a disproportionate share of subsidy children, and serving special needs children. Providers are paid for up to 23 days of attendance per child per month, and up to 3 or 5 absences and/or holidays per child per month depending on the number of units of care authorized per month. Providers may bill up to 11 holidays in a state fiscal year. As of June 30, 2024, the DESE contracted with 2,360 providers and had approved services for 33,110 children. During the year ended June 30, 2024, the DESE paid about $170 million to providers that served children of eligible clients. Approximately $94 million of the $170 million was processed from the CCDS and approximately $76 million was processed from the FAMIS. CCDS operations have been problematic since implementation as various programming and data migration errors have caused overpayments and underpayments to providers. In June 2024, the DESE awarded a contract with a consultant to review payments made from the CCDS from January 1 to May 31, 2024. The consultant identified numerous instances of overpayments and underpayments and reported, with all overpayments and underpayments combined (netted) per provider, 70 percent of providers were overpaid and 25 percent were underpaid (5 percent were correctly paid). The consultant reported for providers with net overpayments, the overpayments ranged from 6 cents to $80,410 per provider; and for providers with net underpayments, the underpayments ranged from 16 cents to $195,446 per provider. The consultant found the overpayments were most commonly related to paying rates of the incorrect age category and duplicate payments for attendance, and the underpayments were most commonly related to not paying enhancement rates and the full market rate for protective services children. DESE personnel indicated, between January and October 2024, they corrected the programing and migration issues that led to the provider overpayments and underpayments. As of June 30, 2025, DESE personnel indicated they had compensated those providers with net underpayments identified by the consultant, and they were working with the DHHS - Administration for Children and Families (DHHS-ACF) to resolve the remaining amounts to providers with net overpayments identified. They further stated they were working with a second consultant to identify and address additional underpayments and overpayments that occurred from June to October 2024, the period between the end of the first consultant's review period and when all system programming and migration issues were resolved. To test compliance with program requirements, we randomly selected a sample of 60 payments totaling $33,814 to 60 child care providers. Each payment was for 1 child for 1 month of care. Of the 60 payments tested, 45 payments totaling $25,902 were from the CCDS and 15 payments totaling $7,912 were from the FAMIS. Of the 60 payments tested, 37 (62 percent) contained 1 or more types of overpayments, totaling $3,225, and/or 1 or more types of underpayments totaling $838. Of the 37 payments with errors, 35 payments were CCDS errors and 2 payments were FAMIS errors. When overpayments and underpayments were combined for each for the 37 payments with errors, 29 payments (all CCDS errors) were net overpayments of $3,063, and 8 payments (6 CCDS and 2 FAMIS) were net underpayments of $674. We question the federal share, or $2,223 (72.56 percent) of the net overpayments. CCDS payment errors Our review of 45 CCDS payments totaling $25,902, identified 35 (78 percent) that contained 1 or more types of errors. The following table shows the absolute counts and amounts by error type, prior to being combined (netted) with other types of errors within each payment. The 7 error types with net overpayments were as follows: • Duplicate payments were made because duplicate child accounts were created in the migration of cases from the FAMIS to the CCDS. • Overpayments occurred because child care providers were paid for 10 absences and holidays instead of the maximum of 3 or 5 absences and holidays for the month. This error affected payments made in January and February 2024. • Duplicate payments were made for absences and holidays. Providers were incorrectly paid twice the number of reported absences and holidays, up to the maximums. • Overpayments occurred because providers were paid for more than the maximum 23 days of attendance for the month. • Overpayments and underpayments occurred because more or less attendance days were paid than recorded in the CCBIS. • Overpayments occurred because absences and holidays were paid at the sliding fee rate for part-time instead of full-time care. • Overpayments and underpayments occurred due to various other sliding fee rate errors. For example, underpayments occurred since the sliding fee rate was set at $1 per child per day for children of clients with very low income instead of $0. Deficiencies in the design and testing of the CCDS led to the significant issues noted above. DESE officials indicated all of the errors identified in the audit occurred due to CCDS programming errors as well as data migration errors from the FAMIS to the CCDS. DESE officials stated the errors identified in the audit were also identified by the first consultant, all related system errors had been corrected, and the child care providers with net underpayments had been compensated; but the child care providers with net overpayments had not been resolved. Net overpayments identified in the sample represent about 12 percent of the CCDS payments tested. Due to the systemic nature of the errors, similar errors on the remaining population of CCDS payments totaling $94 million are likely, and unallowable costs could be significant. FAMIS payment errors Our review of 15 FAMIS payments totaling $7,912, identified 2 payments (13 percent) that contained underpayments totaling $421 (5 percent) due to incorrect enhancement rate calculations. DESE officials were unable to explain why or how these errors occurred. Conclusions The failure to design and implement adequate internal controls to ensure payments are made in accordance with the Child Care program subsidy state plan led to overpayments to child care providers, which are unallowable costs of the Child Care program. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission." Paragraph 16.01 of the Standards for Internal Control in the Federal Government, also known as the Green Book, provides that "[m]anagement should establish and operate monitoring activities to monitor the internal control system and evaluate the results." In addition, 45 CFR Section 98.68(a) requires the lead agency to document in its Child Care program subsidy state plan that it has effective controls to ensure integrity and accountability in the program. Recommendation The DESE continue to review, strengthen, and enforce internal controls to ensure payments are made in accordance with the Child Care program subsidy state plan. The DESE should review and correct the uncorrected child care provider overpayments and underpayments identified in this finding as well as other reviews of CCDS payments. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 93.777 COVID-19 - State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare 93.777 State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare 2023 and 2024 - TITLEXVIII 2023 and 2024 - TITLEXIXSS 2023 and 2024 - CLIA 2023 and 2024 - XVIIIIMPAC 2023 - TITLE18CRS (COVID) State Agency: Department of Health and Senior Services (DHSS) - Section for Long-Term Care Regulation (SLCR) Type of Finding: Nonmaterial Noncompliance Compliance Requirement: Special Tests and Provisions As similarly noted in our 3 prior audit reports, the SLCR did not perform facility survey procedures within required timeframes. In our test of compliance with facility survey requirements for 60 surveys performed during the year ended June 30, 2024, we noted 10 Statements of Deficiencies and Plan of Corrections were sent 11 to 20 days after the survey exit instead of within 10 days, and 1 facility revisit was completed in 64 days instead of within 60 days of the initial survey date. The DHSS is the state survey agency charged with inspecting providers of the Medical Assistance Program (Medicaid), including hospitals, nursing facilities, and other long-term care facilities. Under 42 CFR Section 431.108, as a basis for participation in Medicaid, providers are subject to survey and certification by the DHHS - Centers for Medicare and Medicaid Services (DHHS-CMS) or the DHSS to ensure providers and suppliers are in compliance with regulatory health and safety standards and conditions of participation. During the year ended June 30, 2024, the DHSS through the SLCR surveyed 523 providers, including 483 long-term care nursing facilities, 9 intermediate care facilities for individuals with intellectual disabilities, and 31 non-deemed hospitals. The DHHS-CMS provides the State Operations Manual (SOM) to state agencies as guidelines for the survey and certification of providers. SOM Chapter 2, Section 2728, requires the state agency to mail to the provider a copy of Form CMS-2567 (Statement of Deficiencies and Plan of Correction) within 10 working days after the survey exit. In addition, SOM Chapter 7, Section 7317.2, requires onsite revisits for long-term care nursing facilities to occur any time between the last correction date on the plan of correction and the 60th day from the survey date to confirm the facility is in substantial compliance, and in certain cases, has the ability to remain in substantial compliance. To test compliance with survey and certification requirements, we randomly selected 60 surveys including 44 long-term care nursing facility surveys, 5 intermediate care facility for individuals with intellectual disabilities surveys, and 11 non-deemed hospital surveys, performed between July 1, 2023, and June 30, 2024. Of the 58 surveys that required a Statement of Deficiencies and Plan of Correction, 10 statements (17 percent) were sent to facilities between 11 and 20 working days after the survey exit instead of within 10 working days as required. In addition, of the 27 long-term care nursing facilities that required a revisit, the revisit to 1 facility (4 percent) was completed 64 days after the initial survey date instead of within 60 days as required. DHSS officials indicated there were multiple contributing factors for these delays including DHSS staffing shortages, industry labor shortages, insufficient state and federal funding, increased workloads due to increased volume and severity of complaints received and violations identified, and the backlog of surveys due. DHSS officials stated they hired part-time retired surveyors and contracted with outside survey companies to help with the increased workload and backlog. They further indicated they are working with the DHHS-CMS to minimize the delays. Conducting survey procedures within required timeframes helps to ensure providers are timely notified of deficiencies requiring correction so that timely follow up on those deficiencies can occur to provide assurance facilities are providing services to their clients that are in compliance with health and safety standards and conditions of participation. Recommendation The DHSS through the SLCR ensure survey procedures are conducted within required timeframes. Auditee's Response We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding. Auditor's Comment The DHSS Corrective Action Plan states the DHSS disagrees that the revisit error should be a finding and that corrective action is needed because the error rate identified in the audit sample was less than the performance criteria (70 percent) used to measure compliance and require corrective action in the DHHS-CMS State Performance Standards System. However, the performance criteria is intended to measure the DHSS's level of compliance and identify when corrective action is needed to address deficiencies, and does not remove the DHSS's responsibility to comply with the timeframes required by the SOM.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 93.767 COVID-19 - Children's Health Insurance Program 93.767 Children's Health Insurance Program 2023 - 2305MO3002 and 2305MO5021 2024 - 2405MO5021 93.778 COVID-19 - Medical Assistance Program 93.778 Medical Assistance Program 2023 - 2305MO5MAP and 2305MO5ADM 2024 - 2405MO5MAP and 2405MO5ADM State Agency: Department of Social Services (DSS) - MO HealthNet Division (MHD) and Family Support Division (FSD) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility As similarly noted in our 5 previous audits, the DSS does not have sufficient controls to ensure compliance with the eligibility requirements of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP) for certain participants whose eligibility is based on the Modified Adjusted Gross Income (MAGI). As of June 30, 2024, the DSS had not corrected manual system overrides for approximately 10,200 (1 percent) of MAGI-based participants, preventing their cases from being identified as needing a redetermination and closed when necessary. These participants remained enrolled without redetermination of eligibility for up to 10 years. Of the approximately 1.3 million Medicaid and CHIP participants as of June 30, 2024, approximately 1.1 million were MAGI-based participants. To ensure MAGI-based participants continue to be eligible for benefits, 42 CFR Section 435.916 requires a redetermination of eligibility once every 12 months, or when circumstances affecting a participant's eligibility change. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE). During that period all validly enrolled participants on March 19, 2020, were to remain continuously enrolled, except for participants who requested removal, moved out of state, or died. Effective April 1, 2023, under the COVID-19/Annual Renewals Unwinding User Acceptance Test Plan, submitted to the DHHS - Centers for Medicare and Medicaid Services (DHHS-CMS), the DSS was to resume and complete redeterminations for all participants over a 14-month period, which ended June 30, 2024. In August 2024, the DSS received an extension of this deadline from the DHHS-CMS. Under the extension, the DSS is required to complete redeterminations for all participants, and terminate benefits for participants who no longer meet eligibility requirements, by December 31, 2025. The Medicaid Eligibility Determination and Enrollment System (MEDES) tracks eligibility information from MAGI-based participants, including redetermination due dates; and in some cases, performs redeterminations. Non-automatic redeterminations for MAGI-based participants are performed manually by FSD eligibility benefit technicians. Eligibility information is transferred from the MEDES into the Medicaid Management Information System (MMIS), the Medicaid claims payment system, nightly. To ensure continuous enrollment during the PHE and the extended unwinding period, the DSS programmed the MEDES to continue coverage effective March 18, 2020, except in the case of a participant's death, out-of-state move, or voluntary closure. MEDES operations have been problematic since implementation in January 2014, and manual overrides have been made to individual cases to compensate for various system errors and limitations. DSS officials explained that for a period of time prior to June 2017, manual overrides were needed because the MEDES was incorrectly closing some eligible cases before a redetermination could be performed. To prevent the system from closing affected cases, DSS personnel manually overrode system controls. However, once these system limitations were corrected in June 2017, the DSS did not remove the previously established manual overrides. DSS officials explained in recent years, manual overrides are needed to correct MEDES errors related to initial eligibility determinations, which have substantially increased with the Medicaid expansion beginning in 2021. Until corrected, the manual overrides prevent the MEDES from taking automatic actions such as identifying cases needing redetermination and closing cases. Participants with uncorrected manual overrides have remained enrolled, without a redetermination, since the override was created up to 10 years ago. As a result, cases for participants with manual overrides that did not meet eligibility requirements may not have been closed. In response to our prior year audit findings, in August 2023, the DSS developed a report identifying the cases with manual overrides and began correcting the cases by removing overrides and performing redeterminations. The report of cases with manual overrides as of June 30, 2024, showed approximately 10,200 cases with overrides dating back to 2014. A comparison of the override report to the prior year override report showed during the year ended June 30, 2024, the DSS corrected the overrides for approximately 3,500 participants, and added overrides to an additional approximately 2,500 cases as shown in the following table (rounded to the nearest hundred). The failure to perform redeterminations for these participants, especially those who have not had redeterminations for many years, increases the risk of unallowable and/or unnecessary costs being paid from state and federal funds. The magnitude of this risk was increased by the waivers and extensions granted due to the PHE. For example, the 6,129 participants with overrides made in 2017, remained enrolled for over 7 years as of June 30, 2024, without any review for continued eligibility. When the PHE began on March 19, 2020, these participants had been enrolled without redetermination for over 2 years. During the PHE and extended unwinding period, these participants remained enrolled for at least another 5 years. DSS officials estimate the process of removing overrides and correcting cases will be completed by July 2025. However, they also stated that the number of cases with system overrides will never be zero, because they will continue to bypass system controls to address system errors. Because our random sample of 60 (of approximately 1.3 million) MAGI-based participants enrolled during the year ended June 30, 2024, did not identify any participants with previously established overrides, no questioned costs were identified. The failure to implement adequate internal controls to ensure ineligible participant cases are closed and redeterminations are performed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DSS through the MHD and the FSD continue to review and correct cases for participants with manual overrides in the MEDES, ensure redeterminations are completed for these participants as required, and close the cases of any ineligible participants. In addition, the DSS should ensure system controls are functioning as designed for these participants. Auditee's Response We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement. Auditor's Comment The DSS Corrective Action Plan (CAP) states the DSS disagrees there is a significant deficiency in internal controls because no participants with manual overrides were identified in the audit sample. However, as noted in the finding, the DSS identified approximately 10,200 participants with manual overrides, or 1 percent of the MAGI-based participant population. The significant internal control weaknesses associated with these participants, who have remained continuously enrolled for up to 10 years, remain regardless of whether any of these participants were selected in the audit sample. The CAP states the DSS had processes in place to terminate eligibility for individuals who were deceased, voluntarily requested closure, or reported they have moved out of state. However, as noted in the finding, these processes were not applied to all participant cases with manual overrides; and instead of proactively reviewing cases as recommended in the past 5 audits, the DSS merely reacted when participants voluntarily submitted information. Also in the CAP, the DSS argues they have received an extension to perform redeterminations for all participants, including the participants with manual overrides, through December 31, 2025. However, as noted in the finding, the extension does not exempt the DSS from the responsibility to terminate eligibility for participants who requested removal, moved out of state, or died. As shown in the table in the finding, at least 6,700 participants have remained continuously enrolled without a redetermination since we began recommending these cases be addressed. Until the manual overrides are corrected and/or applicable participants are reviewed, there will be continued circumvention of established internal controls and risk of improper payments on these cases.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 93.767 COVID-19 - Children's Health Insurance Program 93.767 Children's Health Insurance Program 2023 - 2305MO3002 and 2305MO5021 2024 - 2405MO5021 93.778 COVID-19 - Medical Assistance Program 93.778 Medical Assistance Program 2023 - 2305MO5MAP and 2305MO5ADM 2024 - 2405MO5MAP and 2405MO5ADM State Agency: Department of Social Services (DSS) - MO HealthNet Division (MHD) and Family Support Division (FSD) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Questioned Costs: $773 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility As noted in our previous audit, the DSS does not have sufficient controls to ensure benefits are terminated for participants no longer eligible for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). A death match was not operating in the Medicaid Eligibility Determination and Enrollment System (MEDES) during the year ended June 30, 2024. Additionally, the DSS does not have adequate procedures to ensure cases are terminated when information requiring participant case termination is received. For 1 of 60 participant cases sampled, the DSS received information requiring participant case termination, but did not manually terminate the participant's eligibility in the applicable eligibility system. There were approximately 1.3 million Medicaid and CHIP participants as of June 30, 2024. To ensure participants continue to be eligible for benefits, 42 CFR Sections 435.916(d) and 435.952(a) require the agency to redetermine eligibility whenever it receives information about a change in a participant's circumstances that may affect eligibility. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE), except for participants who requested removal, moved out of state, or died. Effective April 1, 2023, under the COVID-19/Annual Renewals Unwinding User Acceptance Test Plan, submitted to the DHHS - Centers for Medicare and Medicaid Services (DHHS-CMS), the DSS was to resume and complete redeterminations for all participants over a 14-month period, which ended June 30, 2024. In August 2024, the DSS received an extension of this deadline from the DHHS-CMS. Under the extension, the DSS is required to complete redeterminations for all participants, and terminate benefits for participants who no longer meet eligibility requirements, by December 31, 2025. Similar to the PHE period, during the extended unwinding period, the DSS is to terminate benefits for participants who requested removal, moved out of state, or died. Termination of benefits originate from various sources including redeterminations, periodic matches against external records, or information voluntarily provided by the participant and/or their relatives. Certain match results automatically update participant eligibility in the eligibility systems. When other information is received, such as voluntarily-provided information or certain external match reports, a manual entry in the applicable eligibility system is generally required to initiate the termination and close the case. Vital records death match As noted in the prior audit, the DSS monthly death match against Department of Health and Senior Services (DHSS) vital records information was not operating during the audit period. DSS officials indicated the death match, which automatically terminates eligibility for participants upon their death, was eliminated from the MEDES due to system problems sometime before July 2022. The DSS indicated they plan to resume use of the DHSS vital records death match in the MEDES in the future, but the anticipated resumption date is unknown. When operating, the monthly DHSS vital records death match serves as a key internal control to identify and terminate participants. The DSS Corrective Action Plan (CAP) and Summary Schedule of Prior Audit Findings for prior audit finding number 2023-006 state although the DHSS vital records death match is not functional, the FAMIS death match with state records is functional for participants of the Supplemental Nutrition Assistance Program, Temporary Assistance for Needy Families, and/or Medicaid Aged, Blind and Disabled program. However, not all MEDES participants are subject to the death match in the FAMIS. If the participant does not receive other benefits from the DSS they are not in the FAMIS where the death match process occurs. Information received As noted in the prior audit, the DSS does not have adequate procedures to ensure cases are terminated when information requiring participant case termination is received. To test compliance with eligibility requirements, we reviewed eligibility documentation for a randomly-selected sample of 60 Medicaid and CHIP participants enrolled prior to the year ended June 30, 2024. Of the 60 participants, 1 qualified for one of the PHE/extended unwinding period exceptions requiring termination; however, the participant's case was not terminated in the MEDES. DSS personnel did not manually close the case when the contracted call center received 2 calls in March 2024 from the participant's head of household requesting voluntary closure of the case. Call center personnel documented both calls in the MEDES case notes; however, the case was not closed at that time. When a redetermination was subsequently performed in October 2024, during the extended unwinding period, DSS officials closed the case because the participant had moved out of state. Medicaid payments made on behalf of the participant after the request for voluntary closure totaled $1,170 during the year ended June 30, 2024. We question the federal share, or $773 (66.05 percent). Medicaid payments made during the period from the date of the first request for voluntary closure to the date of case closure, totaled $1,374 ($906 federal share and $468 in state funding). DSS officials indicated their procedures for terminating cases when relevant information is received by the call center are not automated and may not be adequate to ensure cases are terminated in these situations. DSS officials said they plan to develop new procedures to process information received from participants; however, implementation has been delayed due to competing priorities. Conclusions The failure to implement and enforce adequate internal controls to ensure ineligible participant cases are closed as required can result in Medicaid and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs and result in payments from state funds that should not have occurred. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DSS through the MHD and the FSD continue to review, strengthen, and enforce internal controls to ensure ineligible participant cases are closed when necessary and resume the DHSS vital records death match in the MEDES. Auditee's Response We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding. Auditor's Comment The CAP states the DSS partially agrees with the finding because there was a procedure in place for contracted staff to submit a form instructing DSS staff to terminate and close a case; however, the CAP acknowledges the procedure was not followed for the case cited in the finding and the there are no controls when instructions are documented in the case notes instead of the form. This procedure is not truly "…in place…" when it is not being followed and there is no monitoring to ensure the procedure is being followed. Without a monitoring component, the internal control system is not properly designed to prevent, detect, or correct errors. The CAP also states the FAMIS eligibility system death match with state records is functional and the annual review process in MEDES includes a death match with federal records. However, as noted in the finding, not all MEDES participants are in the FAMIS, and subject to the FAMIS death match, because they do not receive other DSS benefits. Additionally, the MEDES annual review process was not fully functional during the PHE/extended unwinding period.

Federal Agency: Department of Health and Human Services Federal Program: 93.767 COVID-19 - Children's Health Insurance Program 93.767 Children's Health Insurance Program 2023 - 2305MO3002 and 2305MO5021 2024 - 2405MO5021 93.778 COVID-19 - Medical Assistance Program 93.778 Medical Assistance Program 2023 - 2305MO5MAP and 2305MO5ADM 2024 - 2405MO5MAP and 2405MO5ADM State Agency: Department of Social Services (DSS) - MO HealthNet Division (MHD) and Family Support Division (FSD) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirement: Eligibility The DSS does not have sufficient controls to ensure eligibility determinations are performed within required timeframes for participants of the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). Significant application processing delays noted in our two previous audits, continued and increased during the year ended June 30, 2024. In our test of compliance with eligibility requirements for the year ended June 30, 2024, we noted 29 of 120 eligibility determinations were made 2 to 168 days after the required timeframes and averaged 50 days late. The FSD is responsible for determining the eligibility of Medicaid and CHIP participants. FSD eligibility benefit technicians perform the majority of eligibility determinations using participants' Modified Adjusted Gross Income (MAGI). For the remaining non-MAGI participants, including participants in the MO HealthNet Aged, Blind, and Disabled programs, eligibility is not based on their MAGI. As of June 30, 2024, there were approximately 988,000 MAGI-based participants and approximately 304,000 non-MAGI-based participants. To ensure applicants are able to receive necessary medical care timely, 42 CFR Section 435.912(c)(3) requires new Medicaid eligibility determinations be made within 45 days of application and within 90 days of application for applicants who apply for benefits on the basis of disability. Regulation 42 CFR Section 435.912(e) allows exceptions to these timeframes in certain unusual circumstances, such as a doctor's delay. Regulation 42 CFR Section 457.340(d) requires the same timeliness standards for CHIP participants. To test compliance with eligibility requirements, we reviewed randomly-selected samples of 60 MAGI-based participants, and 60 non-MAGI-based participants, all of which were new enrollments, subject to the timeliness requirements. The DSS did not meet timeliness requirements for 17 of the 60 MAGI-based eligibility determinations (28 percent) and 12 of the 60 non-MAGI-based determinations (20 percent). The 29 late determinations were made 2 to 168 days after the required 45-day or 90-day requirement, and averaged 50 days late. DSS officials indicated the FSD was not able to process applications in a timely manner due to a number of continued workload and staffing challenges, including a backlog of new applications created by the expansion of Medicaid, increases in annual federal Health Insurance Marketplace open enrollment applications, unwinding of eligibility redetermination COVID-19 waivers, staffing shortages, and temporary reassignment of staff to work on other tasks. In addition to noncompliance with federal requirements, the failure to ensure eligibility determinations are performed timely can result in potentially eligible participants not receiving necessary medical care. To ensure compliance with federal requirements, the DSS should implement and enforce adequate internal controls to ensure eligibility determinations are performed within required timeframes. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DSS through the MHD and the FSD review, strengthen, and enforce internal controls to ensure participant eligibility is determined within the required timeframes. Auditee's Response We agree with the auditor’s finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Health and Human Services Federal Program: 93.767 COVID-19 - Children's Health Insurance Program 93.767 Children's Health Insurance Program 2023 - 2305MO3002 and 2305MO5021 2024 - 2405MO5021 93.778 COVID-19 - Medical Assistance Program 93.778 Medical Assistance Program 2023 - 2305MO5MAP and 2305MO5ADM 2024 - 2405MO5MAP and 2405MO5ADM State Agency: Department of Social Services (DSS) - MO HealthNet Division (MHD) Type of Finding: Internal Control (Material Weakness) Compliance Requirement: Other As noted in our previous audit, the MHD does not have adequate controls to ensure proper management of receipts. The MHD does not adequately restrict user access within the Medicaid Management Information System and does not account for all cash control numbers to ensure all checks and money orders are properly deposited or returned to senders if the payment cannot be accepted. During the year ended June 30, 2024, the MHD Financial Operations and Reporting Unit processed Medical Assistance Program (Medicaid) and Children's Health Insurance Program (CHIP) receipts totaling approximately $1.5 billion. These receipts included checks and money orders received from participants, providers, and insurance companies for items such as premiums, reimbursements, and taxes. See Financial Statement Finding number FS2024-002 in the Annual Comprehensive Financial Report - Report on Internal Control, Compliance, and Other Matters (Report No. 2025-030), issued in May 2025.

Federal Agency: Department of Health and Human Services Federal Program: 93.767 COVID-19 - Children's Health Insurance Program 93.767 Children's Health Insurance Program 2023 - 2305MO3002 and 2305MO5021 2024 - 2405MO5021 93.778 COVID-19 - Medical Assistance Program 93.778 Medical Assistance Program 2023 - 2305MO5MAP and 2305MO5ADM 2024 - 2405MO5MAP and 2405MO5ADM State Agency: Department of Social Services (DSS) - MO HealthNet Division (MHD) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirement: Other As similarly noted in our previous audit, the MHD needs to strengthen controls to ensure Medicaid Management Information System (MMIS) access rights are removed for users no longer employed in positions needing access. Our sample of 60 MMIS users with access as of March 2024 identified 1 terminated user whose access was not removed for nearly 2 years. Approximately 1,500 various DSS employees and employees of DSS contractors have access to the MMIS. The MMIS is the benefit claims processing and information retrieval system used by the MHD for the Medical Assistance Program (Medicaid) and the Children's Health Insurance Program (CHIP). DSS and contractor supervisors are instructed to notify MHD security officers of employee terminations so the MMIS access can be removed. The MHD Annual MMIS Security Review Procedures also require MHD security staff review all user account access annually to ensure access is still appropriate. We randomly selected a sample of 60 active user accounts as of March 2024, when the DSS initiated the 2024 annual review. We identified 1 account (2 percent) for an individual terminated from the DSS in April and November 2022, whose system access was not removed until May 2024. The individual had access to the MMIS for nearly 2 years while not employed by the DSS. DSS officials indicated in the 2023 annual review, personnel took no action when the supervisor did not respond to an inquiry regarding access for this individual. The individual was identified as terminated in the 2024 annual review and system access removed on May 31, 2024. The Health Insurance Portability and Accountability Act (HIPAA) requires the state to follow 45 CFR Section 164.308(a)(3)(ii)(C), which requires implementation of procedures for terminating access to electronic protected health information when the employment of a workforce member ends. The failure to remove all terminated employees' and contractors' access on a timely basis increases the risk of unauthorized access and may compromise the confidentiality and integrity of MMIS data. Further, reviews of user access rights serve as an internal control over the administration of the Medicaid and the CHIP. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DSS through the MHD continue to strengthen internal controls to ensure inappropriate access to the MMIS, including that of terminated users, is removed in a timely manner. Auditee's Response We agree with the auditor’s finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 10.561 COVID-19 - State Administrative Matching Grants for the Supplemental Nutrition Assistance Program 10.561 State Administrative Matching Grants for the Supplemental Nutrition Assistance Program 10.568 Emergency Food Assistance Program (Administrative Costs) 84.126 Rehabilitation Services Vocational Rehabilitation Grants to States 93.558 Temporary Assistance for Needy Families 93.563 Child Support Enforcement 93.568 COVID-19 Low-Income Home Energy Assistance 93.568 Low-Income Home Energy Assistance 93.658 Foster Care Title IV-E 93.659 Adoption Assistance 93.667 Social Services Block Grant 93.767 COVID-19 - Children's Health Insurance Program 93.767 Children's Health Insurance Program 93.778 COVID-19 - Medical Assistance Program 93.778 Medical Assistance Program State Agency: Department of Social Services (DSS) - Division of Finance and Administrative Services (DFAS) Type of Finding: Internal Control (Significant Deficiency) Compliance Requirements: Activities Allowed or Unallowed and Allowable Costs/Cost Principles As similarly noted in our 2 previous audits, DFAS controls and procedures to allocate some administrative costs to federal programs were not sufficient to prevent and/or detect errors. The DFAS did not include a type of fringe benefit costs in the AlloCAP system, totaling approximately $2.66 million during the year ended June 30, 2024. As a result, allowable costs were paid from state funding, that could have been allocated to federal funding for various federal programs. The DSS estimated such allowable costs to total approximately 30 percent, or $800,000. The DFAS Grants Unit uses the AlloCAP system to identify, measure, and allocate costs to state and federal programs in accordance with its Public Assistance Cost Allocation Plan (PACAP). The PACAP, which is governed by Regulation 45 CFR Section 95 Subpart E, is updated by the DFAS quarterly and periodically reviewed and approved by the DHHS - Division of Cost Allocation Services and various federal grantor agencies. Each quarter, DFAS personnel import expenditure data from SAM II, the state's accounting system, into the AlloCAP system, which allocates costs to programs through allocation methodologies outlined in the department's PACAP. Payroll and fringe benefit expenditure data is imported from quarterly SAM II system reports generated by the Office of Administration (OA). The quarterly OA payroll and fringe benefit expenditure reports for the 21-month period from July 2022 to March 2024, did not include expenditures associated with a retirement savings match fringe benefit offered to state employees beginning in July 2022. As a result, fringe benefit expenditures totaling approximately $2.66 million during the 9 months ended March 31, 2024, were not included in the AlloCAP system and allocated to various federal programs. DSS officials estimated the $2.66 million in costs not allocated during the year ended June 30, 2024, should have been allocated to 29 federal programs. DSS officials estimated the federal share of this amount to be approximately 30 percent, or approximately $800,000. Therefore, for the year ended June 30, 2024, an estimated $800,000 was paid from state funds that should have been paid from federal funds. These errors were not detected because DFAS cost allocation procedures do not include procedures, such as a reconciliation between the quarterly OA payroll and fringe benefit reports and the SAM II system, to ensure completeness and accuracy of the information imported to the AlloCAP system. After we notified the DSS of the errors, the DFAS worked with the OA to update the quarterly payroll and fringe benefit expenditure report to include previously unreported fringe benefit expenditures, and began allocating the costs to programs effective with the quarter ended June 30, 2024. The DFAS also revised the reports for the 9-month period ended March 31, 2024, and the year ended June 30, 2023, to allocate costs totaling approximately $2.66 million, and approximately $3.06 million, respectively, to the various programs. We do not question any federal costs associated with the errors identified in this finding because there were no resulting over-allocations. If this cost allocation issue had not been identified during the audit, the DSS could have continued to spend allowable costs from state taxpayer funds instead of claiming to federal funding sources. Without adequate internal controls and procedures over the allocation of administrative costs, there is increased risk that DFAS staff will not properly allocate an appropriate share of costs to federal programs, and that errors will not be detected timely. In addition, cost allocation errors could result in over-allocation of costs and potentially unallowable costs. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DSS through the DFAS continue to strengthen internal controls and procedures over the PACAP and the AlloCAP system to ensure costs are properly allocated to federal programs. Auditee's Response We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding. Auditor's Comment The DSS Corrective Action Plan (CAP) states the DSS disagrees the finding should be reported as an internal control finding and the DSS believes the data integrity error is not indicative of the strength of current internal controls for cost allocation. The CAP further states oversight or reconciliation of source data provided by business units outside the DFAS Grants Unit is not an internal control function or within the objectives of the DSS Internal Control Plan (ICP) for cost allocation or the DFAS Grants Unit. The CAP states this is because "[i]mplementation of appropriate separation of duties and other internal control processes ensure SAM II data is not entered or maintained by the DFAS Grants Unit." The CAP argues "internal control findings for cost allocation should be relative to the approved objectives, data elements and processes outlined in the ICP for cost allocation or for which there is functional control." While the DFAS Grants Unit is not responsible for source data prepared by other business units, it is responsible for adhering to the approved PACAP. Therefore, it is responsible for ensuring the reliability and validity of the source data and ensuring costs are properly allocated to federal programs. This is clearly stated in the DSS ICP, which states a DFAS Grants Unit objective is to "timely and accurately prepare and reconcile AlloCAP expenditures, payrolls and timesheets," and a related control activity is to "verify all source data documentation has been received timely and accurately for cost allocation processing and federal financial reporting." While segregation of duties is an important control activity within a strong internal control system, it does not replace or eliminate the need to implement control activities designed to ensure imported data is complete and accurate. The absence or insufficiency of such procedures increases the risk of reliance on inaccurate source data and continued cost allocation errors. If this cost allocation issue had not been identified during the audit, based on the errors during the 9-month period ended March 31, 2024, we estimate at least $1 million could have continued to be spent each year from state taxpayer funds instead of being claimed to federal funding sources.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 93.778 COVID-19 - Medical Assistance Program 93.778 Medical Assistance Program 2023 - 2305MO5MAP and 2305MO5ADM 2024 - 2405MO5MAP and 2405MO5ADM State Agency: Department of Health and Senior Services (DHSS) - Division of Senior and Disability Services (DSDS) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirements: Activities Allowed or Unallowed and Allowable Costs/Cost Principles As similarly noted in our prior audit report, the DSDS does not have effective controls to ensure Participant Choice Agreements are completed and retained for participants of the State Plan Personal Care (SPPC) program. Required documentation was not on file for 10 of 60 participants reviewed. The DSDS is responsible for the direct administration of various Medical Assistance Program (Medicaid) funded Home and Community Based Services (HCBS) programs for seniors and adults with disabilities, including the SPPC. During the year ended June 30, 2024, the DHSS made payments totaling approximately $1 billion on behalf of approximately 72,100 participants of the SPPC. As part of the initial assessment and annual reassessment process, DSDS personnel are required to ensure a Participant Choice Agreement (DA-3 form) was signed by the participant and the assessor, and uploaded to the CyberAccess web tool. The DSDS uses Participant Choice Agreements to comply with 42 CFR Section 441.725 that requires participants be provided information and given choices regarding their care and that written consent be obtained from the individual. Due to the COVID-19 Public Health Emergency (PHE), the DHHS - Centers for Medicare and Medicaid Services (DHHS-CMS) approved various requested temporary flexibilities to Medicaid requirements, effective March 2020 to May 11, 2023, including waiver of the written consent requirement and permitting documented verbal consent as an alternative. Assessments and reassessments are completed by either DSDS personnel or provider personnel. DSDS personnel perform quality assurance reviews of assessments and reassessments completed by provider personnel, and are required to ensure a signed Participant Choice Agreement was uploaded or (prior to May 11, 2023) verbal consent was documented. Once the Participant Choice Agreement is uploaded to the CyberAccess web tool by the assessor, the original agreement is not retained to prevent Health Insurance Portability and Accountability Act (HIPAA) breaches. The DSDS identified a weakness in the upload process that has prevented successful upload of some Participant Choice Agreements, and because the original agreements are not retained, there is no record of those agreements. To address this weakness, a DHSS special projects team was created in 2024 to identify and resolve missing agreements on a sample basis. These efforts are ongoing. To test compliance with federal requirements, we reviewed CyberAccess web tool records for 60 randomly-selected participants enrolled in the SPPC program during the year ended June 30, 2024. Of the 60 participants, 1 had a reassessment prior to May 11, 2023 (when documented verbal consent was permitted in lieu of the Participant Choice Agreement), and 59 had assessments/reassessments on or after that date. For the 59 participants with assessments/reassessments completed on or after May 11, 2023, a participant Choice Agreement was not retained in the CyberAccess web tool records for 10 (17 percent). Five of those assessments/reassessments were completed by DSDS personnel and 5 were completed by providers. Neither the DSDS quality assurance reviews nor the special projects team identified the missing agreements. DHSS officials were unable to determine whether Participant Choice Agreements were completed but not uploaded to the CyberAccess web tool due to the system upload problem, or never completed for these participants. DHSS officials indicated in addition to the CyberAccess web tool upload problem, the missing forms can be attributed to turnover during the PHE, the large number of new staff, and returning to pre-PHE processes. DHSS officials also stated the DSDS worked with a vendor to develop a new case management system to replace the CyberAccess web tool. The DSDS began using the system in May 2025. Without ensuring Participant Choice Agreements are completed and retained, the DSDS cannot demonstrate the participants were provided the proper choices in care services as required. Regulation 45 CFR Section 75.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DHSS through the DSDS continue to implement procedures to ensure a signed Participant Choice Agreement is completed and retained for all participants of the State Plan Personal Care program. The DSDS should identify and replace all missing Participant Choice Agreements with newly completed agreements. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Homeland Security - Federal Emergency Management Agency (FEMA) Federal Program: 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) 2017 - FEMA-4317-DR-MO 2019 - FEMA-4435-DR-MO and FEMA-4551-DR-MO 2020 - FEMA-4490-DR-MO and FEMA-4452-DR-MO 2021 - FEMA-4612-DR-MO and FEMA-4636-DR-MO 2022 - FEMA-4665-DR-MO 2023 - FEMA-4741-DR-MO 2024 - FEMA-4803-DR-MO State Agency: Department of Public Safety - State Emergency Management Agency (SEMA) Type of Finding: Internal Control (Material Weakness) and Material Noncompliance Compliance Requirement: Subrecipient Monitoring During state fiscal year 2024, the SEMA did not perform subrecipient monitoring reviews or review subrecipient single audit reports for the Disaster Grants - Public Assistance (Presidentially Declared Disasters) (DGPA) as required. The SEMA disbursed approximately $180 million to 320 DGPA program subrecipients during the year ended June 30, 2024. Regulation 2 CFR Section 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Regulation 2 CFR section 200.332(d) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Pass-through entities are required to follow up and ensure the subrecipient takes timely and appropriate action on all deficiencies detected through audits, on-site reviews, and other means. Regulation 2 CFR Section 200.332(f) requires pass-through entities to verify that every subrecipient has a single audit when it is expected that the subrecipient spent $750,000 or more during the subrecipient's fiscal year. The SEMA's tiered monitoring process, outlined in the SEMA's Risk Assessment Form and Recovery Division Monitoring Policy, requires risk assessments be performed 24 months after the disaster declaration for each subrecipient. Risk assessments are to evaluate various risk indicators and categorize each subrecipient as high, medium, or low risk. The risk category determines the required type and nature of monitoring required for the subrecipient. The policy requires on-site monitoring reviews for all high-risk subrecipients and desk reviews of 20 percent of medium-risk subrecipients. No additional action is required for low-risk subrecipients. The monitoring policy requires the SEMA to generate reports listing any deficiencies noted during on-site and desk monitoring reviews. The Monitoring Report will, if applicable, reflect any notice given to the subrecipient about delinquent reports, failure to submit proper documentation, and any issues noted during the review. The monitoring report also identifies the SEMA's and subrecipient's actions and plans to resolve the issue(s), by documenting a brief written plan and timeline for the resolution of the issues identified. When all issues have been resolved, the policy requires a follow-up letter and updated review report to be provided to the subrecipient. The monitoring policy further requires the SEMA during both the desk and on-site monitoring to review the subrecipient's financial and compliance audit reports. The SEMA's single audit compliance policy requires the SEMA to verify every subrecipient had a single audit when required. Once the single audit is reviewed and additional documentation is obtained, the SEMA will issue a Management Decision Letter. Monitoring reviews During state fiscal year 2024, the SEMA's Monitoring Specialist performed risk assessments for all 890 subrecipients of open projects; however, the SEMA did not perform the 190 monitoring reviews of these subrecipients as required by the monitoring policy. The following table shows the results of the risk assessments performed for that fiscal year, and the supervisory monitoring reviews required by federal regulation and SEMA policy. When subrecipient monitoring reviews are not performed as required by federal regulation and SEMA policy, there is increased risk that noncompliance with program requirements will go undetected. Subrecipient audits During state fiscal year 2024, the SEMA did not conduct the required review of single audit reports for applicable DGPA program subrecipients as required by SEMA policies and federal regulations. During September 2023, the SEMA sent letters to all subrecipients asking if they were required to have a single audit; but performed no further procedures such as ensuring subrecipients obtained the audits or reviewing and following up on audit reports. Each subrecipient that spent in excess of $750,000 in federal awards during its fiscal year must obtain a single audit in accordance with federal regulations within 9 months after the end of the fiscal year. In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure subrecipients received required audits and to review and follow up on the related audit reports, increases the risk that subrecipient noncompliance will not be identified and addressed. Conclusions SEMA personnel indicated the monitoring reviews and single audit reviews were not performed due to turnover and shortages in staff. Adherence to policies and procedures is necessary to ensure compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the non-federal entity to "[e]stablish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal regulations, SEMA policies and the terms and conditions of the Federal award." Recommendation The SEMA strengthen controls and procedures to ensure subrecipients of the DGPG are monitored in accordance with the monitoring policies and ensure policies are followed to ensure compliance with the monitoring requirements. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.