Audit 376229

FINDING 2024-200 The Commission did not comply with federal Matching, Level of Effort, and Earmarking grant requirements for the Rehabilitation Services-Vocational Rehabilitation Grants to States program. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Matching, Level of Effort and Earmarking Questioned Costs: Matching: $232,813 Known, Earmarking: $278,509 Known Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 34 CFR 361.60(a)(1) states that the federal share for expenditures made by the State under the vocational rehabilitation services portion of the Unified or Combined State Plan, including expenditures for the provision of vocational rehabilitation services and the administration of the vocational rehabilitation services portion of the Unified or Combined State Plan, is 78.7 percent. The State share for expenditures is 21.3 percent. Requirements in 34 CFR 361.62 state that to maintain a level of nonfederal share it provided in the previous federal fiscal year is at least equal to the total nonfederal share provided by the State two years prior. Section 110(d)(1) of the Rehabilitation Act of 1973 (Rehabilitation Act), as amended by the Workforce Innovation and Opportunity Act (WIOA), requires a state to reserve at least 15 percent of its state allotment, under the State Vocational Rehabilitation (VR) Services grant (Assistance Listing 84.126), for the provision of pre–employment transition services to students with disabilities under section 113 of the Rehabilitation Act. Condition: Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. In State fiscal year 2024, there were 3 grants open – federal fiscal years 2022, 2023, and 2024. The federal fiscal year 2022 grant period was October 1, 2021, to September 30, 2023, and was the only grant period that concluded within State fiscal year 2024. We evaluated the Commission’s compliance with the matching, level of effort, and earmarking requirements for the fiscal year 2022 grant. Matching The Commission is required to provide at least 21.3 percent of total rehabilitation program spending from nonfederal sources as a match. We reviewed the amounts reported as federal and State expenditures on the Commission’s final RSA-17 report for the federal fiscal year 2022 grant. The Commission reported the federal share as $2,954,061 and the State matching expenditures as $835,255, which calculates as 22 percent of total program expenditures and meets match requirements. We compared the amounts reported on the RSA-17 report to the expenditures in the former statewide accounting system (STARS) in State fiscal years 2022 and 2023 and the current statewide accounting system (Luma) in State fiscal year 2024. We verified that the federal expenditures matched the RSA-17 report; however, the State expenditures reported internally were only $566,698, which calculates as 16.1 percent of total program expenditures and does not meet match requirements. The Commission could not provide documentation to support the amounts reported in the RSA-17 report. To calculate questioned costs, we verified that the federal share of expenditures matched the amounts reported in Luma. We calculated the matching requirement by dividing the federal expenditures by the federal participation rate, and then subtracting the federal share to arrive at the state share ($2,954,061 / 0.787 = $3,753,571.79 - $2,954,061 = $799,511). We then compared the required state match amount to the state expenditures in Luma and the result was the Commission expended $232,813 less than the required matching amount ($799,511 - $566,698 = $232,813). Level of Effort Maintenance of effort is one part of the level of effort grant requirements. The Commission is required to spend at least the amount of State funds expended in the fiscal year two years prior. We compared State expenditures for the federal fiscal years 2020 and 2022 grants based on amounts reported on the RSA-17 reports. The State expenditures reported for the federal fiscal year 2020 grant on the September 30, 2021, RSA-17 report were $835,255, and the expenditures reported for the federal fiscal year 2022 grant on the September 30, 2023, RSA-17 report were $835,255 indicating that the maintenance of effort requirement was met. We compared the amounts reported on the RSA-17 report to the expenditures in STARS for State fiscal years 2022 and 2023 and Luma for State fiscal year 2024. The State expenditures for the federal fiscal year 2020 grant were $468,147 and for the federal fiscal year 2022 grant were $566,698, which also indicates that the Commission met maintenance of effort requirements, but the Commission could not provide documentation to support the amounts reported in the RSA-17 reports. Earmarking The Commission is required to spend at least 15 percent of the total federal grant expenditures on the Pre-Employment Transition Services (pre-ETS) program. We identified the total federal grant expenditures in Luma as $2,954,061 and the amount spent on pre-ETS as $164,600, which calculates to 5.57 percent of total spending, indicating that the Commission did not meet earmarking requirements. To calculate questioned costs, we multiplied the total federal grant expenditures by 15% and then subtracted the Pre-ETS amount of expenditures in Luma and found that the Commission expended $278,509 less than the required earmarking amount ($2,954,061 * .15 = $443,106 – $164,600 = $278,509). Cause: Each month, the Commission uses a spreadsheet to calculate its cost allocations in accordance with its cost allocation plan (CAP). This spreadsheet includes calculations to track federal and State expenditures and compliance with matching, level of effort, and earmarking requirements. The CAP spreadsheet is prepared by one person and reviewed by a second person. However, this process did not identify the errors indicating that the staff completing these reviews did not have adequate knowledge to ensure this internal control was effective. Effect: Noncompliance with matching and earmarking requirements could result in a reduced federal award amount in future fiscal years. The Commission’s internal control procedures did not include maintaining documentation to support amounts reported for the matching, level of effort, and earmarking requirements which could lead to future errors. Recommendation: We recommend that the Commission design and implement procedures to monitor compliance with matching, level of effort, and earmarking requirements and retain documentation to support compliance. Providing appropriate training and staff recruitment is critical to ensuring that internal controls are effective in preventing or detecting errors. Additionally, we recommend the Commission contact the federal grantor to resolve the noncompliance with matching and earmarking requirements. Management’s View: Agree - The Cost Allocation Plan (CAP) needs to be updated, resubmitted, and approved through RSA. We also agree that ICBVI needs to provide clear documentation to support the numbers in our CAP. ICBVI has reviewed its documentation and believes we met the federal Matching, Level of Effort, and Earmarking requirements for the Rehabilitation Services-Vocational Rehabilitation Grants to States program. Corrective Action: • Matching and Maintenance of Effort (MOE): ICBVI uses a monthly/semi-monthly CAP process to determine the level of federal draw for reimbursement. These draw amounts are based on the necessary monthly amounts (1/12) of the required 21.3% of the total grant award + match, OR the MOE amount from 2 years prior (whichever is greater). This CAP process keeps track of the Grant Total, Draws to Date, To be Drawn, State Portion, and Match/MOE amount YTD. It is through this systematic monthly process that we calculate what the allowable direct and indirect State expenditures are and will make draws that allow us to reach the Match/MOE targets. Based on our documentation, we have made our Match and MOE amounts for the years in question. Documentation supporting the reported amounts can be found in the CAPs from any FFY. • Earmarking: Allowable expenditures for Pre-Employment Transition Services (Pre-ETS) are also tracked in the CAP. Documentation to support amounts reported can be found in the CAPs from any FFY. • CAP Update and Approval: We have a meeting scheduled with the Director of the Indirect Cost Division at the US Dept of Education on 12/10/25. The CAP will be revised to reflect the current chart of accounts and reporting parameters of the Luma system. We will be submitting an updated CAP for review and approval. • Documentation: All expenditure data and supporting documentation will be sourced directly from Luma and retained for verification. • Internal Controls and Training: ICBVI will continue to improve its internal control procedures to include periodic training and cross-training on compliance requirements, ensuring reviews are substantive and error detection is robust. ICBVI will also seek further guidance from the federal grantor and will document all correspondence and remedial efforts. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. We continue to assert that the Commission did not provide documentation to support the amounts included on the RSA-17 reports and used to calculate compliance with matching and earmarking requirements. As a result, the only available financial information supports that the Commission did not comply with matching and earmarking requirements. We also want to emphasize that the Commission should work with the federal grantor to determine how to rectify the noncompliance.

FINDING 2024-201 Multiple errors were identified in the amounts reported on the Rehabilitation Services Administration (RSA) reports required for the Rehabilitation Services-Vocational Rehabilitation Grants to States. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Reporting Questioned Costs: None Criteria: The Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.400 contains the policy guide for cost principles related to federal grant administration. Paragraph (a) states that the nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. Paragraph (d) states that the accounting practices of the nonfederal entity must be consistent with these cost principles and support the accumulation of costs as required by the principles and must provide for adequate documentation to support costs charged to the federal award. Section CFR 200.302 – Financial Management states that federal award recipient’s financial management system must identify all federal awards received and expended and the federal programs under which they were received. Additionally, they must maintain records that sufficiently identify the amount, source, and expenditure of federal funds for federal awards. These records must contain information necessary to identify federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: The RSA requires the Commission to submit financial reports quarterly. The reports are cumulative and cover the entire grant period through to the end of the reporting period. The RSA also requires a final report at the end of the grant period. The Vocational Rehabilitation Basic Services (BS) Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. The Commission identifies the grant periods using the initials BS and the last two digits of the grant year. During State fiscal year 2024, there were three grants open: BS22, BS23, and BS24. We tested four quarterly reports that reported on the periods within State fiscal year 2024. We identified errors in 3 of the 4 quarterly reports. We also identified errors in the final report for the federal fiscal year 2022 grant which ended on September 30, 2023. The following errors were identified: BS23 – Report Period July 1, 2023, to September 30, 2023 • Line 21 Total Federal Program Income Received: The reported amount was $47,300, and the supporting documentation showed $43,700, resulting in a $3,600 overstatement. This error carried forward to all subsequent quarterly reports because the amounts reported were cumulative. • Line 38A Required Pre-ETS Services Provided: The amount reported was $47,755. The Commission could not provide any documentation to support that amount or provide an explanation for how the amount was calculated. This error carried forward to all subsequent quarterly reports because the amounts reported were cumulative. • Line 38B Authorized Pre-ETS Services Provided: The amount reported was $73,708. The Commission could not provide any documentation to support that amount or provide an explanation for how the amount was calculated. This error carried forward to all subsequent quarterly reports because the amounts reported were cumulative. • Line 39G Transition Services to Youth and Students: The amount reported was $211,595; however, the supporting schedule showed $199,194 resulting in a $12,401 overstatement. The Commission included expenditures outside of the reporting period. • Line 41 Total Innovation and Expansion Expenditures: The amount reported was $20,943. The Commission could not provide any documentation to support that amount or provide an explanation for how the amount was calculated. BS23 – Report Period October 1, 2023, to December 31, 2023 • Line 39G Transition Services to Youth and Students: The amount reported was $211,594; however, the supporting schedule showed $227,249 resulting in a $15,655 understatement. The Commission included expenditures outside of the reporting period. • Line 41 Total Innovation and Expansion Expenditures: The amount reported was $20,943; however, the supporting schedule showed $10,472 resulting in a $10,471 overstatement. BS23 – Report Period January 1, 2024, to March 31, 2024 • Line 39E Business Enterprise Program (Randolph-Sheppard Program): The reported amount was $383,399; however, the supporting schedule showed $383,399 resulting in a $46,380 overstatement. • Line 39G Transition Services to Youth and Students: The amount reported was $254,977, however, the supporting schedule showed $249,977 resulting in a $4,303 overstatement. The Commission included expenditures outside of the reporting period. BS22 – Report Period October 1, 2021, to September 30, 2023 (Final report for federal fiscal year 2022 grant) • Line 21 Total Federal Program Income Received: The reported amount was $0; however, the supporting schedules showed $43,700 resulting in a $43,700 understatement. • Line 37 Administrative Expenditures: The reported amount was $853,677; however, the supporting schedules showed $1,399,438 resulting in a $545,761 understatement. • Line 38A Required Pre-ETS Services Provided: The reported amount was $302,972; however, the supporting schedules showed $287,258 resulting in a $15,714 overstatement. • Line 38B Authorized Pre-ETS Services Provided: The reported amount was $44,151; however, the supporting schedules showed $75,110 resulting in a $30,959 understatement. • Line 39E Business Enterprise Program (Randolph-Sheppard Program): The reported amount was $372,887; however, the supporting schedule showed $438,558 resulting in a $65,671 understatement. • Line 39G Transition Services to Youth and Students: The amount reported was $91,966; however, the supporting schedule showed $76,407 resulting in a $15,559 overstatement. • Line 41 Total Innovation and Expansion Expenditures: The amount reported was $104,647; however, the supporting schedule showed $83,903 resulting in a $20,744 overstatement. We also noted an error while testing compliance with the Matching and Level of Effort requirements using amounts reported on the final RSA-17 report for the federal fiscal year 2022 grant. The Commission reported $835,255 as total State expenditures; however, the amount recorded in STARS was $566,698, resulting in a $268,557 overstatement. Cause: The Commission has designed a procedure to detect errors in reporting prior to issuance. The reports are compiled by one individual and reviewed by a second individual prior to issuing them to the federal agency. However, the review did not detect the errors indicating that the staff completing these reviews did not have adequate knowledge to ensure this internal control was effective. Our testing found that two of the three quarterly reports with errors were not reviewed prior to submission. The Commission could not provide an explanation for the errors. Effect: The RSA uses the RSA-17 reports to determine compliance with federal statutes, regulations, and the terms and conditions of the federal award. Incorrect reporting can affect both the ability to cover current obligations and the amount of future federal grant awards received by the State of Idaho. The total errors in the quarterly reports were overstatements of $219,561 and understatements of $15,655. The total errors in the final report for the federal fiscal year 2022 grant were overstatements of $271,578 and understatements of $701,746. The aggregated errors are a $229,262 understatement of costs. Recommendation: We recommend that the Commission design and implement procedures to ensure accurate federal grant reporting and retain appropriate documentation to support the amounts reported. We also recommend that the Commission review prior submissions, identify correct reporting, and communicate with the federal grantor about resubmitting corrected reports. Providing appropriate training and staff recruitment is critical to ensuring the internal controls are effective in preventing or detecting errors. Management’s View: Agree - These errors in quarterly and final RSA-17 reports are acknowledged, and immediate measures are being taken to address root causes Corrective Action • Accurate Financial Reporting: ICBVI will develop detailed procedures to ensure all amounts reported on federal forms are reconciled to supporting documentation in the accounting system (Luma) prior to submission. • Review and Oversight: A two-person review process will be formalized, ensuring every report is checked for accuracy by a knowledgeable reviewer before submission. • Documentation and Training: Supporting documentation for all line items will be archived securely. Staff will receive training in federal grant reporting standards. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2024-202 The Cost Allocation Plan (CAP) used in fiscal year 2024 was not approved by the RSA as required and contained multiple errors. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Allowable Costs/Cost Principles Questioned Costs: $210,203 Known Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.400 contains the policy guide for cost principles related to federal grant administration. Paragraph (a) states that the nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. Paragraph (d) states that the accounting practices of the nonfederal entity must be consistent with these cost principles and support the accumulation of costs as required by the principles and must provide for adequate documentation to support costs charged to the federal award. The U.S. Code of Federal Regulations (CFR) Title 34 contains the regulations of the offices of the U.S. Department of Education, including the Rehabilitation Services Administration (RSA). Title 34 CFR § 76.560 (b) states: A grantee must have a current indirect cost rate agreement to charge indirect costs to a grant. Title 2, Subtitle A contains the Office of Management and Budget Guidance for Grants and Agreements. Title 2 CFR § 200 Appendix VII part 3 states: Indirect Cost Allocations Not Using Rates: In certain situations, governmental departments or agencies (components of the governmental unit), because of the nature of their Federal awards, may be required to develop a cost allocation plan that distributes indirect (and, in some cases, direct) costs to the specific funding sources. In these cases, a narrative cost allocation methodology should be developed, documented, maintained for audit, or submitted, as appropriate, to the cognizant agency for indirect costs for review, negotiation, and approval. Condition: The Commission uses a CAP to allocate indirect costs among its various programs that should be certified annually by the RSA. The CAP used by the Commission in fiscal year 2024 was not submitted to the RSA for recertification until April 2025 after we inquired about the certification process and documentation for the CAP. Additionally, this CAP was created to be used with data from STARS and no changes were made to coincide with changes in the chart of accounts and reporting available in Luma. The Commission uses a spreadsheet to calculate the indirect costs in accordance with its CAP. This spreadsheet is prepared each month and also keeps track of total spending for federal grants and calculates the amount of federal draws. We tested 4 of the 12 (33 percent) CAP spreadsheets from State fiscal year 2024 to verify that the expenditure amounts used in the calculations tied to support in Luma. One of the CAP spreadsheets reported monthly expenditures of $703,475; however, reports from Luma showed expenditures of $454,004, which is a difference of $249,471. The Commission could not provide documentation or an explanation to support the difference. Cause: The Commission did not have a procedure in place to review the CAP and submit it for recertification annually as required. The Commission has used the CAP spreadsheet for many years, and it has been changed and prepared by multiple personnel, many of whom no longer work for the Commission. The spreadsheet includes multiple tabs, many formulas, cells with hard coded amounts, and no restrictions or controls on data entry. This creates an environment where data entry errors could be made, or a formula could be overridden, and the errors would be difficult to detect. The primary internal control that the Commission relies upon is that the CAP spreadsheet is prepared by one person and reviewed by a second person. However, this control has been ineffective in preventing errors from occurring. Effect: The CAP used by the Commission was not properly submitted for recertification, was not properly modified for Luma, and was not reviewed for accuracy resulting in multiple errors. The Commission has drawn excess federal funds due to the reliance on inaccurate spreadsheets that are not supported by Luma. The reported expenditures of $703,474 were adjusted down by $95,065 for a new total of $608,409, which was also not supported by the accounting records. This amount, run through the CAP resulted in a draw calculation of $512,644, which is 84 percent of $608,409. To calculate the possible overdraw, we started the allowable calculation with the expenditures identified in Luma of $454,004, less the $95,065 adjustment equaling $358,839 of allowable costs, multiplied by the 84 percent CAP estimation is $302,441 for a possible overdraw of $210,203 ($512,644 - $302,441). Our estimation of the error is based on total program expenditures in Luma for November 2023. The Commission could not provide documentation to support various amounts included in the November CAP calculation and could not explain the reason for the differences. If support for adjustments made was available, the amount of the error may have been reduced. Recommendation: We recommend that the Commission work with the federal grantor, the Rehabilitation Services Administration (RSA), to establish an indirect cost rate plan based on Luma reporting. We further recommend that the Commission design and implement procedures to ensure the indirect cost rate plan is implemented as designed and to ensure that future plans are submitted and approved timely and appropriate supporting documentation is retained. We also recommend that the Commission work with the federal grantor to resolve the questioned costs due to unsupported expenditures. Management’s View: Agree - ICBVI recognizes it did not submit its Cost Allocation Plan for annual recertification as required and that the CAP contained errors due to transition challenges with the new accounting software (Luma). Corrective Action: • CAP Update and Approval: The CAP will be revised to reflect the current chart of accounts and reporting parameters of the Luma system. We have a meeting scheduled with the Director of the Indirect Cost Division at the US Dept of Education on 12/10/25. We will be submitting an updated CAP for review and approval. Annual submission for federal recertification will be scheduled and tracked. • Documentation: All expenditure data and supporting documentation will be sourced directly from Luma and retained for verification. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. We would like to clarify that some of the errors in the CAP were related to the transition to Luma, however many errors occurred because of a lack of internal controls such as reviews for accuracy, protected cells, and detailed procedures. It is important that the Commission address all of the reasons the CAP was unreliable to ensure only appropriate supported costs are charged to federal grants.

FINDING 2024-203 The Commission is not following Idaho Administrative Rules for Purchasing as required for compliance with the requirements applicable to the Rehabilitation Services-Vocational Rehabilitation Grants to States program. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement, and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The CFR procurement standards at 2 CFR 200.317 state that, when procuring property and services under a federal award, a state must follow the same policies and procedures it uses for procurements from its nonfederal funds. The state of Idaho purchasing rules within the Idaho Administrative Procedures Act (IDAPA) contain the following provisions: IDAPA 38.05.01.32. Total Cost: The acquisition cost of property, including all components, options, and add-ons available under the contract, related services, and, in the case of ongoing services, the cost of the full term of the contract, including all authorized renewals. Unless a different total term is provided in the contract, the term used for purposes of total cost is five (5) years. IDAPA 38.05.01.041. Acquisition Procedures: • Small Purchases: Services with less than $25,000 total cost; software with less than $15,000 total cost; property with less than $15,000 total cost; a mix of property and services less than $15,000. o Small purchases do not require acquisition through competitive solicitation. Agencies must comply with the division’s small purchase policy. Property available under single agency or open contracts shall be purchased under such contracts and are not a small purchase under this rule unless otherwise authorized by the administrator. • Informal Purchases: Acquisition of property with a total cost exceeding the dollar limits established in this rule for a small purchase and less than the formal sealed procedure limit are informal purchases. o Informal Purchases may be made using:  An informal solicitation issued through e-procurement, unless exempted by the administrator; or  The formal sealed procedure, when the purchasing authority makes a written determination that using a formal solicitation is in the best interest of the state, including where selection based solely on cost is not appropriate. o Agencies procuring property under this rule shall maintain a purchasing file containing:  The solicitation document posted and quotes received. If the acquisition was not publicly posted, the agency shall include a statement describing the justification for determining that posting was impractical or impossible, along with the administrator’s authorization.  If not using e-procurement, the agency shall document the quotes received (or its attempt to obtain quotes) from at least three (3) vendors having a significant Idaho economic presence as defined in Section 67-2349, Idaho Code. • Formal Sealed Procedure: o The sealed procedure limit is one hundred fifty thousand dollars ($150,000). o Purchases of property in excess of the sealed procedure limit are made using the formal sealed procedure, unless exempted by these rules or the administrator. IDAPA 38.05.01.042.01. Exceptions requiring written administrator approval. The administrator may exempt the following purchases from the requirement for competitive solicitation by issuing a written determination to the purchasing authority. • Rehabilitation Agency Acquisitions. Acquisitions of property that is provided by non-profit corporations and public agencies operating rehabilitation facilities serving the handicapped and disadvantaged and that is offered for sale at fair market price as determined by the administrator in accordance with these rules. The buyer must submit a written request to the administrator to purchase from a rehabilitation agency and a written approval from the administrator. The purchase must comply with the division’s policy for rehabilitation agency acquisitions. Condition: We identified two vendors that the Commission paid more than $25,000 in total expenditures in fiscal year 2024 and would be subject to compliance with procurement requirements. We tested payments to those vendors for compliance with procurement policies and found that the Commission could not provide documentation to show that State procurement policies were followed. Cause: The Commission erroneously believed that the exemption for rehabilitation agencies applied to more vendors than just not-for-profit entities and public agencies. The Commission also believed that the State purchasing policies did not apply to vendors with many small purchases that are individually below, but collectively exceed, the purchasing thresholds. The Commission has control procedures in place to ensure that grant expenditures are for allowable activities and costs at the transactional level but did not have control procedures to ensure that State procurement rules were followed. Effect: The State’s purchasing policies are designed to ensure that State and federal funds are expended efficiently to meet the goals of State and federal programs. By not following these policies, the Commission could be overpaying for products and services. Recommendation: We recommend that the Commission design and implement procedures to ensure that State purchasing policies are followed. We further recommend that the Commission design and implement procedures to ensure that appropriate documentation is retained to demonstrate compliance and internal controls were operating as intended. Management’s View: Agree - ICBVI acknowledges the failure to document compliance with state procurement policies for select vendors. Corrective Action: • Policy Clarification: ICBVI will ensure future purchases above the threshold are fully documented in accordance with state requirements. • Procedural Update: A procurement checklist and documentation template will be added to internal controls to support purchases subject to state policy. We have a training setup with DOP on 12/18/25 to help with correcting this deficiency. Upon completion of this training, we will conduct comprehensive internal training for all ICBVI staff to ensure consistent understanding and compliance with state procurement requirements. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2024-204 The Commission did not verify that vendors were not suspended or debarred prior to making federal grant payments. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement, and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Nonfederal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Condition: We identified two vendors that the Commission paid more than $25,000 in total expenditures in fiscal year 2024. We tested compliance with procurement policies for both vendors and found that the Commission could not provide documentation to show that suspension and debarment verifications were completed as required. Cause: The Commission was not completing the suspension and debarment checks because they incorrectly believed that the checks were already being performed by the Office of the State Controller. Effect: We reviewed all vendors selected as part of our testing and verified that none of the vendors were on the SAM list as suspended or debarred. However, the Commission does not have adequate controls in place to ensure it is not entering into covered transactions with suspended or debarred vendors. Vendors can be suspended or debarred for many reasons including financial crimes such as fraud, embezzlement, or bribery, and other issues such as consistent poor performance on previous contracts or violations of laws. Taking steps to ensure vendors are not suspended or debarred is important to prevent fraud, waste, and abuse. Recommendation: We recommend that the Commission develop and implement procedures to ensure that it is not entering into covered transactions with suspended or debarred vendors and retain documentation to support the procedures performed. Management’s View: Agree - ICBVI recognizes the absence of vendor suspension/debarment verifications prior to payment. Corrective Action: • Verification Process: Procedures will be put in place to check applicable vendors against the SAM.gov database on an annual basis. Documentation of each check will be retained and periodically reviewed. • Staff Training: Relevant staff will be trained on suspension/debarment requirements, and responsibility for checks will be clearly assigned. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2024-205 The Commission could not provide documentation to support the review of the Schedule of Expenditures of Federal Awards (SEFA) Closing Package. Type of Finding: Material Weakness Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A220017, H126A230017, H126A240017 Program Year: October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b ) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Additionally, 2 CFR 200.510 requires the State to prepare the SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Commission prepared the SEFA closing package as required but could not provide documentation to show that the closing package was reviewed for accuracy prior to submission. Cause: One Commission employee was listed as the preparer and submitter for the SEFA closing package. Luma did not prevent the same person from preparing and submitting the closing package. The Commission was under pressure to submit the closing package timely and did not document a review process. Effect: We did not detect any errors in the SEFA closing package; however, without a detailed and documented review, errors could be made and remain undetected. Recommendation: We recommend that the Commission design and implement procedures to accurately record, compile, and document the amounts reported in the SEFA closing package and to retain documentation supporting the amounts reported. Management’s View: Agree - ICBVI acknowledges that it did not document the review process for the SEFA closing package. Corrective Action: • Review Documentation: Procedures will be implemented requiring a documented review prior to submission, with signatures from both preparer and reviewer and archiving of supporting schedules. • Procedural Update: We will ensure that the preparer and reviewer/approver are assigned to different individuals for closing packages going forward. This separation of duties will be incorporated into our procedures to strengthen internal controls and enhance the accuracy and integrity of our financial reporting. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2024-206 The Department did not complete required reports for the Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Federal Award Number: CPFFN0170 Program Year: February 4, 2022 – December 31, 2026 Federal Agency: Department of the Treasury Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that non-federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include reliable financial reporting and compliance with applicable laws and regulations. In addition, the FFATA, as codified in 2 CFR Part 170, requires that subawards of $30,000 or more be reported to the FFATA Subaward Reporting System (FSRS). Condition: The FFATA was developed to provide better transparency over management of federal grants and contracts. Reporting is required for subawards or contracts in excess of $30,000 through the FSRS website. The Department issued 15 subawards for the Capital Projects Fund program (Assistance Listing # 21.029) in fiscal year 2024 with anticipated expenditures in excess of $30,000 each. The Department presumed the Capital Projects Fund program was exempt from FFATA reporting because guidance for this program was provided in conjunction with guidance for another federal program that was exempt from FFATA reporting. Additionally, the FSRS was inaccessible for reporting purposes due to a technical configuration problem until August 2023. However, the configuration problem was corrected in August 2023, and the U.S. Department of the Treasury requested all recipients complete their FFATA reports by June 30, 2024. The Department did not comply with this request. Cause: The Department staff were not aware of the FFATA reporting requirements for the Capital Projects Fund program, nor did they implement internal controls to ensure the accurate and timely submission of the FFATA reports. Effect: The FFATA reports are required to be submitted to the FSRS, which makes the information available to the public in a searchable database. Late reporting, or non-reporting, impacts the integrity of the federal transparency information. Additionally, ineffective internal controls increase the risk that errors or noncompliant reporting could occur and remain undetected. Recommendation: We recommend that the Department design and implement internal controls procedures to ensure an understanding of compliance requirements applicable to grants received and with FFATA requirements for submitting accurate and timely FFATA reports. Management’s View: The Department agrees with this finding. Corrective Action: 1. Multiple RFPs were issued to obtain subject matter experts support for Grant Accounting Support and Grant Administration Support. Internal discussions determined the need for more accounting, administration, and grant management support. Below is our status for support through public procurement. a. The Grant Accounting support was awarded October 2025. b. Procurement of Grant Administration support is in the end stages of award. 2. Updated Procedures (Implemented – April 2025) a. The Department has updated its Notice of Award procedures to explicitly include FFATA reporting as a required step once a Federal grant agreement is fully executed. This requirement is now documented in agency procedures, internal checklists, and award processing workflows. 3. Assignment of Responsibility (Implemented – April 2025) a. Responsibility for FFATA compliance has been formally assigned to the Grants and Contracts Officer with the contracted administrative grant support, with assistance provided from the contracted accounting support when necessary. Their duties now include: i. Completing required FFATA submissions following award execution, and ii. The process has now been added to our internal processes and procedures and updated with staff. 4. Quarterly Monitoring and Verification (April - 2025) a. To prevent recurrence, Grants and Contracts Officer will conduct a quarterly review of all Federal Grant programs to ensure: i. All applicable awards are listed in the FFATA, ii. No required submissions have been omitted. iii. Any discrepancies are corrected promptly. iv. These quarterly reviews will be documented and retained for audit and internal monitoring purposes. 5. Training and Staff Communication (In Progress — Completion in February 2026 a. Training began in April 2025 and was expanded in October 2025 with support from our Grant Accounting Contractor. The contractor assists in finalizing accounting, reporting, and compliance with OMB guidance. They provide training, updated procedures, and staff guidance. Updated procedures and training will be completed in conjunction with our contractor’s subject matter expertise. Updated policies, training materials, and procedural guidance will be completed and fully implemented in February 2026, with training documented and provided to all Grants and Contracts Officers, contracted services, and relevant program personnel. The training includes but is not limited to: a. All Federal reporting requirements (including FFATA) b. Applicable CFR compliance obligations. c. Newly implemented internal controls and review procedures. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-207 The summary schedule of prior findings required by Uniform Guidance did not accurately include all information required by section 2 CFR 200.511(b). Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Supplemental Nutrition Assistance Program; Highway Planning and Construction Grant; Coronavirus State and Local Fiscal Recovery Fund; Education Stabilization Fund - ARPA ESSER III; Special Programs for the Aging, Title III, Part B Grants for Supportive Services and Senior Centers; Special Programs for the Aging, Title III, Part C, Nutrition Services; Nutrition Services Incentive Program; Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises; Temporary Assistance for Needy Families; Low-Income Home Energy Assistance; Child Care and Development Block Grant; Foster Care Title IV-E; Adoption Assistance; Child Care and Development Block Grant (CCDF); State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program; Medical Assistance Program; Assistance Listing Number: 10.561; 20.205; 21.027; 84.425U; 93.044; 93.045; 93.053; 93.391; 93.558; 93.568; 93.575; 93.658; 93.659; 93.775; 93.777; 93.778; Federal Award Number: Various Program Year: Various Federal Agency: Various Questioned Costs: None Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include risk assessment, control activities, and information and communication. Risk assessment is the identification and analysis of various risks entities face because of changing economic, industry, regulatory, and operating conditions and provides a basis to develop appropriate responses to manage those risks. Control activities are policies and procedures that help ensure management directives are carried out and risks are mitigated. Verifications, approvals, reconciliations, authorizations, and segregation of duties are all control activities that support this objective. Information and communication relate to obtaining quality information and effective internal and external communication of that information to achieve management objectives. The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 2 CFR 200.511(a)) states that the auditee is responsible for follow-up and corrective action on all findings. As part of this responsibility, the auditee must prepare a summary schedule of prior audit findings. Section 2 CFR 200.511(b) requires that the summary schedule of prior findings report the status of all audit findings included in the prior audit’s schedule of findings and questioned costs. Additionally, section 2 CFR 200.511(b)(2) requires that when audit findings were not corrected or only partially corrected, the summary schedule must describe the reasons for the findings’ recurrence, planned corrective action, and any partial corrective action taken. Condition: The summary schedule of prior findings reported incorrect statuses for prior findings reported for the 2023 Single Audit Report and a prior finding Internal Control Report for the fiscal year audit of the fiscal year 2023 Annual Comprehensive Financial Report (ACFR). The summary schedule prepared by the Office included the following finding statuses for which its determination differed from the determination made by the auditor after completing follow-up procedures: Idaho Department of Correction: • 2023-203: Office determination – Not Corrected. Based on follow-up procedures completed, the Department of Correction had designed a new process in March 2024 which was implemented for fiscal year 2024 reporting. Audit determination – Corrected. Idaho Department of Environmental Quality: • 2023-206: Office determination – Corrected. Based on follow-up procedures completed, the Department of Environmental Quality did not document their evaluation of each subrecipients risk of noncompliance with a subaward as required by Uniform Guidance for 13 of 13 subrecipients tested. Audit determination – Not Corrected Department of Health and Welfare: • 2023-210: Office determination – Corrected. Based on follow-up procedures completed, the Department did not include a review or approval for 2 of 8 reports tested. Audit determination – Not Corrected • 2023-211: Office determination – Corrected. Based on follow-up procedures completed, the review and approval of the LIHEAP benefits matrix do not go into effect until fiscal year 2025 and the process is to be implemented prior to the beginning of the new federal fiscal year beginning October 1, 2024. Audit determination – Not Corrected • 2023-212: Office determination – Corrected. Based on follow-up procedures, the LIHEAP earmarking review process did not go into effect until fiscal year 2025, as per the documented approval email on November 11, 2024. Audit determination – Not Corrected • 2023-222: Office determination – Corrected. Based on follow-up procedures, the Department was unable to locate the risk assessment for 2 out of 6 subrecipients tested. Audit determination – Not Corrected Idaho Transportation Department • 2023-226: Office determination – Partially Corrected. Based on follow-up procedures, the Department provided correspondence from the Federal Highway Administration (FHWA) showing that the finding had been closed at the federal level as of March 2025. Audit determination – Corrected The summary schedule of prior findings for the single audit also did not explicitly provide a reason for recurrence for findings 2023-201, 2023-203, 2023-208, 2023-223, 2023-224, and 2023-226, as required. Additionally, the summary schedule of prior findings for the single audit did not include follow upfollow-up work for the following findings: Commission on Aging: • 2022-201 which remained Partially Corrected in the 2023 single audit. Based on follow-up procedures, the Commission did not submit timely 5 of 5 reports tested that were submitted after March 2024 and were due by June 30, 2024. The Commission has created a workbook to track awards and reporting dates, with reporting period end dates and due dates added to fiscal calendars, but continues working to catch up on their federal reporting. Audit Determination – Partially Corrected. State Department of Education: • 2022-205 which remained Partially Corrected in the 2023 single audit. Based on follow-up procedures, a sample of 20 fiscal year 2024 ESSER transactions were tested for proper controls, to ensure transactions were for allowable activities, and to ensure transaction information agreed to supporting documentation. No deviations were noted. Audit Determination – Corrected. The ACFR prior finding follow-up included the following finding status determination, which differed between the Office determination and the audit determination. Office of the State Controller: • 2023-103: Office determination – Corrected. Based on follow-up procedures, we were able to see additional processes were added in the fiscal year 2024 ACFR, but were not sufficient to detect or prevent significant misstatements in the 2024 ACFR Audit Determination – Not Corrected Additionally, the ACFR prior finding follow-up did not include follow-up work for the following finding: Idaho State Tax Commission: • 2022-105: for the Idaho State Tax Commission. Based on follow-up procedures, the amount of Restricted Cash was understated in fiscal year 2024 closing packages. Audit Determination – Not Corrected. Cause: The Office did not complete follow-up procedures until the audit work was completed, and the report was in process. Additionally, Office procedures to complete the review are not well documented or properly designed to properly determine the status of prior findings or to ensure a clear reason for recurrence was provided for findings that were not corrected. Effect: The summary schedule of prior findings does not adequately report all the information required by Uniform Guidance. Recommendation: We recommend that the Office design and implement follow-up procedures to accurately and timely determine if prior findings have been corrected. We also recommend that the Office improve review procedures to ensure the summary schedule of prior findings includes all information required by Uniform Guidance. Management’s View: The State Controller’s Office acknowledges and agrees with this finding. Corrective Action: The office will work closer with the agencies to ensure we get the same information provided to the auditors and have the correct statuses along with the needed information when not corrected. The office will also dedicate a position to the findings follow up and corrective action plans from other agencies. Auditor’s Concluding Remarks: We thank the Office for its cooperation and assistance throughout the audit.

FINDING 2024-208 The Department does not have documented internal controls functioning as intended for the Title I Grants to Local Educational Agencies (Title I) annual allocation process increasing the risk of errors occurring and going undetected. Type of Finding: Significant Deficiency Assistance Listing Title: Title I Grants to Local Educational Agencies Assistance Listing Number: 84.010 Federal Award Number: 170ED2102:170ED2202; 170ED2302; 500ED2002; 500ED2102; 500ED2202; 500ED2302 Program Year: July 1, 2021 – September 30, 2024; July 1, 2022 – September 30, 2024; July 1, 2023 – September 30, 2025; July 1, 2020 – September 30, 2023 Federal Agency: U.S. Department of Education Compliance Requirement: Eligibility; Matching, Level of Effort, Earmarking; Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: Title I is a formula program to States. The U.S. Department of Education (USED) allocates Title I funds to State educational agencies (SEAs) through four statutory formulas (Basic Grants, Concentration Grants, Targeted Grants, and Education Finance Incentive Grants) that are based primarily on the annually updated census poverty local educational agency (LEA) data adjusted for the cost of education in each State. SEAs in turn distribute Title I funds to their LEAs in accordance with Title I requirements. The annual allocation process used by the Department for the Title I program includes steps to determine eligibility of the LEAs, calculate federal earmarking requirements, and ensure funding for new and expanding charter schools. The Department must also ensure that new or significantly expanded charter schools receive the appropriate level of funds under each program for which they are eligible. The new and expanding charter school allocations are determined as part of the annual allocation process. The annual allocation process includes factors for two earmarking requirements. The first requirement is that at least 95 percent of the total Title I funding is passed through to LEAs. The second requirement is that no LEA allocation is below 85 to 95 percent of their prior-year funding. The allocation amounts calculated for distribution to the LEAs and charter schools are maintained using Excel spreadsheet templates. The Department director typically completes a review of the calculations and allocations to each LEA and charter school. Allocations are determined with the initial USED calculations, then with a final allocation, and again if there are revised final allocations. However, the Department’s director and financial principal completed the eligibility and allocation process together during the current audit period. There was no separate documented review completed of the annual allocation calculation in fiscal year 2024. Cause: The Department experienced significant turnover in the financial specialist position since 2022 that made it difficult to completely train staff to perform the annual allocation calculations independently from the standard reviewers; the director and financial principal. No alternative procedures were completed to ensure accuracy. Effect: No errors were noted in the eligibility determinations, earmarking requirements, or funding levels for new and expanding charter schools. However, without a separate documented review, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department implement internal control procedures that include a separate, documented review process for the annual allocation calculations. Management’s View: The Department agrees with this finding. Corrective Action: Immediately following discussions with the auditors on site, allocations, earmarking, and eligibility summary reports were generated as companions to the regular Title I-A allocations process. These three documents are printed, reviewed by the Federal Programs Director, signed and dated by both the Financial Specialist, Principal and Director, then scanned and uploaded to the shared Department drive. This process is completed with both preliminary allocations and final allocations after LEAs have had the opportunity to complete new and significant expansion-related data uploads, if applicable. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We want to emphasize that the Department needs to create procedures that include documenting and retaining the information related to the review processes completed.

FINDING 2024-209 The Department does not have documented internal controls functioning as intended for the Title I Grants to Local Educational Agencies (Title I) Assessment and Integrity Guide increasing the risk of errors occurring and going undetected. Type of Finding: Significant Deficiency Assistance Listing Title: Title I Grants to Local Educational Agencies Assistance Listing Number: 84.010 Federal Award Number: 170ED2102:170ED2202; 170ED2302; 500ED2002; 500ED2102; 500ED2202; 500ED2302 Program Year: July 1, 2021 – September 30, 2024; July 1, 2022 – September 30, 2024; July 1, 2023 – September 30, 2025; July 1, 2020 – September 30, 2023; July 1, 2022 – September 30, 2024; July 1, 2023 – September 30, 2025 Federal Agency: U.S. Department of Education Compliance Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Department is required to establish and maintain an assessment system that is valid, reliable, and consistent with relevant professional and technical standards. The assessment system must include policies and procedures to maintain test security and ensure that LEAs implement those policies and procedures (Title I, Section 1111(b)(2)(B)(iii) of the Elementary and secondary Education Act (ESEA) (20 U.S. Code 6311(b)(2)(B)(iii))). Condition: As part of complying with the requirements for receiving the Title I grants, the Department is required to maintain a policy manual regarding test security. The Department uses an assessment and accountability team to review and update policies and procedures for test security on an annual basis. The team then meets with the assessment and accountability director; however, there was no documented review of the policy updates in the current audit period. Cause: The Department did not formally document the review process over updates on the test security policy manual. There were changes in personnel, and internal control procedures were not designed effectively to document the review and approval process. Effect: We identified no errors in compliance with the Assessment and Integrity Guide. However, the lack of a documented review process for updates to the test security manual increases the risk of errors or misinformation in test security guidance occurring and going undetected. Further, the lack of review controls could lead to questions about the integrity and effectiveness of the policy changes. Recommendation: We recommend that the Department implement internal control procedures that include a documented review process over updates to the policies of procedures for test security. Management’s View: The Department agrees with this finding. Corrective Action: The Assessment and Accountability team has implemented a process whereby the staff documents their approval in writing, and then the Director documents her approval in writing as well. Those approvals were taking place previously, and now there is a formalized, written process. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-210 The Department did not complete sufficient subrecipient monitoring for the Individuals with Disabilities Education Act (IDEA) program during fiscal year 2024. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Special Education Cluster Assistance Listing Number: 84.027; 84.173 Federal Award Number: 170ED2131; 170ED2231; 500ED2131; 500ED2141; 500ED2231; 500ED2241; 500ED2331; 500ED2341 Program Year: July 1, 2021 – September 30, 2023; July 1, 2022 – September 30, 2024; July 1, 2021 – September 30, 2023; July 1, 2023 – September 30, 2025 Federal Agency: U.S. Department of Education Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations and the terms and conditions of the federal award. The requirements for pass-through entities are in 2 CFR 200.332, which states that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and include the following information at the time of the subaward or if information changes. The required information includes: • Federal Award Identification. 1. Subrecipient’s name (which must match the name associated with its unique entity identifier) 2. Subrecipient’s unique entity identifier 3. Federal Award Identification Number (FAIN) 4. Federal award date of award to the recipient by the federal agency 5. Subaward period of performance start and end date 6. Subaward budget period start and end date 7. Amount of federal funds obligated by this action by the pass-through entity to the subrecipient 8. Total amount of federal funds obligated to the subrecipient by the pass-through entity to the subrecipient 9. Total amount of the federal award committed to the subrecipient by the pass-through entity 10. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA) 11. Name of awarding agency, pass-through entity, and contact information for awarding official of the pass-through entity 12. Assistance Listings (AL) number and title 13. Identification of whether the award is research and development (R&D) 14. Indirect cost rate for the federal award • All requirements imposed by the pass-through entity on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the federal award. • Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the federal awarding agency, included identification of any required financial and performance reports. Pass-through entities must also: • Evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. • Consider imposing specific subaward conditions upon a subrecipient, if appropriate. • Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subawards, and that subaward performance goals are achieved. • Verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, and follow up on the results of those audits. Further guidance is provided by the U.S. Department of Education in the State General Supervision Responsibilities Under Parts B and C of the IDEA, Monitoring, Technical Assistance, and Enforcement, which states that a state should monitor all LEAs within a reasonable period of time and at least once within a six-year period. Condition: The Department has designed a monitoring plan to meet the IDEA subrecipient monitoring requirements that includes reviewing all LEAs in the State within a five-year period. The USED guidelines indicate reviews should occur within a reasonable amount of time and at least once within a six-year period. The annual award notification letters to LEAs contain the required grant award information. The program administrators perform an annual risk assessment of all LEAs and subrecipients receiving IDEA Funds. The risk assessment dictates the frequency of completed monitoring. The LEAs are scheduled to be reviewed every year for high risk, every two years for medium risk, and every four to five years for low risk. There are approximately 180 LEAs receiving IDEA funding each year; therefore, between 36 and 45 subrecipients should be monitored each year. Fiscal year 2022 was the first year in the monitoring cycle, and monitoring was completed during calendar year 2022 for 35 LEAs. Fiscal year 2023 activity monitoring included 5 LEAs monitored in calendar year 2023, 8 LEAs monitored in calendar year 2024, and 14 LEAs monitored in calendar year 2025. Based on the number of reviews completed in the prior four years, it is unlikely that the Department could complete those remaining 118 reviews in calendar year 2026 to be compliant with the Department’s internal policy or at the conclusion of calendar year 2027 to be compliant with USED monitoring guidelines. Cause: The Department does not have effective written policies and procedures to ensure all LEAs are monitored for IDEA activity within an appropriate amount of time. Further, the Department has not implemented appropriate procedures to ensure monitoring is completed at a sufficient level to ensure compliance with federal program requirements. Effect: Monitoring for fiscal year 2023 activity took three years to complete. This created a significant backlog of monitoring to be completed for activity in fiscal years 2024, 2025, and 2026 that ensures every LEA is reviewed at least once in a six-year period to be compliant with federal monitoring requirements. Monitoring LEAs is a critical requirement in accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other guidelines provided by the grantor. Lack of monitoring of LEAs increases the risk that LEAs may not comply with the grant terms. Recommendation: We recommend that the Department implement robust written procedures outlining monitoring activities so that an appropriate number of LEAs are monitored annually to help ensure compliance with federal requirements. Management’s View: The Department disagrees with this finding. Corrective Action: Although the Department agrees that not as many LEAs were monitored as might normally be in a given year, the Department is on track to have monitoring activities completed for all LEAs within the five-year cycle and in accordance with the US Department of Education’s six-year cycle. There is no statute that states a certain amount of monitoring must take place each year. Rather, states are required to monitor all LEAs within a six-year period. In Office of Special Education Programs (OSEP) QA 23-01, State General Supervision Responsibilities under Parts B and C of the IDEA, it states: “States should ensure all LEAs or EIS programs are monitored at least once within the six-year cycle of the State’s SPP/APR, presumptively implementing a reasonable timeframe for monitoring.” (See also Q A-11). The special education fiscal monitoring process includes robust written policies and procedures to meet federal requirements, and the Department underwent thorough federal on-site monitoring by OSEP in FY 2024 and passed without any fiscal findings. The LEA fiscal monitoring is assigned and takes place throughout the state fiscal year. The Department has completed or is in the process of completing 88 LEA monitors for the first three years in the cycle before the end of calendar year 2025. Corrective actions will be forthcoming, and LEAs have 365 days to complete any state monitoring and enforcement corrective actions under 34 CFR 300.600(e). This program-specific rule complements the Uniform Grant Guidance of 2 CFR 200.332(d) in which passthrough entities (SEAs) “must ensure subrecipients take ‘timely and appropriate action’ to correct deficiencies.” The Department is currently transitioning to year four of the five-year cycle for FY 2025-26 (reviewing FY 2024-25 records). With the support of five contracted staff, 60 LEAs are scheduled between December 2025 and June 2026 to review FY 2024-25 fiscal records (made available in November 2025 when CPA audits are due to the state). The Department is also continuing to close out corrective action plans for LEAs from prior reviews. Year five (FY 2026-27) of the cycle will evaluate the FY 2025-26 fiscal records of remaining LEAs. Those LEAs will not be available to monitor until November 2026 when LEA CPA audits are finalized and available. The Department will conduct those reviews in FY 2026-27 (after November 2026). The Department will continue to conduct other monitoring activities throughout the year for all LEAs including through claim reimbursement reviews, the annual IDEA Part B Application, and the risk assessment activities in alignment with Idaho’s Special Education System of General Supervision. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We continue to assert that the Department’s documented progress monitoring LEAs through the end of fiscal year 2024 does not indicate it will comply with federal monitoring requirements. As stated in the finding, documentation reviewed shows that only 62 out of 180 LEAs have been monitored over three and ¾ years, between January 2022 and October 2025. Approximately 63% of the available 6 year monitoring period has elapsed and the Department has only completed approximately 34% of the required reviews. While the Department indicates its intention to catch up the completed reviews, it is unlikely to occur until the Department not only outline a well-defined schedule of monitoring to be completed that complies with the requirements, but also tracks its performance of monitoring completed each year to ensure that each LEA is monitored at least once every six years in accordance with federal monitoring guidelines.

FINDING 2024-211 The Department did not consistently document compliance with federal suspension and debarment requirements for the Coronavirus State and Local Fiscal Recovery Funds program. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of the Treasury Compliance Requirement: Procurement, and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) (2 CFR Part 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Nonfederal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (for example, grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. The Uniform Guidance included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulation, and the terms and conditions in the federal award. Condition: During fiscal year 2024, the Department procedures utilized the process for routing a contract to verify that a vendor was not suspended and debarred. The routing slip includes necessary bidding documents, solicitation documents, bidder evaluations, SAM check on vendor, and the notice of award, as documented in the Department’s DEQ Contract Officer Desk Manual. Contracts 2495 and 2392, solicited to respective contractors Amplifund and Energy Laboratories, did not include evidence of the required SAM check for the vendor on the routing slip. This resulted in two deviations out of a sample of four, reporting a 50 percent exception rate. The Department’s fiscal officer informed us that these contracts were solicited through the State Division of Purchasing; however, the Department was unable to provide information from the State Division of Purchasing that the SAM check was done prior to funds being sent to the vendor. The responsibility to ensure compliance with federal requirements remains with the Department issuing the contract. Cause: Department staff did not verify that all steps required on the routing slip were appropriately completed when a contract was solicited by the State Division of Purchasing. Effect: We did not identify suspended or debarred vendors receiving federal funds during our testing. However, the requirement is to ensure that funds do not go to a contractor that is suspended or disbarred and without a consistently applied and documented internal control the Department increases the risk of paying funds to a contractor who is suspended or disbarred Recommendation: We recommend that the Department strengthen control procedures to include procedures to document the Department’s verification that vendors are not suspended or debarred prior to entering into a covered transaction whether the contract is solicited by the Department or by the State Division of Purchasing. Management’s View: We agree with and acknowledge the finding presented and are committed to addressing it with the following corrective action plan. Corrective Action: The agency utilizes a routing slip or checklist that includes a suspension and debarment check, which will be used and reviewed prior to entering into a covered transaction. This check will be done regardless of whether the solicitation is through our Department, or the State Division of Purchasing. DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures, including those for federal grant compliance. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-212 The Department’s Indirect Cost Rate Proposal (ICRP) contained multiple errors. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Drinking Water State Revolving Fund; Clean Water State Revolving Fund Assistance Listing Number: 66.468; 66.458 Federal Award Number: Various Program Year: Various Federal Agency: Environmental Protection Agency Compliance Requirement: Activities and Costs Allowed Questioned Costs: Undetermined Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.400 contains the policy guide for cost principles related to federal grant administration. Paragraph (a) states that the nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. Paragraph (d) states that the accounting practices of the nonfederal entity must be consistent with these cost principles and support the accumulation of costs as required by the principles and must provide for adequate documentation to support costs charged to the federal award. Condition: The Department uses an Indirect Cost Rate Agreement to charge indirect costs to its programs. We reviewed the ICRP used to calculate the indirect cost rate in place in fiscal year 2024 and found multiple errors: • The direct cost base was reported as $27,355,390; however, the ICRP did not define the methodology used to calculate that amount, the amount reported was also not defined in a detailed schedule in the ICRP, and the Department could not provide documentation to support that it was correct. • The indirect departmental cost was reported as $9,685,891 however, the ICRP did not define the methodology used to calculate that amount nor was the amount reported or supported by a detailed schedule in the ICRP, and the Department could not provide documentation to support that it was correct. • The rate calculation did not include a carryforward amount from the prior year, as required. • The schedules in the proposal contained multiple mathematical errors, including the total sum of the fiscal year 2024 indirect cost pool. The sum was reported as $9,543,761; however, the amounts in the schedule sum to $9,696,805. The difference, $153,044, was the carryover amount from the fiscal year 2022 ICRP, which was incorrect. Cause: The Department’s procedures require the ICRP to be compiled by the fiscal staff and reviewed by separate staff to identify errors. The Department provided documentation to verify that the review occurred; however, it was not performed at a level of detail necessary to identify the errors. The Department also did not include a procedure to retain documentation to support the amounts reported in the ICRP. Effect: We were unable to determine if the indirect cost rate used in fiscal year 2024 was correctly calculated because the methodology and documentation to support the amounts used in the calculation were unavailable. Further, Department staff could not explain or recreate what had been calculated. Even if we make assumptions about what the direct cost base was intended to include, typically direct salary, wages, and fringe benefits, there is no support available to identify which salaries were included or how fringe benefits were calculated. Additionally, formula errors within the schedule used to calculate the rate increase the risk of an incorrect calculation. Recommendation: We recommend that the Department provide training for the staff preparing and reviewing the ICRP to ensure compliance with applicable regulations. We further recommend that the Department design and implement procedures to retain documentation of the methods used to compile the ICRP and the basis for the amounts reported in the ICRP. Management’s View: We agree with and acknowledge the finding presented and are committed to addressing it with the following corrective action plan. Corrective Action: The agency has new staff that will be preparing and submitting the indirect cost rate proposal this year and will take the auditor’s recommendations very seriously in our development and preparation. We have reached out to our federal oversight agency for assistance and direction and are committed to maintaining a file with all supporting documentation used to compile and prepare the proposal, as required by 2 CFR 200. DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures, including those for federal grant compliance. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-213 The Department did not have documentation to support the verification that grant subrecipients were not suspended or debarred. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Drinking Water State Revolving Fund Assistance Listing Number: 66.468 Federal Award Number: Various Program Year: Various Federal Agency: Environmental Protection Agency Compliance Requirement: Procurement, and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards contains guidance that nonfederal entities must follow as a condition of receiving federal awards. Section 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 180.300 requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Nonfederal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Condition: Loan recipients from the Drinking Water State Revolving Fund (DWSRF) are considered subrecipients for federal grant compliance purposes. We tested 7 of the 46 identified subrecipients (or 15 percent) to determine if the Department verified that the subrecipients were not suspended or debarred. The Department could not provide documentation to support that suspension and debarment checks were performed for 2 subrecipients (or 28.57 percent). Cause: The Department did not have procedures in place to maintain documentation to support the checks for suspended or debarred subrecipients. Effect: We reviewed all subrecipients selected as part of our testing and verified that none were on the SAM list as suspended or debarred. However, the Department does not have adequate controls in place to ensure that they are not entering into covered transactions with suspended or debarred subrecipients. Subrecipients can be suspended or debarred for many reasons including financial crimes such as fraud, embezzlement, or bribery, and other issues such as consistent poor performance on previous contracts or violations of laws. Taking steps to ensure vendors are not suspended or debarred is important to prevent fraud, waste, and abuse. Recommendation: We recommend that the Department develop and implement procedures to ensure that they are not entering into covered transactions with suspended or debarred parties and retain documentation to support compliance with suspension and debarment requirements. Management’s View: We agree with and acknowledge the three findings presented and are committed to addressing them with the following corrective actions being taken by DEQ. Corrective Action: The agency utilizes a routing slip or checklist that includes a suspension and debarment check, which will be used and reviewed prior to entering into a covered transaction. This check will be done, and documented, regardless of whether the solicitation is through our Department, or the State Division of Purchasing. DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures. Along with these changes, the grants and contracts teams have been combined to help with oversight and consistency. This is particularly valuable when contracting or procuring goods or services with grant or federal funds. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-214 The Department does not have documented internal controls for cash draws and requested reimbursement for the same $175,500 grant expenditure twice. Type of Finding: Material Weakness, Noncompliance Assistance Listing Title: Clean Water State Revolving Fund Assistance Listing Number: 66.458 Federal Award Number: EB25020-22 Program Year: November 1, 2022 – October 31, 2027 Federal Agency: Environmental Protection Agency Compliance Requirement: Cash Management Questioned Costs: $175,500 Known Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.400 contains the policy guide for cost principles related to federal grant administration. Paragraph (a) states that the nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. Paragraph (d) states that the accounting practices of the nonfederal entity must be consistent with these cost principles and support the accumulation of costs as required by the principles and must provide for adequate documentation to support costs charged to the federal award. Condition: The Department draws grant funds for reimbursement of allowed costs such as loan disbursements and set-aside funds which may be used for administrative expenses, technical assistance to small water systems, and State program management. One employee uses reports from the statewide accounting system, Luma, to prepare the draw request, accesses the Environmental Protection Agency’s (EPA) Automated Standard Application for Payments (ASAP) system to request the draw, and enters the receivable amount into Luma. The Department does not have a procedure in place for a second person to verify the amounts requested in the grant draws are correct. We tested the following cash draws for the Drinking Water State Revolving Fund (DWSRF) and the Clean Water State Revolving Fund (CWSRF) to verify they were made in compliance with applicable requirements and were recorded in the correct amount: • The Department made five cash draws for reimbursement of loan disbursements for the DWSRF. We tested all five and found no errors. • The Department made four cash draws for reimbursement of loan disbursements for the CWSRF. We tested all four and found one $175,500 draw that was a duplicate of a previously drawn amount. • The Department made six draws for set-aside amounts. These draws were made for multiple EPA programs including the CWSRF and DWSRF. We tested all six and found no errors. Cause: The Department relied on the expenditure controls in Luma to identify the grant expenditures used to determine the amount of the cash draws and did not believe additional controls were necessary. However, these controls would not be effective for ensuring that errors in the draw process would be detected or prevented. Effect: The Department did not have controls in place to identify a duplicate cash draw request for $175,500, resulting in questioned costs. Without control procedures in place to ensure the correct grant expenditures are identified for cash draw requests, additional errors could be made and remain undetected. Recommendation: We recommend that the Department design and implement control procedures to ensure cash draw requests are correct and supported. Management’s View: We agree with and acknowledge the three findings presented and are committed to addressing them with the following corrective actions being taken by DEQ. Corrective Action: The duplicate payment in question was issued but not redeemed. The issuance was to a similar, but incorrect, vendor name and was caught by staff before it was sent to the vendor. The transaction was cancelled in Luma but was not properly recorded in the following draw request. Fiscal staff now perform a thorough review of transactions before a loan draw is finalized in Luma, reconciling the transactions from the Loans and Grants Tracking System (LGTS) to the information generated in the Luma draw invoice. The reconciling and supporting documentation from LGTS is attached to the Luma draw invoice. DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures, including those for federal grant compliance. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We agree that a more stringent review process and reconciliation control in place would likely prevent or detect an error of this nature in the future, however we would also like to emphasize that the Department should contact the federal grantor to resolve the overdraw of $175,500.

FINDING 2024-215 The Department did not document subrecipient risk assessments or ensure subrecipient audits were received for the Coronavirus State and Local Fiscal Recovery Fund. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of the Treasury Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that nonfederal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The requirements for pass-through entities are in 2 CFR 200.332, which states that all pass-through entities must: • Evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations and the terms and conditions of the subaward for the purpose of determining the appropriate subrecipient monitoring. • Consider imposing specific subaward conditions upon a subrecipient, if appropriate. • Verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, and follow up on the results of those audits. A non-Federal entity that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year. Condition: The Department received funds for the Coronavirus State and Local Fiscal Recovery Fund (Assistance Listing Number 21.027) from the U.S. Department of Treasury through the Idaho Department of Financial Management. The funds were for two specific program areas within the Department: planning and construction grants for the clean and drinking water infrastructure projects and waste management projects. During fiscal year 2024, there were 128 subrecipients for these funds. The Department established oversight for these funds under the Grant Loan Bureau (planning and infrastructure grants) and the Waste Management Group (various waste management projects). The Department complied with some, but not all, of the pass-through entity requirements. Noncompliance was identified in the following areas: 1) The Department did not adequately document their evaluation of each subrecipient’s risk of noncompliance with federal statutes, regulations, and terms and conditions of the subaward for 13 out of 13 (100 percent) of the sample tested. The Department completes thorough reviews throughout the project timeline to ensure that subrecipients are complying, but those reviews do not adequately assess the subrecipients risk of noncompliance with a subaward, prior to award, as required by 2 CFR 200.332(c). While the Department’s review does ensure each subrecipient has financial review controls in place, the Department does not document a formal risk assessment that evaluates each subrecipient’s risk of noncompliance based on the subrecipient’s prior experience with the same or similar awards, the results of previous awards including whether the subrecipient receives a Single Audit, whether the subrecipient has new personnel, or the extent and results of any Federal agency monitoring. 2) The Department does not have a process in place to ensure that subrecipients are audited, as required by 2 CFR 200, Subpart F for 1 out of 13 (7.69 percent) of the contracts tested. In the prior-year audit, it was stated that the planning/construction group in the Grants Loans Bureau were aware of this issue and have procedures in place within their Loan Grant Tracking Software (LGTS) and that the Waste Program was aware that the subrecipients also required procedures; however, no procedures are in place. During this year’s audit, however, no documentation was submitted in support of the Grants Loan Bureau or the Waste Program. Cause: The Department did not have a formal documented risk assessment process in place as they believed the application process and monitoring during the actual grant award period met the requirements. The Department has procedures in place to check the Federal Audit Clearinghouse for Single Audit Act (SAA) grant audits to see if a subrecipient has a recent audit, however, this procedure alone does not satisfy the requirement. The Department did not deem it necessary to implement additional procedures to ensure an audit was completed for subrecipients meeting the threshold because the grant makes up more than 50 percent of the total project cost and are reimbursement grants. The fact that these are reimbursement grants does not exempt the Department from ensuring that the subrecipient is audited as required by 2 CFR 200, Subpart F. Effect: Subrecipient monitoring is a critical requirement when accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other guidelines provided by the grantor. Assessing the risk of subrecipient noncompliance enables a pass-through entity to determine the proper level of monitoring procedures. Without completing the risk assessment process, a pass-thought entity may increase the risk that appropriate monitoring procedures will not be performed, and noncompliance may occur and go undetected. Subrecipient audit reports may identify internal control issues and noncompliance with federal award requirements. Reviewing these reports and ensuring that potential issues are addressed decreases the overall risk of noncompliance with the federal award requirements. Recommendation: We recommend that the Department design and implement appropriate procedures to ensure that subrecipient risk assessments are properly completed and documented and subrecipient audits are completed and reviewed in accordance with federal grant regulations. Management’s View: We agree with and acknowledge the three findings presented and are committed to addressing them with the following corrective actions being taken by DEQ. Corrective Action: The Department created a Subrecipient Monitoring Policy that will be implemented by the end of this calendar year, December 31, 2025. This policy includes a risk assessment checklist that will be used prior to issuing a subaward. The results of the risk assessment, the overall risk level, and the level of monitoring will be included in the subaward agreement. The risk assessment and the process will be documented with each subaward request. DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures. Along with these changes, the grants and contracts teams have been combined to help with oversight and consistency. This is particularly valuable when contracting or procuring goods or services with grant or federal funds. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-216 Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) project and expenditure reports (P&E) contained material overstatements. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The CSLFRF grant award from the U.S. Department of the Treasury requires recipients to provide quarterly P&E reports that contain related costs incurred during the covered period. The recipient’s quarterly P&E report submissions should be supported by the data in the recipient’s accounting system. Condition: During fiscal year 2024, the CSLFRF program was required to submit four P&E reports to the federal government. The agency’s state financial officer compiles and submits the reports to the U.S. Department of the Treasury. The report for the quarter ending March 31, 2024, was overstated by $36.5 million, and the report for the quarter ending June 30, 2024, was overstated by $1.3 million. Cause: The Division’s controls are not performed at the level of detail necessary to prevent or detect errors in the reports before they are submitted to the U.S. Department of the Treasury. The Division compiles P&E reports based off information provided by State agencies. In the prior year, the Division pulled queries to ensure accuracy of agency reported amounts. This process was not performed in the current year as the Division encountered difficulties when attempting to pull reports from the newly implemented accounting system, Luma, to verify agency reported amounts. Effect: The report for the quarter ending March 31, 2024, was overstated by $36.5 million, and the report for the quarter ending June 30, 2024, was overstated by $1.3 million. Recommendation: We recommend that the Division design and implement internal controls to ensure CSLFRF P&E reports are accurate. We also recommend that the Division e-mail the U.S. Department of the Treasury to correct erroneous information in the Treasury Portal as suggested in the Project and Expenditure Report User Guide published by the U.S. Department of the Treasury. Management’s View: The agency agrees with this finding. With significant turnover at DFM, and the implantation of a new statewide accounting system it was difficult to identify expenditure data that was provided by agencies to the division. Additionally, it was difficult to get responses from the US Department of Treasury when identifying errors to be correct in prior periods. Currently there is no option to update prior quarter errors when they are identified. Corrective Action: DFM is currently training other staff members to add to the bench of support for SLFRF quarterly reporting. This training includes matching expenditures in Luma. We are also going to engage with SCO to see if we can get a report built to identify agency expenditures and match them to the reports provided by the agencies. Additionally, we will continue to work with the US Treasury to see if we can update previous reporting periods. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2024-217 The Department lacked documentation to support continued eligibility for providers within the Medicaid program. Type of Finding: Material Weakness, Material Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: Undetermined Criteria The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. Additionally, the Uniform Guidance included in 42 CFR 455.412 states that the state Medicaid agency must: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any state is licensed by such state. (b) Confirm that the provider’s license has not expired and that there are no current limitations on the provider’s license. Condition: The Department could not provide documentation to support the eligibility for 14 of the 62 MCO providers tested (or 22.6 percent) and could not provide documentation that 9 of the 14 noted providers (or 64.3 percent) had applicable licenses and certifications. Also, 4 out of 14 noted providers (or 28.6 percent) did not have an active contract with the MCO during the applicable period. The Department also could not provide documentation for 1 out of the 14 noted providers (or 7.1 percent) that the provider entered into an agreement and made the required disclosures to the State. We were unable to verify if the MCOs paid claims to ineligible providers. The Department should have been tracking and verifying payments were not made to ineligible providers by the MCOs. All providers noted were included in the rosters as of December 2024, indicating they were eligible to participate in the Medicaid program. Cause: The Department did not review the documentation supporting eligibility for 14 providers at a level of detail sufficient to properly identify the required missing support, despite the providers being included in the provider roster reports. Effect: Without supporting documentation, we are unable to confirm that the noted providers were eligible to participate in the Medicaid program. In addition, there is an increased risk that a Medicaid recipient could utilize an ineligible provider from the roster and claim payments could be processed by an MCO and go undetected by the Department. Recommendation: We recommend that the Department strengthen internal controls to ensure required documentation is maintained by MCOs to support the eligibility of contracted providers, including applicable licenses and certifications, provider agreements, and required disclosures to the State. In addition, we recommend that the Department determines if payments were made to ineligible providers. Management’s View: The Department Agrees with this Finding. Corrective Action: As part of the Provider Enrollment project, the division will audit provider payments starting in 2026. The health plans will be required to validate that the providers are fully enrolled with Medicaid prior to enrolling with the health plan in early 2026. These are [sic] audits will begin in May 2026 and continue through the end of the year depending on when provider reports are due to Medicaid. This is also part of the Corrective Action Plan mentioned in finding #5. The information required to validate that no payment was made inappropriately is part of the audits that will be conducted this year with the provider rosters. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-218 The Department did not ensure compliance with federal requirements that Managed Care Organizations (MCO) were submitting provider roster reports annually to verify that all providers are properly licensed and in good standing. Type of Finding: Material Weakness, Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR Section 431.107 states that providers must be licensed in accordance with federal, state and local laws, and regulations to participate in the Medicaid program and receive payments. Additionally, the Uniform Guidance included in 42 CFR 455.412 states that the state Medicaid agency must: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any state is licensed by such state. (b) Confirm that the provider’s license has not expired and that there are no current limitations on the provider’s license. Condition: The Department has contracts with 4 MCOs; 2 of the Department’s MCOs submitted provider roster reports as required. We confirmed that the Department received 4 provider roster reports for the applicable Managed Care Plans. The receipt of the provider roster reports for each plan, the review of the plan, and the approval of the plan are documented on a tracking spreadsheet. We noted that 3 out of 4 managed care plans (or 75 percent) did not have the receipt, the review, or the approval information documented on the tracking spreadsheet for fiscal year 2024. Cause: It appears that while the Department had established internal controls to document the receipt, review, and approval of the provider roster reports on the tracking spreadsheet, it was not consistently performed due to the Division of Medicaid oversight. The Department is updating the tracking spreadsheet to ensure proper documentation is maintained in the future. Effect: In the absence of internal controls over the provider roster reports, an MCO could be enrolling and maintaining ineligible providers. Recommendation: We recommend that the Department strengthen internal controls over the MCO provider roster reports and properly document the receipts, reviews, and approval information. Management’s View: The Department Agrees with this Finding. Corrective Action: Starting early 2026 most providers will be required to enroll with Medicaid prior enrollment with the health plans. Health plans have been receiving a daily file with the provider enrollment information and are working on their own system changes to intake that information. This is part of the Corrective Action Plan that is mentioned in finding #5. The report trackers that the Medicaid teams use will document when these reports are received, whether or not they meet metric criteria. The audit of those provider rosters will occur annually. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-219 The Medicaid Enterprise System was not properly updated for members deemed ineligible, resulting in capitation payments issued to Managed Care Organizations for ineligible members within the Medicaid program. Type of Finding: Material Weakness, Material Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Eligibility Questioned Costs: $78 Known, $2,051,295 Projected Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 435.10 states that a state plan must: (a) Provide that the requirements of this part are met; and (b) Specify the groups to whom Medicaid is provided, as specified in subparts B, C, and D of this part, and the conditions of eligibility for individuals in those groups. The Uniform Guidance included in 42 CFR 438.3(c)(2) states that capitation payments may only be made by the state and retained by the Managed Care Organization, Prepaid Inpatient Health Plans, or Prepaid Ambulatory Health Plans for Medicaid-eligible enrollees. Condition: During our review of the eligibility determination for Medicaid members, we tested 78 claims that included capitation payments. Capitation payments are payments made by the State to Managed Care Organizations (MCO), Prepaid Inpatient Health Plans, or Prepaid Ambulatory Health Plans for Medicaid eligible enrollees. For each MCO, capitation payments are calculated per member per month. The Department makes payments to an MCO based on the total number of members per month. Out of 78 claims tested, 3 capitation payments (or 3.8 percent) were paid to the MCOs for Medicaid members that were no longer eligible; 2 of the 3 capitation payments were paid for a Medicaid member that was eligible through May 2023; and 1 of the 3 capitation payments was paid for a Medicaid participant that was eligible through the end of April 2023. Questioned costs were calculated based on a sample error of $78 of known questioned costs paid that was projected out to the overall population for $2,051,295 of projected questioned costs. Cause: During May 2023, eligibility was re-evaluated in the Idaho Benefit and Eligibility System (IBES). The members in some MCO plans were determined ineligible in IBES. The updates to eligibility status were not forwarded to the Medicaid Enterprise System (MES). Capitation payments were still paid on behalf of these members despite being deemed ineligible in IBES. The MES relies on member eligibility information from IBES and interfaces nightly; however, the eligibility status in IBES was not appropriately updated in MES. No claims were paid on behalf of those members during fiscal year 2024. Effect: Though we did not identify claims in our sample that were paid on behalf of the ineligible members during fiscal year 2024, the Department did issue Medicaid capitation payments on behalf of ineligible members. Additionally, given the nature of the error in updating the MES, other capitation payments or claims may have been paid for ineligible members. Recommendation: We recommend that the Department properly design, implement, and maintain internal controls to ensure that MES and IBES data are properly interfacing, complete, and accurate, ensuring that capitation payments are issued only for eligible members. In addition, we recommend that the Department review those recipients that were deemed ineligible to determine which would have contributed to capitation payments and if any more had been made in error. Management’s View: The Department Agrees with this finding. Corrective Action: Medicaid recognizes that this appears to be an interface issue with Self Reliance, and their inability to send correct eligibility records to Medicaid in certain instances. Medicaid will investigate and work with Self Reliance to mitigate these issues while working through our new system implementations and interfaces. Self-Reliance is looking at the issue to identify root causes and will work closely with MC to determine next steps to implement. System integration is expected in 2028. In the interim, we’ll identify issues and develop implementation strategies by 2027. Strategies will align with system updates and builds for both Self-Reliance and Medicaid. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-220 The expenditures reported on the Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program form (CMS-64) were understated by $16,348,275 for the Medicaid program. Type of Finding: Material Weakness, Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 302.15(a)(3) states that the agency should maintain the necessary records for the proper and efficient operation of the State plan, including records regarding amount and sources of support collections and the distribution of these collections. In addition, the Uniform Guidance included in 42 CFR 430.30(c)(1) states that the State must submit the CMS-64 to the central office (with a copy to the regional office) not later than 30 days after the end of each quarter. Condition: The CMS-64 is used by the Department to report its actual program benefit costs and administrative expenses to the Centers for Medicare and Medicaid Services (CMS). We reviewed two of the four quarters submitted during fiscal year 2024. One of the two tested quarters on the CMS-64 (or 50 percent) was submitted 207 days late. The other quarter was submitted 185 days late. The Department notified CMS and received return communications acknowledging that reporting for Idaho would be delayed due to the implementation of Luma. In addition, one of the two quarters tested on the CMS-64 (or 50 percent), the state and local administration amount was understated by $16,348,275. Cause: The implementation of Luma resulted in significant reporting issues and caused the Department to submit the CMS-64 forms late. In addition, staff turnover and insufficient training caused the misstatement of the state and local administration amount on the CMS-64, and the review of the report was not performed at a level sufficient to identify errors. Effect: The late submission of the CMS-64 caused the Department to be noncompliant with the federal requirements. Additionally, the state and local administration amount reported on the CMS-64 was understated by $16,348,275 for one quarter during fiscal year 2024 for the Medicaid program. The understatement was eventually corrected in the June 30,2025, CMS report. Recommendation: We recommend that the Department strengthen internal controls to ensure accurate amounts are reported and timely submission of the CMS-64. Management’s View: The Department Agrees with this finding. Corrective Action: As noted in the finding, the late submission and understated expenditures were primarily the result of the Luma system implementation and the unavailability of required data for CMS reporting. During the development phase, concerns were raised regarding the system’s ability to meet federal reporting requirements—specifically the CMS-64 and CMS-21 reports for Medicaid. The Budget Team requested sample output reports to proactively update workpapers and ensure accurate and timely reporting; however, these requests were not fulfilled. During the delay in timely reporting, DHW maintained ongoing communication with our federal partners. The Budget Team developed the necessary reports and revised internal processes to bring reporting current. The Budget Team also worked closely with our federal auditors to ensure no reporting elements were inadvertently omitted. During this review, we identified that our initial submission excluded indirect expenditures associated with the federally approved Cost Allocation Plan. This allocation process cannot be completed within Luma and requires coordination among the State Controller’s Office, two external vendors, and the Cost Allocation Budget Analyst. These dependencies created significant delays. As a result, indirect cost allocation charges were substantially delayed, and the first successful import for July 2023 did not occur until November 2023. Upon receiving the complete data, the Reporting Team corrected the process, documented the updates, and submitted a prior period adjustment to capture previously under-reported expenditures. As we entered SFY 2025, we had a more comprehensive understanding of the new processes and required timelines. This resulted in improved timeliness: the December 2024 submission was five days late submitted 2/4/25, the March 2025 submission was two days late submitted 4/30/25 and resubmitted 7/31/25, and the June 2025 submission was only one day late submitted 7/31/25. We are pleased to report that the September 2025 submission was certified on time and submitted 10/30/25. While some reporting adjustments were needed, CMS and the Budget Team collaborated effectively to update and recertify the report to ensure accuracy. We have updated all relevant process documentation and continue to automate steps where feasible to further improve efficiency and reduce turnaround times. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-221 The Division of Medicaid did not document the review and approval of the audited financial reports of the Managed Care Organizations (MCO). Type of Finding: Material Weakness Related to Prior Finding: 2023-224 AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 438.3(m) requires the contract with MCO to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all 4 MCO contracts with the Department that were active during fiscal year 2024. The Department did include requirements for the MCOs to submit audited financial reports in the contracts but did not have documented reviews and approvals in places over those audited financial reports provided for 2 out of 4 MCO contracts (or 50 percent). Cause: The Department did not realize that the annual submission of the audited financial reports provided by the MCO was not included in the monitoring spreadsheet until we requested clarification which led to a lack of a documented review. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules, and regulations. Collecting and reviewing audited financial reports provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCO. Recommendation: We recommend that the Department follow intended procedures to monitor and document the receipt, and review, of the audited financial reports. Management’s View: The Department Agrees with this Finding. Corrective Action: The division has signed and [sic] MOU with the Department of Insurance to review audited financial reports. The first reports will be sent to the Division of Insurance December 2025 with the exception of the Magellan report which is [sic] will be sent to the Division of Insurance in January 2026 as they are finalizing their report currently. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-222 Four providers lacked documentation to support continued eligibility within the Medicaid program. Type of Finding: Significant Deficiency, Noncompliance Related to Prior Finding: 2023-223 AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: Undetermined Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 455.412 states that the state Medicaid agency must: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any state is licensed by such state. (b) Confirm that the provider’s license has not expired, and that there are no current limitations on the provider’s license. In addition, the Uniform Guidance included in 42 CFR 455.414 states that the state Medicaid agency must re-validate the enrollment of all providers regardless of provider type at least every five years. Condition: During testing, we identified 4 out of 60 providers (or 6.7 percent) that did not submit maintenance documents over 5 years. The specific maintenance documents that are required to be submitted depend on the type of provider. The Gainwell Provider Enrollment Specialist did not ensure that provider eligibility was properly maintained prior to updating the provider’s eligibility in the MES. Cause: Idaho Medicaid provider re-validation was scheduled to be completed in March 2025. The service organization, Gainwell Technologies, was unable to complete re-validation due to their own constraints. This is a known issue to the Department, and it anticipates completion of the provider re-validation by December 2025. Effect: If providers are not properly validated every five years, they may be ineligible to participate in the Medicaid program and still receive payments for services. Recommendation: We recommend that the Department strengthen internal controls to ensure provider validation is completed timely and in compliance with federal requirements. This may include providing for alternative procedures when a contractor does not perform agreed upon services. Management’s View: The Department Agrees with this finding. Corrective Action: Medicaid is currently under a Corrective Action Plan with CMS requiring all Managed Care providers to enroll with Medicaid. This project is currently underway. The initial date of completion of having all providers enroll was 12/31/2025. However, there were unforeseen system enrollment issues that delayed the project. The go live date is now April 1, 2026. Once all providers are enrolled Medicaid will audit provider rosters throughout the year to ensure those providers are in fact enrolled within Medicaid's system. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-223 The submission of a Child Care and Development Fund (CCDF) financial report used to support compliance with the Matching, Level of Effort (LOE), and Earmarking requirement was not completed timely. Type of Finding: Significant Deficiency, Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Matching, Level of Effort, Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 98.65(g) states that Lead Agencies shall submit financial reports, in a manner specified by the Administration for Children and Families (ACF), quarterly for each fiscal year until funds are expended. Additionally, the Administration for Children and Families (ACF) Form ACF-696 (Financial Reporting Form for State and Territory Child Care and Development Fund (CCDF) Lead Agencies) states that this form must be submitted quarterly. These reports are due 30 days after the end of the quarter: Quarter 1 by October 31, Quarter 2 by April 30, Quarter 3 by July 31, and Quarter 4 by January 31. Condition: The Department is required to complete a CCDF financial report, Form ACF-696 on a quarterly basis for each grant. Each report must be submitted within 30 days after the end of the applicable quarter. The final report for the quarter ended September 30, 2023, that included earmarking and level of effort amounts was submitted 1 month later, on November 30, and was signed off by the Department’s financial executive officer about 5 months after the deadline, on March 25, 2024. We did not note errors related to maintenance of effort and earmarking compliance requirements in the reports. Cause: Staff turnover, insufficient training, and the implementation of Luma caused the Department’s late submission of the required Form ACF-696 for the quarter ended September 30, 2023. The Department requested an extension from the ACF to complete necessary adjustments, but the request was denied. Effect: Late submission of the report resulted in the Department’s noncompliance with federal requirements. Additionally, the documentation of a review by the financial officer almost 4 months after submission calls into question how effective the review would be in detecting and correcting errors prior to submission. Recommendation: We recommend that the Department strengthen internal controls to ensure the timely and reviewed submission of the CCDF financial report, Form ACF-696. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department has seen an increased time commitment related to financial grant reporting since the implementation of Luma in July 2023. This was particularly relevant in SFY 2024 as Luma implementation, training and interfaces were still evolving, resulting in a tremendous increase in time commitments without the corresponding staff increases needed. In many cases, this resulted in late filings and/or filing reports that were not reviewed in sufficient detail. The Division of Financial Services continues to work through the inefficiencies encountered and design processes that include sufficient review and other internal controls while also allowing for timely completion of required reports. One FTE was transferred from another team to the Cash and Grants team. This position is expected to assist in completing preliminary tasks so that Grant Reporters have necessary data at their fingertips when drafting financial reports. As Department staff continue to learn nuances of the Luma system, both accuracy and timeliness of financial reporting is expected to improve. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-224 Some expenditures were misclassified on the Child Care and Development Fund (CCDF) financial report resulting in an overstatement of Child Care Administration expenditures and an understatement of Direct Services. Type of Finding: Material Weakness, Material Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 98.65(g) states that Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended. Also, 45 CFR 98.54(a) states that not more than 5 percent of the aggregate funds expended by the Lead Agency from each fiscal year's allotment, including the amounts expended in the state pursuant to 45 CFR 98.55(b), shall be expended for administrative activities. Additionally, Form ACF-696 (Financial Reporting Form for State and Territory Child Care and Development Fund (CCDF) Lead Agencies) states that the CCDF program has a number of fiscal requirements associated with multiple funding streams that comprise the block grant. Form ACF-696 has separate columns for reporting expenditures from each of these component funding streams. Condition: The Department is required to complete a CCDF financial report, Form ACF-696 on a quarterly basis for each grant. The Department compiles reports using quarterly supporting workpapers which are broken out by source, including the mandatory fund, the matching fund, and the discretionary fund. We found 1 out of 4 Form ACF-696 tested (or 25 percent), in which the Department misclassified the expenditures included in the mandatory funds, reporting $2,867,578 under the Child Care Administration line instead of Direct Services Line. Cause: Staff turnover and the implementation of Luma contributed to the human error that caused the expenditure misclassification. In addition, the review of Form ACF-696 was not completed at a level sufficient to identify errors. Effect: Expenditures in CCDF Direct Services included in mandatory funds were misclassified as Child Care Administration expenditures. With an incorrect amount being reported, the spending requirements applicable to the Child Care Administration expenditures were also not met. Recommendation: We recommend that the Department strengthen internal controls over the compilation and submission of the CCDF financial report, Form ACF-696, to ensure the amounts are classified properly and accurately. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department's Grant Reporting team has been developing additional internal controls to put in place with the utilization of the Luma ERP. Some of the controls include conducting reconciliations between internal workpapers and Luma records as well as reconciling to external parties such as the Payment Management System. The deeper reviews being performed during reconciliations are also highlighting areas where workpaper adjustments may be needed as some of the templates used may be outdated. We believe these increased focused efforts will alleviate issues like this in the future and are ongoing as the Department identifies opportunities for advancements in our own processes and working with SCO to implement better Luma reports and controls within the grant reconciliation process. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-225 Amounts reported as provided to subrecipients by financial services on the Schedule of Expenditures of Federal Assistance (SEFA) are not properly supported. Type of Finding: Significant Deficiency, SEFA Misstatement Related to Prior Finding: 2023-208; 2022-211; 2021-206 AL Title: Special Supplemental Nutrition Program for Women, Infants, and Children, Temporary Assistance for Needy Families, Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 10.557, 93.558, 93.575, 93.596 Federal Award Number: Various Program Year: Various Federal Agency: Department of Health and Human Services Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in 2 CFR 200.510(b), which states, in part, it must include: • Total federal awards expended as determined in accordance with 2 CFR 200.502, and • Total amount provided to subrecipients from each federal program (2 CFR 200.510(b)(4)) The Office of the State Controller (Office) requires agencies to complete the SEFA closing package and uses the reported information to compile the statewide SEFA. Condition: Amounts reported on the SEFA closing package as expenditures to subrecipients did not agree to amounts provided by program staff to auditors for testing purposes. The following programs had discrepancies between what was reported on the SEFA closing package and what was retained by program personnel: • An overstatement of $4,503,700 for the Child Care and Development Block Grant (Assistance Listing Number (AL) 93.575) • An overstatement of $29,079 for the Child Care and Development Block Grant (AL 93.596) • An understatement of $1,014,475 for the Temporary Assistance for Needy Families (AL 93.558) • An understatement of $362,470 for the Special Supplemental Nutrition Program for Women, Infants, and Children (AL 10.557) Cause: Contradicting information was provided by financial services personnel and program personnel related to expenditures to subrecipients reported on the Schedule of Expenditures of Federal Awards (SEFA) closing package for three major programs. A new statewide accounting system (Luma) was implemented in July 2023. The Office provided guidance to the Department on how to code expenditures to subrecipients, using specific account codes. According to financial services personnel, some expenditures to subrecipients were incorrectly coded causing incorrect amounts to be included on the SEFA. The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2024 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. In addition, Department financial services personnel and program personnel are not communicating effectively to discover and resolve any discrepancies related to expenditures to subrecipients reported on the SEFA. Effect: The amounts provided to subrecipients were misstated in the Department’s SEFA closing package as detailed in the condition section above. The net overstatement is a combination of over and under statements that total $3,155,834 in the Department’s SEFA closing package. Recommendation: We recommend that the Department improve the process of gathering information to prepare the SEFA closing package and review for accuracy at a level of detail sufficient to detect and correct errors in the SEFA closing package. In addition, we recommend that the Department improve training of program personnel regarding the proper coding of the expenditures to subrecipients. Management’s View: The Department Agrees with this finding. Corrective Action: For major grants, Financial Services staff will send a summary of transactions coded as subrecipient payments to the program manager to review prior to inclusion in the SEFA closing package. The review will be requested to be twofold: to ensure that everything that should be included as a subrecipient payment is and to ensure that nothing that should not be considered a subrecipient payment is included. This process helps to identify that we are reporting the accurate amount of expenditures for each subrecipient. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-226 The Bureau of Facility Standards within the Department failed to complete timely health and safety surveys for three long-term care facilities. Type of Finding: Material Weakness, Material Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 488.330(a)(i) states that the survey agency surveys all facilities for compliance or noncompliance with requirements for long-term care facilities. Also, 42 CFR 488.308(a) states that the survey agency must conduct a survey of each nursing facility not later than 15 months after the last day of the previous survey. Additionally, 42 CFR 488.308(b) states that the statewide average interval between standard surveys must be 12 months. The Centers for Medicare and Medicaid Services (CMS) provided the QSO-22-02-ALL memo on November 12, 2021, which stated that as of November 2021, the Bureau of Facility Standards (Bureau) should be able to resume re-certification surveys on a regular basis and should do so by establishing new intervals based on each facility’s next survey, not based on the last survey that was conducted prior to the COVID-19 Public Health Emergency (PHE). Condition: The Bureau is required to conduct unannounced standard re-certification surveys, which provide a comprehensive review of the quality of care furnished in a facility. For long-term care facilities, these recertification surveys must be conducted no later than 15 months after the previous recertification survey with a statewide average interval of 12 months or less. We identified 3 out of 18 providers tested (or 16.6 percent) that did not have a survey completed within 15 months of the previous survey as required. The timing of the re-certification surveys was 27 months, 42 months, and 38 months, respectively. Collectively, the timing of the re-certification surveys caused the Department to be noncompliant with the statewide average interval of 12 months or less requirement as well. Cause: The Bureau experienced staffing shortages that delayed survey completions. The Bureau also stated that they followed the guidance provided by CMS QSO-22-02-ALL memo by prioritizing facility recertification surveys for facilities that had a history of noncompliance or allegations of noncompliance. Effect: Delays in the completion of health and safety surveys increases the risk of inadequate care for Medicaid recipients and that Medicaid providers are not complying with health and safety standards. In addition, ineligible providers could be receiving federal funds. Recommendation: We recommend that the Department ensure that surveys required are conducted not later than 15 months after the last day of the previous survey and ensure that the statewide average interval between standard surveys must be 12 months. Management’s View: The Department Agrees with this finding. Corrective Action: During SFY24, Bureau of Facility Standards (BFS) was still coming out of the COVID response for recertification time frames and actively recruiting new health facility surveyors to ensure proper multidisciplined teams were available to complete the overdue surveys. BFS also contracted with Healthcare Management Solutions, LLC. to supplement overdue recertification surveys. On October 3, 2025, during the government shutdown, we were able to complete the final overdue surveys to be compliant with 15.9 months between surveys. Due to the government shutdown, CMS paused recertification surveys for nursing facilities. This may restrict our ability to maintain the required recertification timeline of 15.9 months. We have recruited and maintained staffing posture but are still actively recruiting to round out of staffing to meet the statutory timelines. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We appreciate the Department’s efforts to reduce the time between required surveys to 15.9 months; however, the United States Code of Federal Regulations Title 42 Section 488.308(a) requires the survey agency to conduct a survey of each nursing facility not later than 15 months after the last day of the previous survey. Based on our interpretation of the very specific language in the requirement that the reviews be completed not later than 15 months after the last day of the previous survey, we assert that the Department was not compliant with the requirement during the audit period and still not compliant as of October of 2025.

FINDING 2024-227 The review and approval of the annual updates to the Low-Income Home Energy Assistance Program (LIHEAP) benefits matrix were not documented. Type of Finding: Material Weakness Related to Prior Finding: 2023-211 AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLWC6, 2201IDLIEA, 2301IDLIEA, 2301IDLIEE, 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Eligibility Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP program staff utilizes software to determine eligibility and benefit amounts for applicants based on energy burden and qualifying factors. There is a benefits matrix within the software, which is updated annually. Each year, the Department’s LIHEAP program staff update the benefits matrix with any required changes. The review and approval of the changes were completed by program staff, who met in-person and completed testing scenarios to verify the accuracy of the information. After the test results were reviewed and no errors identified, the matrix information was uploaded into software production. Verbal confirmation was provided to the program manager. The review and approval of the changes to the benefits matrix were not documented during fiscal year 2024. The documented review and approval procedures were implemented in February 2025. Cause: The Department did not consider that documentation to support the review and approval of the updates to the benefits matrix was necessary during fiscal year 2024. Effect: We did not identify errors in the 60 approved and 60 denied eligibility determinations that were reviewed. However, without a documented review, there is an increased risk of errors in the benefits matrix. Recommendation: We recommend that the Department maintain sufficient documentation to support the review and approval of the updates to the benefits matrix. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The corrective action referenced was not completed, by the Department’s own admission, until March 6, 2025 which would have been significantly after the fiscal year 2023 issuance of the Single Audit Report, and also would have left fiscal year 2024 and most of fiscal year 2025 without proper internal controls in place. Without an appropriate control in place the Department continued to risk errors in the matrix going undetected and uncorrected until March of 2025.

FINDING 2024-228 The review of the Low-Income Home Energy Assistance Program (LIHEAP) earmarking compliance requirements was not documented. Type of Finding: Material Weakness Related to Prior Finding: 2023-212 AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLIE4, 2201IDLIE4, 2301IDLIEE, 2401IDLIEA, 2401IDLIEI Program Year: October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025 Federal Agency: Department of Health and Human Services Requirement: Matching, Level of Effort, Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP requires earmarking, which limits the percentage of grant funds that can be spent on administration, weatherization, and leveraging programs. The monitoring of LIHEAP earmarking requirements was completed by the program manager on a spreadsheet that tracked expenditures and appropriate limitations to ensure compliance was met. There was no documented review for accuracy nor approval of the tracking spreadsheet during fiscal year 2024. The documented review and approval procedures were implemented in February 2025. Cause: The Department did not consider that documentation to support the review and approval of the earmarking tracking spreadsheet was necessary to ensure accuracy and compliance during fiscal year 2024. Effect: We did not identify any errors in compliance with earmarking requirements during completion of audit procedures, but the lack of a documented review increases the risk of errors occurring and going undetected. Recommendation: We recommend that the Department maintain sufficient documentation to support the review and approval of the earmarking tracking spreadsheet. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The corrective action referenced above was not completed, by the Department’s own admission, until March 25, 2025 which would have been significantly after the fiscal year 2023 issuance of the Single Audit Report, and also would have left fiscal year 2024 and most of fiscal year 2025 without proper internal controls in place. Without an appropriate control in place the Department continued to risk errors in the spreadsheet going undetected and uncorrected until March of 2025 which could lead to noncompliance with earmarking requirements.

FINDING 2024-229 Low-Income Home Energy Assistance Program (LIHEAP) special reports did not include a review for accuracy and compliance prior to submission. Type of Finding: Material Weakness Related to Prior Finding: 2023-210 AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLIE4, 2201IDLIE4, 2301IDLIEE, 2401IDLIEA, 2401IDLIEI Program Year: October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: During fiscal year 2024, the Department was required to submit 6 LIHEAP special reports to the Federal Government. The Department’s LIHEAP program manager compiled the program special reports. The reports are submitted by the same program manager to the Office of Community Services. The reviews and approvals for 2 out of 6 program special reports tested (or 33 percent) were not documented. The LIHEAP program manager indicated that there were no documented review and approval of the program special reports between July 2023 and January 2024 for fiscal year 2024. Review and approval procedures were designed in April 2024 and implemented in February 2025. Cause: The Department staff indicated that there was no official approval process as reports are submitted online and the data source was either collaborated or provided by internal sources and verified during fiscal year 2024. The Department did not consider that documentation to support the review and approval of these reports was necessary to ensure accuracy and compliance with reporting requirements. Effect: We did not identify any errors in the LIHEAP special reports. However, without a documented internal control, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department maintain sufficient documentation to support the completion of a review for accuracy and compliance of required LIHEAP special reports prior to submission. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We would like to clarify that while the Department has indicated that review and approval procedures were developed in April 2024, the program manager stated that they were not implemented until February 2025, which is outside of our audit period. As a result, the Department was at risk for errors occurring and going undetected and uncorrected during fiscal year 2024.

FINDING 2024-230 The Department did not provide documented support to verify the accuracy of a Low-Income Home Energy Assistance (LIHEAP) performance report. Type of Finding: Significant Deficiency, Noncompliance AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLIE4, 2201IDLIE4, 2301IDLIEE, 2401IDLIEA, 2401IDLIEI Program Year: October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.302(b)(3) states that the recipient's financial management system must maintain records that sufficiently identify the amount, source, and expenditure of federal funds for federal awards. These records must contain information necessary to identify federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: During fiscal year 2024, the Department was required to submit one LIHEAP performance report to the Federal Government. The Department’s LIHEAP program manager compiled and submitted the report to the Office of Community Services. The Department was unable to provide the supporting documentation to confirm the accuracy of the information included in the report. Cause: The Department did not design and implement an internal control to ensure that sufficient documentation was maintained to support the accuracy of the required report. Effect: Without documented support for the LIHEAP performance report, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department maintain sufficient documentation to support information in LIHEAP performance reports. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The corrective action referenced above was not completed, by the Department’s own admission, until March 25, 2025, which would have been significantly after the fiscal year 2023 issuance of the Single Audit Report, and also would have left fiscal year 2024 and most of fiscal year 2025 without proper internal controls in place. Without an appropriate control in place the Department continued to risk errors in the report going undetected and uncorrected until March of 2025 which could lead to noncompliance.

FINDING 2024-231 Supporting documentation for subrecipient risk assessments for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program was not available for review. Type of Finding: Significant Deficiency, Noncompliance Related to Prior Finding: 2023-222 AL Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises AL Number: 93.391 Federal Award Number: 1 NH75OT000105-01-00, 6 NH75OT000105-01-00 Program Year: June 1, 2021 – May 31, 2024 Federal Agency: Department of Health and Human Services Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.332(b) states that all pass-through entities must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Additionally, 2 CFR 200.332(c)(2) states that all pass-through entities must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the results of previous audits. This includes considering whether the subrecipient receives a Single Audit in accordance with 2 CFR 200 subpart F and the extent to which the same or similar subawards have been audited as a major program. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program had a total of 6 subrecipients during fiscal year 2024. During testing, the Department was unable to provide a subrecipient risk assessment for 2 out of 6 subrecipients tested (or 33 percent). In the risk assessment, the Department documents the need for a subrecipient to have a Single Audit, if necessary, and the Department’s review of required subrecipient Single Audits. The Department was compliant with all other aspects of the subrecipient monitoring compliance requirements for the subrecipients. Cause: Staff turnover led to the documentation creation and retention shortcomings as new staff were being trained and onboarded when risk assessments should have been completed and documented, including Single Audit requirements. Effect: The Department is exposed to increased risk of noncompliance related to subrecipients and improper payments in the STLT Health Department Response to Public Health or Healthcare Crises program. Recommendation: We recommend that the Department strengthen internal controls to ensure required risk assessments are completed and supporting documentation is retained. Management’s View: The Department Agrees with this Finding. Corrective Action: The Division of Public Health updates its standard operating procedures annually and communicates updates to staff. The DPH Federal Compliance Officer is conducting monthly trainings to cover all required steps in the process and will begin conducting mini audits in calendar year 2026 to ensure all steps are being followed consistently. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-232 An incorrect Federal Medical Assistance Percentage (FMAP) rate was applied while calculating the federal and state share of expenditures for the Child Care and Development Fund (CCDF) financial report resulting in an understatement of $1,064,932 of the federal share of costs. Type of Finding: Significant Deficiency, Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Matching, Level of Effort, Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 98.55(a) states that federal matching funds are available for expenditures in a state based upon the formula specified in 42 CFR 98.63(a). Also, 42 CFR 98.55 (b) states that expenditures in a state under paragraph (a) of this section will be matched at the federal medical assistance rate for the applicable fiscal year for allowable activities, as described in the approved State Plan, that meet the goals and purposes of the Act. Additionally, 42 CFR Section 98.55 (c) states that in order to receive federal matching funds for a fiscal year under paragraph (a) of this section: (1) States shall also expend an amount of non-Federal funds for child care activities in the State that is at least equal to the State's share of expenditures for fiscal year 1994 or 1995 (whichever is greater) under sections 402(g) and (i) of the Social Security Act as these sections were in effect before October 1, 1995; and (2) The expenditures shall be for allowable services or activities, as described in the approved State Plan if appropriate, that meet the goals and purposes of the Act. (3) All Mandatory Funds are obligated in accordance with Section 98.60(d)(2)(i). Condition: The Department is required to complete a CCDF financial report, Form ACF-696, on a quarterly basis for each grant. We found that 1 out of 4 CCDF financial reports tested (or 25 percent), had an incorrect FMAP rate applied while calculating the federal and State share of expenditures, understating federal funds by $1,064,932. Cause: Staff turnover, insufficient training, and the implementation of Luma caused an incorrect FMAP rate to be applied while calculating the federal and state share of expenditures on the CCDF financial report. In addition, the review procedures were not completed at a level sufficient to identify an error. Effect: An incorrect FMAP rate was applied causing federal funds to be understated by $1,064,932. Recommendation: We recommend that the Department strengthen internal controls over the application of FMAP rates and review the reports at a level sufficient to identify errors. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department's Grant Reporting team has been developing additional internal controls to put in place with the utilization of the Luma ERP. These controls include conducting reconciliations between internal workpapers and Luma records as well as reconciling to external parties such as the Payment Management System. This has streamlined our approach and has allowed management more opportunity to review items with higher risk factors, such as the quarterly change in FMAP rates during the stepdown from enhanced FMAP rates during COVID. We believe these increased focused efforts will alleviate issues like this in the future and are ongoing as the Department identifies opportunities for advancements in our own processes and working with SCO to implement better Luma reports and controls within the grant reconciliation process. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-233 The submission of Child Care and Development Fund (CCDF) financial report was not completed timely. Type of Finding: Significant Deficiency, Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 98.65(g) states that Lead Agencies shall submit financial reports, in a manner specified by the ACF, quarterly for each fiscal year until funds are expended. Additionally, Form ACF-696 (Financial Reporting Form for State and Territory Child Care and Development Fund (CCDF) Lead Agencies) states that this form must be submitted quarterly, reports are due 30 days after the end of the quarter: Quarter 1 by October 31, Quarter 2 by April 30, Quarter 3 by July 31, and Quarter 4 by January 31. Condition: The Department is required to complete a CCDF financial report, Form ACF-696, on a quarterly basis for each grant. Each report must be submitted within 30 days after the end of the applicable quarter. We found 1 out of 4 ACF-696 tested (or 25 percent) was submitted 2 months after the due date. The report for the quarter ended September 30, 2023, was submitted in January 2024. No other compliance or substantive errors were noted related to the report submission. Cause: Staff turnover, insufficient training, and the implementation of Luma caused the Department’s late submission of the required Form ACF-696 for the quarter ended September 30, 2023. The Department requested an extension from the ACF to complete necessary adjustments, but the request was denied. Effect: Late submission of the report resulted in the Department’s noncompliance with federal requirements. Recommendation: We recommend that the Department strengthen internal controls to ensure the timely submission of the CCDF financial report, Form ACF-696. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department has seen an increased time commitment related to financial grant reporting since the implementation of Luma in July 2023. This was particularly relevant in SFY 2024 as Luma implementation, training and interfaces were still evolving, resulting in a tremendous increase in time commitments without the corresponding staff increases needed. In many cases, this resulted in late filings and/or filing reports that were not reviewed in sufficient detail. The Division of Financial Services continues to work through the inefficiencies encountered and design processes that include sufficient review and other internal controls while also allowing for timely completion of required reports. One FTE was transferred from another team to the Cash and Grants team. This position is expected to assist in completing preliminary tasks so that Grant Reporters have necessary data at their fingertips when drafting financial reports. As Department staff continue to learn nuances of the Luma system, both accuracy and timeliness of financial reporting is expected to improve. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-234 Payroll adjustments lacked sufficient internal controls. Type of Finding: Significant Deficiency AL Title: Immunization Cooperative Agreements, Temporary Assistance for Needy Families, Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund, State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.268, 93.558, 93.575, 93.596, 93.777, 93.778 Federal Award Number: Various Program Year: Various Federal Agency: Department of Health and Human Services Requirement: Activities Allowed or Unallowed, Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The State implemented a new Enterprise Resource Planning system, Luma, in July 2023. Due to the implementation, and insufficient experience, some transactions were entered incorrectly into Luma. Necessary adjustments were completed by both the Department and the Office. We noted 21 out of 42 payroll adjustments tested (or 50 percent) that were not properly reviewed and approved, and of those 21 noted payroll adjustments, 4 were completed by the Office, and 17 were completed by the Department. Additionally, of those 21 noted payroll adjustments, 6 were completed by the Department and had the same personnel submitting, approving, and releasing the adjustment. The remaining 15 payroll adjustments had no documented review and approval information. Cause: The majority of the noted deviations were processed in the beginning of fiscal year 2024. According to the Department’s personnel, the reviews of payroll adjustments were not consistently documented following the implementation of Luma. The significant number of adjustments processed and time constraints were provided as the reason the Department had the same personnel submit, approve, and release the adjustments. In addition, according to Office personnel, multiple adjustments were processed due to a statewide correction to the benefit coding in the beginning of fiscal year 2024. An incorrect account was used to record benefits. This correction was reviewed by the Department’s payroll team and followed the financial payroll correction process. However, there was no documentation of the review process. Effect: We did not identify any substantive or compliance errors during testing over payroll adjustments. However, without documentation of a review and approval, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department consistently maintain documentation of implemented review and approval procedures over payroll adjustments. We further recommend that the Department request that it be provided appropriate documentation of any adjustments made by the Office on its behalf. Management’s View: The Department Agrees with this Finding. Corrective Action: The department has established internal controls to ensure appropriate separation of duties and proper documentation of all reviews. When an accounting adjustment is required, staff prepare the adjustment using either an Infor Spreadsheet Designer (ISD) template or an Excel template. ISD is used for adjustments involving large volumes of data. Because ISD-generated adjustments cannot be reviewed within the system after entry, the completed template is sent to a Financial Specialist Principal (or higher) for review prior to upload. Email approval is obtained and attached to the adjustment record when it is entered into the system. For adjustments involving smaller amounts of data, staff use the Excel template. The Excel template, original GL lines, supporting documentation, and any other relevant information are attached when the adjustment is entered. After the manual adjustment is submitted, it is automatically routed to a Financial Specialist Principal (or higher) for approval before final posting. These procedures ensure that all adjustments undergo an independent review and that documentation is consistently maintained. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-235 Quarterly financial reports for the Social Security Disability (DI) grant were submitted after the required deadline. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Social Security Disability Insurance Assistance Listing Number: 96.001 Federal Award Number: 23-04IDD100; 24-04IDD100 Program Year: October 1, 2022 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: Social Security Administration Compliance Requirement: Reporting Questioned Costs: None The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Social Security Administration (SSA) oversees the administration of the DI program with comprehensive guidance provided in the Program Operations Manual System (POMS). At the end of each quarter, the State Disability Determination Services (DDS) submits a Form SSA-4513, State Agency Report of Obligations for SSA Disability Programs, to account for program disbursements and obligations, and a Form SSA-4514, Time Report of Personnel Services for Disability Determination Services, to account for employee time. The State DDS is required to submit the forms to the designated SSA regional office, which, pursuant to POMS sections DI 39506.202 and DI 39506.230, is responsible for setting the submission deadlines for quarterly reports. The State’s designated regional office has mandated a deadline of thirty days following the conclusion of each fiscal quarter. Condition: The Department submitted four reports during our audit period. We selected a sample of 2 quarterly reports, each including forms SSA-4513 and SSA-4514, to test for compliance and internal controls. The Department has a control procedure in place for the reports to be reviewed by a qualified person prior to submission. Our testing found that reports were submitted 17 and 23 days after the established deadline set by SSA’s regional office. However, no substantive errors were identified in our testing, and we confirmed that the internal control procedure for accuracy was operating as designed. Cause: Reports were submitted late due to delays in obtaining the payroll data needed to comply with the U.S. Department of Labor’s modified accrual-based grant reporting requirements. Payroll is processed biweekly for the prior timesheet period, creating a delay in the availability of the previous month’s data. In prior years, the Department estimated payroll costs, which led to inaccuracies in federal quarterly reports. Although adjustments were made in the following quarter, they did not align with the actual payroll reporting periods. With the implementation of the State’s current accounting system (Luma), the Department prioritized using actual payroll data to improve accuracy, even if it resulted in late report submissions. Effect: Late report submissions may hinder timely oversight by the federal regulator and delay identification of potential financial or compliance issues. Recommendation: We recommend that the Department consider additional methods to ensure timely submission of reports. Management’s View: The Idaho Department of Labor agrees with the audit finding. Prior to Luma go-live, our legacy cost accounting system was programmed to accrue payroll monthly by grant. The process was programmed into our system to provide estimated payroll earlier than when it paid out in the state system, meaning cost accounting could close the period on a timeline that allowed our reporting staff to file our quarterly federal reports before their due date. Our legacy process then called for a quarterly true-up in the subsequent quarter of our internal cost accounting system to the state system (STARS). This lag between the accrual and the true-up meant that expenses were not fully accounted for or reported in the quarter in which they were incurred. In Luma, complete accrued monthly payroll data is not available until the final payroll for the prior month pays out. There is no mechanism for us to estimate payroll to close the month early like we did in legacy. Because of the timing of the bi-weekly payrolls, there are some months when the final payroll for the quarter does not pay out in Luma until close to the due date for some of our quarterly federal reports. Once that payroll is posted in Luma, it currently takes approximately 10 days to do final entries for the month and then close the period. Many of our federal reports are not due until 45 days after the end of the quarter. Since Luma go-live we have made significant process improvements that now allow us to close the period and file those reports in time. For a couple of our grants, the federal report’s due date is 30 days after the end of the month. Filing those reports within the 30-day filing window has been very challenging due to the lag in payroll and closing described above. The DDS program is one such program where the federal report is due 30 days from the end of the quarter. Corrective Action: The department is taking several steps to provide for a faster month-end close: Step 1: Process Mapping of Cost Accounting Closing a. As part of our strategic planning initiative, document the new closing process in Luma through process maps b. Review process maps internally in accounting and with executive leadership to help identify areas where efficiencies could be achieved c. Implement identified areas of efficiency Step 2: Assess potential for expedited close on quarter-end months a. Cost Accounting manager, supervisor and financial executive officer to review calendar and timing of payroll for quarter-end closings b. Cost Accounting manager, supervisor, and financial executive officer to develop plans for expedited close with potential for overtime, pulling additional resources from other teams and any other options that may help shorten the close period to allow us to file quarterly federal reports timely. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-236 The review and approval of quarterly special reports for the Unemployment Insurance (UI) program were not consistently documented, and the reports were submitted after the required deadline. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Unemployment Insurance Assistance Listing Number: 17.225 Federal Award Number: 24A55UI000030-01; 23A03UI039319-01; UI-35645-21-55-A-16; 23A55UI034712-01 Program Year: October 1, 2023 – December 31, 2026; October 1, 2022 – December 31, 2025; October 1, 2020 – December 31, 2023; April 1, 2020 – June 30, 2024 Federal Agency: U.S. Department of Labor Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Quarterly UI Above-Base (UI-3) report requires information on staff years worked and paid by program category. The reports are due within 30 days after the end of the reporting quarter as required by the U.S. Department of Labor, per the Employment and Training (ET) Handbook No. 336, Unemployment Insurance State Quality Service Plan Planning and Reporting Guidelines. Condition: We tested all 4 UI-3 quarterly reports that were due during our audit period. Our evaluation determined that 3 out of the 4 reports were submitted after the established deadline. Only the first quarterly report, covering the period ending June 30, 2023, and prepared using the State’s prior accounting system (STARS), was submitted by the deadline. The 3 subsequent quarterly reports, prepared after the State’s transition to Luma, were submitted 13, 31, and 35 days late. The Department has a control procedure in place for the reports to be reviewed by a qualified person prior to submission. Our testing found that 1 of the 4 quarterly reports was missing documented approval, typically retained via e-mail. Cause: Reports were submitted late due to delays in obtaining the payroll data needed to comply with the U.S. Department of Labor’s modified accrual-based grant reporting requirements. Payroll is processed biweekly for the prior timesheet period, creating a delay before the previous month’s data is available. In prior years, the Department estimated payroll costs, which led to inaccuracies in federal quarterly reports. Although adjustments were made in the following quarter, they did not align with the actual payroll reporting periods. With the implementation of Luma, the Department prioritized using actual payroll data to improve accuracy, even if it resulted in late report submissions. The Department was in the process of updating their reporting procedures and did not require documentation of the controls to be retained at the time. Effect: Without a documented review, there is an increased risk that the reports contain inaccurate data. Further, late report submissions may hinder timely oversight by the federal regulator and delay identification of potential financial or compliance issues. Recommendation: We recommend that the Department design and implement internal controls to ensure reports are submitted on time and sufficient documentation is maintained to support the completion of a review for accuracy and compliance. Management’s View: The Idaho Department of Labor agrees with the audit finding. During the period in question, our federal reporting team was in the process of transitioning reporting duties from the financial specialist principal over reporting to the financial specialist senior over reporting. During the training process, one report was completed and reviewed in tandem as part of the training process and no paper trail was retained to document that the report had been properly reviewed by the financial specialist principal. Once the handoff of the task was completed, subsequent reports were prepared by the financial specialist senior and then queued to the principal for review, and the paper trail was properly captured and retained. Prior to Luma go-live, our legacy cost accounting system was programmed to accrue payroll monthly by grant. The process was programmed into our system to provide estimated payroll earlier than when it paid out in the state system, meaning cost accounting could close the period on a timeline that allowed our reporting staff to file our quarterly federal reports before their due date. Our legacy process then called for a quarterly true-up in the subsequent quarter of our internal cost accounting system to the state system (STARS). This lag between the accrual and the true-up meant that expenses were not fully accounted for or reported in the quarter in which they were incurred. In Luma, complete accrued monthly payroll data is not available until the final payroll for the prior month pays out. There is no mechanism for us to estimate payroll in order to close the month early like we did in legacy. Because of the timing of the bi-weekly payrolls, there are some months when the final payroll for the quarter does not pay out in Luma until close to the due date for some of our quarterly federal reports. Once that payroll is posted in Luma, it currently takes approximately 10 days to do final entries for the month and then close the period. Many of our federal reports are not due until 45 days after the end of the quarter. Since Luma go-live we have made significant process improvements that now allow us to close the period and file those reports in time. For a couple of our grants, the federal report’s due date is 30 days after the end of the month. Filing those reports within the 30-day filing window has been very challenging due to the lag in payroll and closing. The UI program is one such program where the UI-3 report is due 30 days from the end of the quarter. Corrective Action: The department has taken measures to ensure proper documentation of the review process: Step 1: Provide a designated place on the UI-3 back-up documentation and quarterly report work papers for reviewer to sign off directly in the work papers. Step 2: The individual who enters the report into the federal system will not proceed with entering the report into the system unless the workpapers have the review and approval in the workpapers. The department is taking several steps to provide for a faster month-end close: Step 3: Process Mapping of Cost Accounting Closing a. As part of our strategic planning initiative, document the new closing process in Luma through process maps b. Review process maps internally in accounting and with executive leadership to help identify areas where efficiencies could be achieved c. Implement identified areas of efficiency Step 4: Assess potential for expedited close on quarter-end months a. Cost Accounting manager, supervisor and financial executive officer to review calendar and timing of payroll for quarter-end closings b. Cost Accounting manager, supervisor, and financial executive officer to develop plans for expedited close with potential for overtime, pulling additional resources from other teams and any other options that may help shorten the close period to allow us to file quarterly federal reports timely. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-237 The Division could not provide supporting documentation for amounts included on the Rehabilitation Services Administration (RSA) reports required under the Rehabilitation Services-Vocational Rehabilitation Grants to States. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Reporting Questioned Costs: $1,445,110 Known Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR), 2 CFR 200.303, states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Section CFR 200.302 – Financial Management states that federal award recipient’s financial management system must identify all federal awards received and expended and the federal programs under which they were received. Additionally, they must maintain records that sufficiently identify the amount, source, and expenditure of federal funds for federal awards. These records must contain information necessary to identify federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: The RSA requires the Division to submit financial reports (RSA-17) every 6 months. The reports are cumulative and cover the entire grant period through to the end of the reporting period. Reporting periods end on March 31 and September 30. If the reporting period is the final report for the grant, the report is due 120 days after the close of the period. All other reports are due 30 days after the close of the period. Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. In State fiscal year 2024, there were 3 grants open – federal fiscal years 2022, 2023, and 2024. The Division was required to submit 4 reports for these grants. We compared the federal expenditure amounts reported for the grant in total and for the Pre-Employment Transition Services (Pre-ETS) to the amounts in Luma and found errors in all 4 as follows: Total Expenditures Grant Year Report Period End RSA-17 Amount Luma Amount Difference Federal Fiscal Year 2022 9/30/23 $14,601,067 $13,941,207 $659,860 Federal Fiscal Year 2023 9/30/23 $7,633,338 $7,465,827 $167,511 Federal Fiscal Year 2023 3/31/24 $16,823,595 $16,661,795 $161,800 Federal Fiscal Year 2024 3/31/24 $2,007,420 $2,077,874 $(70,454) TOTAL $918,717 Pre-ETS Grant Year Report Period End RSA-17 Amount Luma Amount Difference Federal Fiscal Year 2022 9/30/23 $2,579,855 $2,991,527 $(411,672) Federal Fiscal Year 2023 9/30/23 $3,083,866 $2,869,311 $214,555 Federal Fiscal Year 2023 3/31/24 $5,596,382 $5,005,941 $590,441 Federal Fiscal Year 2024 3/31/24 $211,681 $78,612 $133,069 TOTAL $526,393 Cause: Reports were prepared by former employees, and the current personnel could not determine why the reported amounts did not match Luma. Further, supporting documentation was not retained by the Division, which might have provided insight into the differences. Effect: The RSA uses the RSA-17 reports to determine compliance with federal statutes, regulations, and the terms and conditions of the federal award. Incorrect reporting can affect both the ability to cover current obligations and the amount of future federal grant awards received by the State of Idaho. We are questioning the amount that Division cannot support for reported total expenditures and pre-ETS expenditures of $918,717 and $526,393, respectively. Recommendation: We recommend that the Division design and implement procedures to ensure accurate federal grant reporting and retain appropriate documentation to support the amounts reported. We also recommend that the Division review prior submissions, identify correct reporting, and communicate with the federal grantor about resubmitting corrected reports. Management’s View: The issues uncovered during the single audit are in alignment with challenges and weaknesses uncovered over the last 17 months. As such, we are in agreement with the seven identified findings specified in the Management letter. The Division will ensure the accuracy, reliability, and sufficient supporting documentation of financial data pulled from the state accounting system of record (LUMA) that is reported on all RSA-17 reports by implementing effective internal controls, verification procedures, and record retention practices in compliance with 2 CFR 200.302 and 2 CFR 200.303. Corrective Action: 1.1 Establish Accurate Reporting Procedures: Develop and implement procedures for preparing, reviewing, and approving all RSA financial reports, including step-by-step reconciliation. 1.2 Ensure Documentation and Audit Trail: Maintain comprehensive supporting documentation for all amounts reported, including detailed reconciliations, adjustments, and source data, in accordance with requirements for traceable and verifiable records. 1.3 Strengthen Internal Controls and Oversight: Implement Strategic Leadership review of all reports prior to submission to the Rehabilitation Services Administration to confirm data accuracy and compliance with reporting requirements. 1.4 Complete a Restatement of RSA-17 Reports: Review previously submitted RSA-17 reports for fiscal years 2022–2024, determine accurate expenditure amounts, and coordinate with RSA to correct and resubmit revised reports, if necessary. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. While the Division’s corrective action plans indicate that portions are complete, because they have occurred outside of the period under audit, we have not reviewed those actions to see that they are effective at addressing the issues identified.

FINDING 2024-238 The Division did not comply with Matching, Level of Effort, and Earmarking requirements for the fiscal year 2022 Rehabilitation Services-Vocational Rehabilitation Grants to States program. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Matching, Level of Effort, Earmarking Questioned Costs: $51,728 Known Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 361.62, Maintenance of effort requirements, states (a) General requirements. The Secretary (of Education) reduces the amount otherwise payable to a State for any fiscal year by the amount by which the total expenditures from non-Federal sources under the vocational rehabilitation services portion of the Unified or Combined State Plan for any previous fiscal year were less than the total of those expenditures for the fiscal year two years prior to that previous fiscal year. Condition: Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. In State fiscal year 2024, there were 3 grants open – federal fiscal years 2022, 2023, and 2024. Maintenance of effort is one part of the level of effort grant requirements. The federal fiscal year 2022 grant period ended on September 30, 2023. It is the only grant that we could evaluate for level of effort compliance because it is the only one that ended within State fiscal year 2024, which is the period of our audit. The Division is required to spend at least the amount of State funds expended in the fiscal year two years prior. We compared State expenditures for the federal fiscal years 2020 and 2022 grants based on amounts reported on the RSA-17 reports. RSA-17 Report RSA-17 Report Federal Fiscal Year 2020 Grant Expenditures Federal Fiscal Year 2022 Grant Expenditures Difference $4,508,835 $4,222,109 $(286,726) This analysis found that the Division did not meet level of effort requirements because State spending for the federal fiscal year 2022 grant was $286,726 less than State spending for the federal fiscal year 2020 grant. We performed additional analysis on the amounts reported and compared them to the underlying information in Luma and STARS due to errors we identified in the RSA-17 reports; also described in Finding 2024-237. We found that the amounts reported for the federal fiscal years 2020 and 2022 grants did not match the amounts recorded in Luma or STARS, and the Division could not provide documentation to support the differences. We compared the State expenditures for federal fiscal years 2020 and 2022 grants based on the amounts recorded in Luma and STARS. Accounting System Accounting System Federal Fiscal Year 2020 Grant Expenditures (STARS) Federal Fiscal Year 2022 Grant Expenditures (Luma and STARS) Difference (STARS) $4,072,786 $4,021,058 $(51,728) In both of our analyses, the Division still failed to meet level of effort requirements. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. The staff in place during our single audit procedures were not the same as the staff who compiled the RSA-17 reports for the federal fiscal years 2020 or 2022 grants and could not locate any documentation to support the amounts reported or verify that the Division had internal controls in place to monitor the matching, level of effort, or earmarking requirements for compliance. Effect: We did not identify any errors with the matching or earmarking requirements, however, reporting errors, when corrected, could result in noncompliance. The noncompliance with the level of effort requirements could result in the RSA reducing the federal grant award to the Division for the federal fiscal year 2025 grant. Recommendation: We recommend that the Division design and implement procedures to ensure compliance with matching, level of effort, and earmarking requirements. We also recommend the Division contact the federal grantor to resolve the noncompliance related to the level of effort requirement. Management’s View: The Division will ensure compliance with all matching, level of effort, and earmarking requirements by developing and implementing internal control processes, accurate financial tracking mechanisms, and adequate supporting documentation for all federal grant expenditures. Corrective Action: 2.1 Develop and Implement Written Policy (Grants Management Manual Section) and Procedures: Establish documented procedures for monitoring and validating compliance with state match funds, maintenance of effort (MOE), and earmarking requirements for each active RSA grant. 2.2 Training and Staff Accountability: Train fiscal and leadership staff responsible on grant calculation methods, documentation standards, and compliance monitoring for matching and level of effort requirements. 2.3 Ongoing Monitoring: Conduct annual compliance reviews before report submission to verify that all level of effort and earmarking requirements are satisfied and adequately supported. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. While the Division’s corrective action plans indicate that portions are complete, because they have occurred outside of the period under audit, we have not reviewed those actions to see that they are effective at addressing the issues identified.

FINDING 2024-239 The Division does not have documented control procedures in place to ensure compliance with period of performance requirements for the Rehabilitation Services-Vocational Rehabilitation Grants to States. Type of Finding: Material Weakness Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Period of Performance Questioned Costs: Undetermined Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. In State fiscal year 2024, there were 3 grants open – federal fiscal years 2022, 2023, and 2024. The Division uses Aware, a case management system which documents clients’ Individual Plans for Employment (IPE). The IPEs have employment goals, planned services, estimated costs, client responsibilities, and criteria for evaluating progress. Expenditures are initially entered into Aware and uploaded into Luma for payment. The Division uses project codes in Aware to designate expenditures to specific grant periods. The project codes correlate to grant codes in Luma when transactions are uploaded from Aware. Grant codes are used to track expenditures and period of performance for each grant award. Client expenditures are entered into Aware, and Regional Managers review the entries for accuracy, including the correct project code for the period of performance. As grant periods begin and end, the project codes in Aware need to be changed to correlate to new grant codes in Luma. The Division stated that, in past years, the changes to the project codes would be discussed among the fiscal staff and communicated to the regional managers, and the final changes were reviewed for accuracy and inclusion in the proper period. The Division made changes to the project codes but could not provide documentation to confirm these changes were reviewed and approved in fiscal year 2024. Further, the Division could not provide documentation of any additional procedures to evaluate period of performance at an overall program level that would detect errors in the coding of project codes or federal grant codes. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. This likely contributed to internal controls not being properly executed. Documentation was not retained to verify internal controls. Effect: Regional managers review transaction entries to ensure they are for allowable costs and coded to the correct project codes to comply with period of performance requirements. This control procedure is ineffective if the project codes in Aware are not linked to the correct grant codes in Luma. The Division does not have any other control procedures in place to evaluate period of performance at an overall program level, which increases the risk of noncompliance. Our testing did not identify any noncompliance with period of performance requirements, however, without effective controls in place, errors could be made and remain undetected. Recommendation: We recommend that the Division design and implement control procedures to ensure compliance with period of performance requirements and maintain documentation to demonstrate both that controls were operating as intended and compliance was achieved. Management’s View: To ensure that all federal grant expenditures are properly recorded within their authorized period of performance by implementing documented internal controls, verification processes, and documentation retention procedures. Corrective Action: 3.1 Document Control Procedures: Develop and implement formal, written procedures (Grants Management Manual Chapter) for verifying that expenditures are assigned to the correct period of performance in both Aware and Luma. 3.2 Training: Train IDVR team members on policies and procedures tied to Period of Performance. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We would like to emphasize that staff training should be an ongoing activity to ensure that staff are knowledgeable about the program and the requirements to accepting federal assistance. Additionally, implementation of internal controls as identified in the grants management manual will be critical to ensuring compliance. Also, while the Division’s corrective action plans indicate that portions are complete, because they have occurred outside of the period under audit, we have not reviewed those actions to see that they are effective at addressing the issues identified.

FINDING 2024-240 The Division is not following Idaho Administrative Rules for Purchasing as required by federal requirements. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The CFR procurement standards at 2 CFR 200.317 states that, when procuring property and services under a federal award, a state must follow the same policies and procedures it uses for procurements from its nonfederal funds. The state of Idaho purchasing rules within the Idaho Administrative Procedures Act (IDAPA) contain the following provisions: IDAPA 38.05.01.32. Total Cost: The acquisition cost of property, including all components, options, and add-ons available under the contract, related services, and, in the case of ongoing services, the cost of the full term of the contract, including all authorized renewals. Unless a different total term is provided in the contract, the term used for purposes of total cost is five (5) years. IDAPA 38.05.01.041. Acquisition Procedures: • Small Purchases: Services with less than $25,000 total cost; software with less than $15,000 total cost; property with less than $15,000 total cost; a mix of property and services less than $15,000. o Small purchases do not require acquisition through competitive solicitation. Agencies must comply with the division’s small purchase policy. Property available under single agency or open contracts shall be purchased under such contracts and are not a small purchase under this rule unless otherwise authorized by the administrator. • Informal Purchases: Acquisition of property with a total cost exceeding the dollar limits established in this rule for a small purchase and less than the formal sealed procedure limit are informal purchases. o Informal Purchases may be made using:  An informal solicitation issued through e-procurement, unless exempted by the administrator; or  The formal sealed procedure, when the purchasing authority makes a written determination that using a formal solicitation is in the best interest of the state, including where selection based solely on cost is not appropriate. o Agencies procuring property under this rule shall maintain a purchasing file containing:  The solicitation document posted and quotes received. If the acquisition was not publicly posted, the agency shall include a statement describing the justification for determining that posting was impractical or impossible, along with the administrator’s authorization.  If not using e-procurement, the agency shall document the quotes received (or its attempt to obtain quotes) from at least three (3) vendors having a significant Idaho economic presence as defined in Section 67-2349, Idaho Code. • Formal Sealed Procedure: o The sealed procedure limit is one hundred fifty thousand dollars ($150,000). o Purchases of property in excess of the sealed procedure limit are made using the formal sealed procedure, unless exempted by these rules or the administrator. IDAPA 38.05.01.042.01. Exceptions requiring written administrator approval. The administrator may exempt the following purchases from the requirement for competitive solicitation by issuing a written determination to the purchasing authority. • Rehabilitation Agency Acquisitions. Acquisitions of property that is provided by non-profit corporations and public agencies operating rehabilitation facilities serving the handicapped and disadvantaged and that is offered for sale at fair market price as determined by the administrator in accordance with these rules. The buyer must submit a written request to the administrator to purchase from a rehabilitation agency and a written approval from the administrator. The purchase must comply with the division’s policy for rehabilitation agency acquisitions. Condition: We identified a population of 75 vendors that were paid more than $25,000 in fiscal year 2024 by the Division. The total dollar value of that population is $7,366,145 and we also identified 18 vendors within that population that received total payments that were large enough to be considered individually significant, based on materiality. We reviewed all of those 18 vendors and also selected a random sample of 6 vendors from the remaining 57 vendors in our population to arrive at a total testing group of 24 vendors. We evaluated if the Division’s internal controls were properly designed, in place, and effective in preventing or detecting errors. We also assessed if the Division was in compliance with procurement policies, both as required by the Rehabilitation Services – Vocational Rehabilitation Grants to States program and the State. The main internal control that the Division relies on to ensure compliance is that appropriate personnel review the procurement documents and approve the contract or purchase made prior to payment. The Division could not provide evidence that the review and approval occurred for 3 of the 6 (or 50 percent) randomly sampled vendors, and for 2 of the 18 (or 11 percent) vendors that had significant payments. We also found that the Division could not provide documentation to show that State procurement policies were followed for 4 of the 6 (or 67 percent) sampled vendors and 4 of the 18 (or 22 percent) individually significant vendors. Cause: The Division misunderstood several purchasing requirements. It believed that an exemption for rehabilitation agencies applied to more vendors than just not-for-profit entities and public agencies. The Division also believed that the State purchasing policies did not apply to vendors with many small purchases that are individually below, but collectively exceed, the purchasing thresholds. This misunderstanding led to noncompliance with purchasing requirements. Effect: The State’s purchasing policies are designed to ensure that State and federal funds are expended efficiently to meet the goals of State and federal programs. By not following these policies, the Division could be overpaying for products and services and is not in compliance with federal grant requirements. Recommendation: We recommend that the Division design and implement procedures to ensure that State purchasing policies are followed. This should include training to ensure that staff understand what purchases require additional procedures. We further recommend that the Division design and implement procedures to ensure that appropriate documentation is retained to demonstrate compliance and that internal controls were operating as intended. Management’s View: The Division will ensure full compliance with Idaho Administrative Rules for Purchasing and applicable federal procurement standards by developing, implementing, and maintaining internal controls, procedures, and documentation of practices that verify all procurements, regardless of funding source or transaction size adhere to State and Federal purchasing requirements. Corrective Action: 4.1 Policy Alignment: Review and revise internal procurement policies and procedures to align with IDAPA 38.05.01, 2 CFR 200.317, and 2 CFR 200.303 requirements. 4.2 Training and Awareness: Provide training to all staff to ensure understanding of: 4.2.1 Purchasing thresholds and categories (small, informal, and formal purchases). 4.2.2 Documentation and approval requirements. 4.2.3 Process and documentation requirements for purchases requiring exemptions. 4.3 Internal Control Strengthening: Develop and implement internal control mechanisms to ensure compliance with State and Federal purchasing requirements. 4.4 Monitoring and Accountability: Establish a quality assurance and compliance monitoring process to perform monitoring of procurement transactions to verify compliance with Division policies and procedures. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2024-241 The Division did not verify that vendors receiving payments from the Rehabilitation Services – Vocational Rehabilitation Grants to States program, were not suspended or debarred prior to making federal grant payments. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Nonfederal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (for example, grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Condition: We identified 75 vendors that were paid more than $25,000 in total expenditures in fiscal year 2024 by the Division. The total dollar value of that population is $7,366,145 and we identified 18 vendors within that population that received total payments that were large enough to be considered individually significant, based on materiality. We reviewed those 18 vendors and selected a random sample of 6 vendors from the remaining 57 vendors in our population to arrive at a total testing group of 24 vendors. The Division relies on appropriate personnel reviewing the documents that support verification that the vendor is not suspended or disbarred, and then indicate approval by e-mail, as its primary internal control to assure compliance with federal regulations. Our testing found that the Division could not provide the documentation to show that the review and approval occurred for 5 of the 6 (or 83 percent) sampled vendors and for 7 of the 18 (or 39 percent) vendors identified as individually significant. Cause: The Division has procedures in place to retain documentation showing the suspension and debarment reviews were completed, reviewed, and approved for new vendors added during fiscal years 2022, 2023, and 2024. However, the Division could not provide documentation to show that vendors added prior to fiscal year 2022 were subject to this process. Further, the Division does not perform any subsequent checks to ensure that vendors did not become suspended or debarred after they were initially added to the current statewide accounting system (Luma) or prior statewide accounting system (STARS) which increases the risk that payments could be made to a suspended or disbarred vendor. Effect: We reviewed all vendors selected as part of our testing and verified that none of them were on the SAM list as suspended or debarred. However, the Division does not have adequate controls in place to ensure that they are not entering into covered transactions with suspended or debarred vendors. Vendors can be suspended or debarred for many reasons including financial crimes such as fraud, embezzlement, or bribery, and other issues such as consistently poor performance on previous contracts or violations of laws. Taking steps to ensure vendors are not suspended or debarred is important to prevent fraud, waste, and abuse. Recommendation: We recommend that the Division develop and implement procedures to ensure that they are regularly reviewing vendors with whom it is contracted to ensure compliance with suspension and debarment requirements. Management’s View: The Division will ensure full compliance with federal suspension and debarment requirements by establishing and maintaining effective internal controls and procedures that verify and document vendor eligibility prior to contract execution and throughout the vendor relationship. 5.1 Corrective Action: Policy Development and Alignment: Revise the Division’s procurement and grant management procedures to include mandatory ongoing verification and documentation of suspension and debarment status for all vendors involved in covered transactions. 5.2 Systematic Verification Process: Implement a standardized process to verify vendor eligibility by: 5.2.1 Checking the System for Award Management (SAM.gov) exclusion list. 5.2.2 Retaining a copy of the verification record or certification in the procurement or vendor file. 5.2.3 Incorporating a suspension/debarment verification clause into agreements, contracts, authorizations for purchase, and purchase orders. 5.3 Ongoing Monitoring: Establish a control to periodically re-verify vendor status at least annually to identify changes in eligibility after the initial onboarding. 5.4 Training and Accountability: Provide training to all fiscal staff on: 5.4.1 Federal suspension and debarment requirements. 5.4.2 Verification methods and documentation expectations. 5.4.3 Proper retention of evidence. 5.4.4 Compliance Reviews: Implement periodic internal compliance reviews to ensure continued adherence to suspension and debarment verification requirements. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2024-242 The Division did not accurately report federal grant expenditures on the Schedule of Expenditures of Federal Awards (SEFA) Closing Package. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b ) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Additionally, 2 CFR 200.510 requires the State to prepare the SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Division prepared the SEFA closing package as required but could not provide documentation to show that the closing package was reviewed for accuracy prior to submission. Additionally, amounts on the SEFA did not agree with the underlying accounting records in Luma, and Division staff could not provide an explanation for the differences. We identified the following errors based on expenditure transactions that were coded to specific grants in the Federal Grant Fund in Luma: Assistance Listing SEFA Amount Luma Amount Difference 84.126A $18,785,454 $18,285,440 $500,014 93.369 $282,568 $242,954 $39,614 Total Difference $539,628 The Federal Grant Fund also contained transactions that were not directly coded to any specific grant in the amount of $1,168,908. The Division could not provide documentation to show how these expenditures were allocated to individual programs. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. Staff did not retain documentation to support amounts reported. Effect: The Division overstated expenditures, according to Luma, by $500,014 for the Rehabilitation Services-Vocational Rehabilitation Grants to States and also overstated expenditures, according to Luma, by $36,614 for the Independent Living State Grant. Additionally, expenditures in the amount of $1,168,908 were charged to the federal grant fund in Luma but are not identified by grant indicating that errors could be larger. Recommendation: We recommend that the Division design and implement procedures to accurately calculate the amounts reported in the SEFA closing package and to retain documentation supporting the amounts reported. Management’s View: The Division will ensure the accuracy, completeness, and appropriate documentation of all federal grant expenditures reported on the SEFA closing package by implementing effective reconciliation processes, internal review controls, and documentation retention procedures in compliance with 2 CFR 200.303 and 2 CFR 200.510. Corrective Action: 6.1 Develop and Implement Written SEFA Procedures: Create formal written procedures describing how SEFA amounts are compiled, reconciled, reviewed, and approved prior to submission within Grants Management Manual. 6.2 Strengthen Internal Controls and Oversight: Implement internal review and approval steps that require documented verification of SEFA amounts against Luma accounting records. 6.3 Ensure Accurate Grant Coding: Review and correct all federal grant fund transactions not assigned to specific grants, ensuring proper coding and allocation in Luma. 6.4 Training and Staff Development: Provide training to fiscal staff on SEFA preparation, reconciliation, and documentation requirements. 6.5 Establish Continuous Monitoring: Perform periodic reviews of federal expenditure coding and SEFA data to identify discrepancies before year-end reporting. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We would like to clarify that the SEFA closing package for the state fiscal year 2025 contains several grant phases including, but not limited to, the federal fiscal year (FFY) 2024 award and was due prior to this progress note so it is unclear which SEFA preparation the Division intends to have the improved internal controls impact.

FINDING 2024-243 The Division did not properly evaluate costs related to the Rehabilitation Services-Vocational Rehabilitation Grants to States program resulting in direct costs incorrectly being recorded as indirect costs for the grant. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Allowable Costs/Cost Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.403(d) describes factors affecting the allowability of costs. Except where otherwise authorized by statute, costs must meet a consistency treatment criterion to be allowable under federal awards. A cost should not be assigned to a federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the federal award as an indirect cost. This also applies for misapplying indirect costs as direct costs. Condition: We tested a sample of 60 transactions, plus 15 individually significant transactions, from the population of indirect costs incurred in State fiscal year 2022. Those costs were used to calculate the indirect cost rate used in fiscal year 2024. We identified 2 transactions from the sample of 60 (or 3 percent) and 1 (or 7 percent) individually significant transactions that should have been charged as direct costs. The 2 sampled transactions were $30 for training and $269 for postage. The individually significant transaction was $46,922 for laptops. We also tested a sample of 60 employee payroll transactions from the population of direct costs in fiscal year 2024 to determine that the costs were allowable and the Division’s internal control procedures were operating as intended. The Division could not provide documentation to confirm that 2 transactions (or 3 percent) were approved prior to entry in Luma. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. Prior staff did not retain documentation, and current staff was unable to produce documentation to support the expenditure transactions or verify controls were in place and operating. Effect: The 3 indirect cost transactions that should have been recorded as direct costs caused the Division to draw a lower amount of grant funds than allowed. We did not find any compliance errors in our testing of payroll transactions; however, if control procedures are not operating as designed, errors could occur and not be detected. Recommendation: We recommend that the Division provide training to employees to correctly distinguish direct costs and indirect costs and design and establish procedures to ensure that documentation is retained to support transactions. Management’s View: To ensure all costs charged to federal grants are accurately classified as direct or indirect in accordance with federal cost principles, and to maintain documentation supporting all expenditures, approvals, and internal control activities in compliance with 2 CFR 200.303 and 2 CFR 200.403(d). Corrective Action: 7.1 Establish and Document Clear Cost Classification Procedures: Develop written procedures defining and distinguishing between direct and indirect costs. 7.2 Strengthen Internal Controls Over Cost Allocation: Implement review and approval controls to verify proper cost classification before posting transactions to Luma or inclusion in the indirect cost pool. 7.3 Enhance Staff Training and Knowledge: Provide targeted training for fiscal staff to ensure understanding of allowable cost principles and consistent application of cost classification policies. 7.4 Ensure Documentation Retention and Review: Maintain complete documentation supporting all cost allocations, including approval records, cost pool calculations, and reconciliations. 7.5 Perform Regular Monitoring and Verification: Conduct periodic reviews of both direct and indirect cost transactions to confirm classification accuracy and identify any required adjustments. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2024-244 The Department’s original Schedule of Expenditures of Federal Awards submitted to the Office of the State Controller underreported the amount disbursed to subrecipients by $3,500,000 under the Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) program. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), 2 CFR 200.510(b), requires that the State prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended. In addition, the total federal awards expended must be the total amount provided to subrecipients from each federal program. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instruction on the completion of the closing package. The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department failed to report one subrecipient of CSLFRF program on the SEFA in fiscal year 2024. Cause: The Department does not have sufficient controls in place to prevent or detect errors on the SEFA before submission to the Office. Program staff determined that one recipient of CSLFRF funding was a subrecipient. However, review procedures were not performed at the level of detail necessary to ensure amounts passed on to the subrecipient were appropriately identified on the SEFA closing package and did not report all funds passed through. Effect: The statewide SEFA amounts reported as disbursed to subrecipients were underreported by $3,500,000. Recommendation: We recommend that the Department improve training and the review process for the SEFA closing package to ensure appropriate reporting of subrecipient expenditures on the SEFA. Management’s View: The Department of Water Resources agrees with the finding. Corrective Action: The Department will improve training and the review process for the SEFA closing package to ensure appropriate reporting of subrecipient expenditures on the SEFA. The Department will review the FY 20025 SEFA closing package that was submitted to the Office of the State Controller to ensure the appropriate subrecipient expenditures were reported. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.