Audit 384576

Finding Number: 2023-019 Prior Year Finding Number: 2022-020 Compliance Requirement: Allowable Costs/Cost Principles – Payroll Activities Program: U.S. Department of Agriculture Government Department/Agency: Department of Human Services (DHS) Supplemental Nutrition Assistance Program Cluster (SNAP) ALN: 10.551, 10.561 Award #: Various Award Period: 10/01/21 - 09/30/22 10/01/22 – 09/30/23 Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (1.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its activities allowed or unallowed, allowable cost/cost principal process. CFR 200.403(g) states that for costs to be allowed under federal awards, they must be adequately documented. Additionally, salaries and wages charged to Federal awards are subject to the standards of documentation as described by 2 CFR Section 200.430(i) and must be based on records that accurately reflect the work performed. These records must: - Be incorporated into the organization’s official records. - Reasonably reflect the total activity for which the employee is compensated across all grant-related and non-grant related activities (100%); and - Support the distribution of employee salary across multiple activities or cost objectives. Condition – During our testing of allowable costs for payroll expenditures incurred throughout the year, we sampled and selected 60 of 1,798 payroll disbursements and noted the following: - 34 instances in which DHS did not consistently apply the funding allocation. The hours that should have been split 50/50 between federal and local were charged 100% to the program. - 5 instances in which the hours recorded on the employees’ timesheets did not agree with the hours recorded per the payroll register. - 1 instance in which the employee timesheet was not provided for the pay cycle tested. - 1 instance in which the employee timesheet was not approved by personnel authorized to do so. - 4 instances in which COVID-19 telework hours were not split 50/50 as required by the employees’ funding allocation and charged 100% to the program. Further, we noted that internal controls identified did not appear to be operating at a level of precision to ensure compliance with the above-mentioned requirements. Questioned Costs – Not Determinable. Context – This is a condition identified per review of DHS’ compliance with the specified requirements using a statistically valid sample. The total payroll expenditures charged to the program in fiscal year 2023 were $3,942,422. The amount sampled is $168,409. The known amount of inconsistencies noted is $53,501. Effect – An ineffective control system related to review of transactions to ensure that only allowable costs are allocated to federal programs can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements that could ultimately lead to disallowed costs for the major programs. Cause – DHS does not appear to have adequate policies and procedures to ensure compliance with applicable cost principles and ensure that an appropriate level of review and approval was completed prior to charging costs to a federal program. Recommendation – We recommend that DHS reevaluate and improve internal controls to ensure adherence to federal regulations related to the fiscal administrative requirement for expending and accounting for payroll and to ensure proper and accurate funding allocation of payroll cost. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The Department of Human Services (DHS) adopted the electronic Timeforce (STATS) system for payroll, replacing manual processes. Time and attendance are approved through management levels, with payroll based on Notice of Personnel Action (NOPA) cost centers. Financial Analysts reconcile payroll, and a workflow ensures accurate NOPA listings for payroll purposes. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-020 Prior Year Finding Number: 2022-021 Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Agriculture Government Department/Agency: Department of Human Services (DHS) Supplemental Nutrition Assistance Program Cluster (SNAP) ALN: 10.551, 10.561 Award #: Various Award Period: 10/01/21 - 09/30/22 10/01/22 – 09/30/23 Criteria – CFR Section 200.303, Internal Controls, (a) states DHS must establish and maintain effective internal control over federal awards that provides reasonable assurance that DHS is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its matching process. Further, 2 CFR Section 200.306 provides detailed criteria for acceptable matching costs. The basic criteria for acceptable matching costs include costs that are necessary and reasonable for accomplishment of program objectives and are allowed under 2 CFR Part 200, Subpart E (Cost Principles). Condition – We found that DHS was unable to readily exhibit and provide evidence that it met the matching requirement or monitored compliance with the matching requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with the specified requirements and general compliance principles. Effect – DHS is not in compliance with the stated provisions. Without adequate internal controls to ensure compliance with matching requirements, there is an increased risk that matching will not be properly applied and funding could be jeopardized. Cause – DHS does not appear to have adequate policies and procedures in place to ensure complete compliance with the matching requirement. Further, lack of monitoring of the match requirement appears to be the result of significant personnel turnover and lack of staffing. Recommendation – We recommend that DHS deploy resources that are given the responsibility to ensure periodic monitoring and compliance of the matching requirement throughout the fiscal year. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. While the ERP provides an overall expense report, a specific liquidation report has been developed to ensure that matching is completed with each report submission. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-021 Prior Year Finding Number: 2022-022 Compliance Requirement: Special Tests and Provisions – EBT Card Security Program: U.S. Department of Agriculture Government Department/Agency: Department of Human Services (DHS) Supplemental Nutrition Assistance Program Cluster (SNAP) ALN: 10.551, 10.561 Award #: Various Award Period: 10/01/21 - 09/30/22 10/01/22 – 09/30/23 Criteria – CFR Section 200.303, Internal Controls, Section (a) states DHS must establish and maintain effective internal control over federal awards that provides reasonable assurance that DHS is managing the federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its EBT Card Security process. Per 7 CFR Section 274.8(b)(3), System Security, as an addition to or component of the Security Program required of Automated Data Processing (ADP) Systems, the State or Territory agency shall ensure that a certain electronic benefits transfer (EBT) security requirements are established. As such, DHS is required to maintain adequate security over, and documentation/records for EBT cards, to prevent their theft, embezzlement, loss damage, destruction, unauthorized transfer, negotiation, or use. Condition – DHS contracted with Fidelity National Information Service (FIS) for the issuance and security of the EBT cards; however, it is DHS’ ultimate responsibility to ensure the contractor has controls in place to maintain adequate security over, and documentation/records of EBT cards. We sampled 8 out of 24 monthly card reconciliations and found 3 reconciliations with differences between new/replacements issued cards status report and the actual new/replacements cards issued. Specifically, we identified differences of 2 new cards and 1 replacement card issued. Further, we noted that internal controls identified did not appear to be operating at a level of precision to ensure compliance with the above-mentioned requirements. Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with the specified requirements using a statistically valid sample. The reconciliations sampled reported 451 new cards and 1,659 replacement cards issued. Effect – Without adequate internal controls to ensure compliance with EBT card security requirements, there is an increased risk that the inventory of EBT cards will not be properly maintained and accounted for which can lead to noncompliance with laws, regulations, and the provision of the grant agreement. Cause – DHS does not appear to have adequate policies and procedures in place to ensure adequate safeguarding and documentation of EBT cards. Recommendation - We recommend that DHS strengthen formal policies and procedures to maintain adequate security, documentation, and records over EBT Cards to ensure internal controls over EBT cards security are operating effectively. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. A Standard Operating Procedures and Procedures (SOPP) document is being developed to outline the EBT Reconciliation process. Additionally, a Director of Support Services will be hired to oversee and review all reports. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-022 Prior Year Finding Number: 2022-023 Compliance Requirement: Allowable Costs/Cost Principles – Payroll Activities Program: U.S. Department of Agriculture Government Department/Agency: Department of Education (VIDE) Child Nutrition Cluster ALN: 10.555, 10.559, 10.582 Award #: 1VI300308, 4VI300308, 4VI308908 Award Period: 10/01/2021 – 09/30/2022 10/01/2022 – 09/30/2023 10/01/2022 – 09/30/2024 Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the nonfederal entities receiving Federal awards (1.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its activities allowed or unallowed, allowable cost/cost principal process. CFR 200.403(g) states that for costs to be allowed under federal awards, they must be adequately documented. Additionally, salaries and wages charged to Federal awards are subject to the standards of documentation as described by 2 CFR Section 200.430(i) and must be based on records that accurately reflect the work performed. These records must: - Be incorporated into the organization’s official records. - Reasonably reflect the total activity for which the employee is compensated across all grantrelated and non-grant related activities (100%); and - Support the distribution of employee salary across multiple activities or cost objectives. Condition – During our testing of allowable costs for payroll expenditures incurred throughout the year, we sampled and selected 20 of 196 payroll disbursements and noted the following: - 11 instances where the approved timesheet for the pay period selected was not available for review. - 20 instances where VIDE did not provide support that time and effort is charged in accordance with A-87 requirements. - 4 instances where the NOPA provided did not include any evidence that the employee was approved to be federally reimbursed for the project code utilized in the payroll register. - 4 instances where the employee’s pay rate in the approved NOPA provided did not agree with the pay rate in the payroll register. As a result, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – $10,789. Context – This is a condition identified per review of VIDE’s compliance with the specified requirements using a statistically valid sample. The total payroll expenditures charged to the program in fiscal year 2023 was $196,740. The amount sampled is $21,572. The known amount of the instances of inconsistent funding allocation is $10,789. Effect – An ineffective control system related to review of transactions to ensure that only allowable costs are allocated to federal programs can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements that could ultimately lead to disallowed costs for the major programs. Cause – VIDE does not appear to have adequate policies and procedures to ensure compliance with applicable cost principles and ensure that an appropriate level of review and approval was completed prior to charging costs to a federal program. Recommendation – We recommend that VIDE reevaluate and improve internal controls to ensure adherence to federal regulations related to the fiscal administrative requirement for expending and accounting for payroll and to ensure proper and accurate funding allocation of payroll cost. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VIDE will develop and institute stricter fiscal controls to address the root causes of documentation and allocation discrepancies for this program. To prevent discrepancies including unapproved project codes and pay rate mismatches between NOPAs and payroll registers, the Fiscal Team will take the lead in preparing and maintaining the official staffing list for federally funded personnel within this program, an effort that involves reviewing the grant application for all positions and informing HR of required action entries. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-023 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles and Period of Performance Program: U.S. Department of Agriculture Government Department/Agency: Department of Education (VIDE) Child Nutrition Cluster ALN: 10.555, 10.559, 10.582 Award #: 1VI300308, 4VI300308, 4VI308908 Award Period: 10/01/2021 – 09/30/2022 10/01/2022 – 09/30/2023 10/01/2022 – 09/30/2024 Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Additionally, a non-federal entity may charge to the Federal award, allowable costs incurred during the period of performance and any costs incurred before the Federal awarding agency or pass-through entity made the Federal award, only to the extent that they would have been allowable if incurred after the date of the Federal award and only with the written approval of the Federal awarding agency. Unless the federal awarding agency or pass-through entity authorizes an extension, a non-federal entity must liquidate all financial obligations incurred under the federal award not later than 120 calendar days after the end date of the period of performance as specified in the terms and conditions of the federal award (2 CFR section 200.344(b)). Condition – During our testing of costs incurred throughout the year, we sampled and selected 40 disbursements and found one instance where the disbursement was paid outside the extended liquidation period of the grant award. The expenditure in question was paid 18 days after the approved extended liquidation period ending May 5, 2023. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the period of performance compliance requirement. Questioned Costs – $30,733. Context – This is a condition identified per review of VIDE’s compliance with the specified requirements using a statistically valid sample. The total non-payroll expenditures charged to the program in fiscal year 2023 were $3,524,322. The amount sampled is $873,942. The known amount of the instances of noncompliance is $30,733. Effect – VIDE is not in compliance with the stated provisions. Failure to properly review and support expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – VIDE does not appear to have adequate policies and procedures to ensure compliance with applicable liquidation provisions. Recommendation – We recommend that VIDE reevaluate and improve internal controls to ensure adherence to federal regulations related to the fiscal administrative requirement for adhering to liquidation provisions. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VIDE will enforce strict protocols for grant closeout and liquidation. To achieve this, VIDE will establish an internal hard stop deadline for invoice submission, requiring that all invoices for expiring grants be submitted to the Fiscal Office no later than 45 days prior to the federal liquidation deadline to provide a necessary buffer to resolve vendor disputes and process payments before the federal cutoff. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-024 Prior Year Finding Number: 2022-024 Compliance Requirement: Cash Management Program: U.S. Department of Agriculture Government Department/Agency: Department of Health (DOH) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) ALN: 10.557 Award #: Various Award Period: Various Criteria - The WIC program is subject to the provisions of the Cash Management Improvement Act (CMIA). (42 USC 1786(h)(8)(J); 7 CFR section 246.15(a)). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We sampled and selected 60 out of 349 drawdowns and noted the following: - 60 drawdown requests did not contain evidence of review and approval; and - 5 drawdowns did not adhere to the CMIA average clearance of zero days for payroll activities. In all instances, funds were drawn 1 day in advance of the related payroll payment. Questioned Costs – None. Context – This is a condition identified per review of the DOH’s compliance with the specified requirements using a statistically valid sample. Total drawdown requests were $4,488,679. The amount sampled is $1,296,470. Total amount of drawdowns with compliance exceptions is $117,231. Effect – Without proper review and oversight drawdowns may not be in compliance with the CMIA Agreement and cash management compliance requirements. Cause – It appears that policies and procedures, including review over cash management transactions, were not functioning as intended. Recommendation – We recommend that the DOH reevaluate its policies and procedures to ensure proper monitoring and continue to be vigilant in following internal procedures over reviews and authorizations. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The Department of Health (DOH) updated drawdown Standard Operating Procedures (SOPs) for Fiscal Year 2025 to require signatures or initials on all supporting documents, certifying proper review. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-025 Prior Year Finding Number: N/A Compliance Requirement: Procurement and Suspension and Debarment Program: U.S. Department of Agriculture Government Department/Agency: Department of Health (DOH) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) ALN: 10.557 Award #: Various Award Period: Various Criteria - When procuring property and services, states must use the same policies and procedures they use for procurements from their non-federal funds (2 CFR section 200.317). Per Procurement Manual, User Agencies are required to submit a written justification letter to the Government’s Department of Property and Procurement (DPP), which was signed by the agency head, which explains the need for the services, the exception in title 31, Virgin Islands Code, chapter 23, section 239(a) being relied upon, the methodology for the selection process, and the rationale for selecting the prospective contractor. The letter must identify the funding source and comply with all other requirements necessary for the acquisition of services under title 31, Virgin Islands Code, chapter 23, sections 239(a) (1), (2) or (3) whichever is applicable. The letter must contain an “approve/disapprove” block for the Commissioner of Property and Procurement. Additionally, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition - In our review of 9 out of 86 procurement transactions, we noted the following: - 1 procurement that did not have supporting documentation to verify the method of procurement, selection of the contract type and basis for the contract price. -2 procurements did not contain evidence that a quotation was obtained prior to selection of the vendor. -1 procurement where no supporting documentation was available for review. Further, we noted that internal controls were not operating at a level of precision to ensure compliance with the procurement compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of DPP’s compliance with the specified requirements using a statistically valid sample. Total amount of procurement transactions was $314,776. Total amount sampled was $40,332. The known amount of exceptions is $29,256. Effect – DPP could inadvertently contract or make sub-awards to parties that are suspended or debarred from doing business with the Federal government as well as award contracts to vendors whose contract prices are unreasonable. In addition, contracts may be executed to unqualified vendors. Cause – DPP does not appear to have a process in place to adequately monitor and maintain completed contract files comprising of all supporting documents. Recommendation – We recommend that DPP improve internal controls to ensure adherence to federal regulations relating to the procurement of goods and services and review current records retention policies. There should be timely coordination and communication amongst all Government departments and/or agencies that are responsible for handling and managing procurement tasks. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. DOH will collaborate with DPP to strengthen internal controls and ensure compliance with federal procurement regulations. DOH will also encourage DPP to review records retention policies. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-026 Prior Year Finding Number: N/A Compliance Requirement: Cash Management Program: U.S. Department of Agriculture Government Department/Agency: Department of Health (DOH) WIC Grants to States (WGS) ALN: 10.578 Award #: 1VI700748 Award Period: 07/01/19 - 12/31/23 Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We sampled and selected 12 out of 30 drawdowns and noted that all 12 drawdown requests did not contain evidence of review and approval. Questioned Costs – None. Context – This is a condition identified per review of the DOH’s compliance with the specified requirements using a statistically valid sample. Total drawdown requests were $3,317,520. The amount sampled is $2,992,269. Effect – Without proper review and oversight drawdowns may not be in compliance with the cash management compliance requirements. Cause – It appears that policies and procedures, including review over cash management transactions, were not functioning as intended. Recommendation – We recommend that the DOH reevaluate its policies and procedures to ensure proper monitoring and continue to be vigilant in following internal procedures over reviews and authorizations. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. DOH revised drawdown Standard Operating Procedures (SOPs) to mandate that all supporting documents include a signature or initial to certify that a proper review was conducted internally or externally. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-027 Prior Year Finding Number: N/A Compliance Requirement: Procurement and Suspension and Debarment Program: U.S. Department of Agriculture Government Department/Agency: Department of Health (DOH) WIC Grants to States (WGS) ALN: 10.578 Award #: 1VI700748 Award Period: 07/01/19 - 12/31/23 Criteria - When procuring property and services, states must use the same policies and procedures they use for procurements from their non-federal funds (2 CFR section 200.317). Per Procurement Manual, User Agencies are required to submit a written justification letter to the Government’s Department of Property and Procurement (DPP), which was signed by the agency head, which explains the need for the services, the exception in title 31, Virgin Islands Code, chapter 23, section 239(a) being relied upon, the methodology for the selection process, and the rationale for selecting the prospective contractor. The letter must identify the funding source and comply with all other requirements necessary for the acquisition of services under title 31, Virgin Islands Code, chapter 23, sections 239(a) (1), (2) or (3) whichever is applicable. The letter must contain an “approve/disapprove” block for the Commissioner of Property and Procurement. Further, non-Federal entity must comply with section 70914 of the Build America, Buy America Act (BABA), including through incorporation of a Buy America preference in the terms and conditions of each award with an infrastructure project or obtain waiver. Additionally, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition - In our review of 5 out of 13 procurement transactions, we noted the following: - 1 procurement transaction did not contain sufficient supporting documentation to validate adherence to procurement policy. - 1 procurement transaction did not contain evidence that a quotation and justification letter was obtained prior to selection of the vendor. - 2 procurements did not include Buy America domestic preference provisions in the agreement or obtained a BABA waiver. Further, we noted that internal controls were not operating at a level of precision to ensure compliance with the procurement compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of DPP’s compliance with the specified requirements using a statistically valid sample. Total amount of procurement transactions was $3,133,788. Total amount sampled was $3,100,835. The known amount of exceptions is $3,096,961. Effect – DPP could inadvertently contract or make sub-awards to parties that are suspended or debarred from doing business with the Federal government as well as award contracts to vendors whose contract prices are unreasonable. In addition, contracts may be executed to unqualified vendors. Cause – DPP does not appear to have a process in place to adequately monitor and maintain completed contract files comprising of all supporting documents. Recommendation – We recommend that DPP improve internal controls to ensure adherence to federal regulations relating to the procurement of goods and services and review current records retention policies. There should be timely coordination and communication amongst all Government departments and/or agencies that are responsible for handling and managing procurement tasks. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. To ensure that the WIC program is included in all processes and receive all documents and correspondence relating to WIC Special Funding as a secondary oversight of the transactions. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-028 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Agriculture Government Department/Agency: Department of Health (DOH) WIC Grants to States (WGS) ALN: 10.578 Award #: 1VI700748 Award Period: 07/01/19 - 12/31/23 Criteria – Each State or Territory must file various financial, programmatic, and special reports. Additionally, the requirements necessitate that all submitted reports should be supported by the underlying performance records and presented in accordance with program requirements. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We sampled and selected 4 out of 8 financial and progress reports and noted the following: - 2 financial reports where there was no evidence of submission and review by the authorized reviewer. Additionally, sufficient supporting documentation was not available to validate accounting basis used in reporting the data and the respective financial information agreed with accounting records. - 2 progress reports did not contain evidence that the report was reviewed by an authorized reviewer prior to submission. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the reporting compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of the Government’s compliance with the specified requirements using a statistically valid sample. Effect – The Government is not in compliance with the stated provisions and inaccurate information may have been reported to the Federal government. Cause – It appears that policies and procedures, including review over reporting procedures were not functioning as intended. Further, the Government does not have adequate control over maintenance of the underlying documentation used in preparing various reports. Recommendation – We recommend that Government reevaluate its policies and procedures to ensure proper retention, monitoring, and review of the required reports by an appropriate official who would ensure that information submitted is complete, accurate, consistent, and submitted within the required timeframe. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The Department of Health will create an internal control procedure to indicate proper review and approval of the SF-425 excel print out from the electronic USDA FPRS System. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-029 Prior Year Finding Number: 2022-026 Compliance Requirement: Allowable Costs/Cost Principles – Payroll Activities Program: U.S. Department of Defense Government Department/Agency: Office of the Adjutant General (OTAG) National Guard Military Operations and Maintenance (O&M) Projects ALN: 12.401 Award #: W9127P-23-2-1001, W9127P-22-2-1001 Award Period: 10/01/2021 – 09/30/2022 10/01/2022 – 09/30/2023 Criteria – CFR 200.403(g) states that for costs to be allowed under federal awards, they must be adequately documented. Additionally, salaries and wages charged to Federal awards are subject to the standards of documentation as described by 2 CFR Section 200.430(i) and must be based on records that accurately reflect the work performed. These records must: - Be incorporated into the organization’s official records. - Reasonably reflect the total activity for which the employee is compensated across all grant-related and non-grant related activities (100%); and - Support the distribution of employee salary across multiple activities or cost objectives. The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Condition – We sampled and selected 60 out of 652 payroll transactions and noted the following: - 1 instance where health insurance costs continued to be charged to the program after the employee retired, with no related time and effort. - 1 instance where the employee pay rate did not agree to the pay rate listed on their NOPA form. - 7 instances where the timesheet for the pay period selected was not provided. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the allowable costs/cost principles compliance requirements. Questioned Costs – Not determinable. Context – This is a condition identified per review of OTAG’s compliance with the specified requirements using a statistically valid sample. The total amount of payroll expenditures charged to the program during fiscal year 2023 were $1,810,965 and the total amount of our sample was $188,082. The known amount of the exceptions amounted to $26,694. Effect – OTAG is not in compliance with the stated provisions. Failure to properly review and support expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – OTAG does not appear to have adequate policies and procedures in place to ensure compliance with applicable cost principles stipulations. Recommendation – We recommend that OTAG improve internal controls to ensure adherence to Federal regulations related to the fiscal and administrative requirements for expending and accounting for payroll expenditures. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. OTAG implemented enhanced payroll controls including a dual manual and electronic timesheet system, verification of pay rates against NOPA forms, and separation controls to discontinue benefit charges upon employee separation or retirement. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-030 Prior Year Finding Number: 2022-027 Compliance Requirement: Cash Management and Reporting Program: U.S. Department of Defense Government Department/Agency: Office of the Adjutant General (OTAG) National Guard Military Operations and Maintenance (O&M) Projects ALN: 12.401 Award #: W9127P-23-2-1001, W9127P-22-2-1001 Award Period: 10/01/2021 – 09/30/2022 10/01/2022 – 09/30/2023 Criteria – U.S. Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Each State or Territory must file various financial, programmatic, and special reports. Additionally, the requirements necessitate that all submitted reports should be supported by the underlying performance records and presented in accordance with program requirements. SF-270, Request for Advance or Reimbursement Report, is required to be filed in connection with cash drawdowns. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Condition – We were unable to verify the completeness of the SF-270 (cash management and reporting) population. As a result, we were unable to test compliance and internal controls over compliance related to the cash management and reporting compliance requirements. Questioned Costs – Not determinable. Context – This is a condition identified per review of OTAG’s compliance with the specified requirements and general compliance principles. Effect – OTAG is not in compliance with the stated provisions. Inaccurate information may have been reported to the Federal government in the absence of required reconciliations and reviews. Cause – It appears that policies and procedures, including review over cash management transactions, were not functioning as intended. Recommendation - We recommend that OTAG reevaluate its policies and procedures to ensure proper monitoring and continue to be vigilant in following internal procedures over reviews and authorizations. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. OTAG established a centralized SF-270 tracking log and implemented reconciliation procedures to ensure completeness and accuracy of cash drawdowns prior to submission. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-031 Prior Year Finding Number: 2022-028 Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Defense Government Department/Agency: Office of the Adjutant General (OTAG) National Guard Military Operations and Maintenance (O&M) Projects ALN: 12.401 Award #: W9127P-23-2-1001, W9127P-22-2-1001 Award Period: 10/01/2021 – 09/30/2022 10/01/2022 – 09/30/2023 Criteria – According to the Master Cooperative Agreement Section 303, Cost Sharing, cost sharing requirements are found in a grantees individual Cooperative Agreements. The Government has various cost-sharing requirements within their Cooperative Agreements. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Condition – OTAG was unable to readily exhibit and provide its computation of the matching calculation or provide evidence that it was monitoring compliance with said requirement. Therefore, we were unable to determine if the matching requirement has been met or if the expenditures being claimed towards the matching requirement are allowable activities/costs. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the matching compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of OTAG’s compliance with the specified requirements and general compliance principles. Effect – OTAG is not in compliance with the stated provisions. Cause – OTAG does not appear to have adequate policies and procedures in place to ensure complete compliance with the matching requirement. Recommendation – We recommend that OTAG deploy resources that are given the responsibility to ensure periodic monitoring and compliance of the matching requirement throughout the fiscal year. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. OTAG implemented a formal match tracking mechanism and assigned responsibility for calculating, documenting, and monitoring match requirements throughout the fiscal year. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-032 Prior Year Finding Number: 2022-029 Compliance Requirement: Period of Performance Program: U.S. Department of Defense Government Department/Agency: Office of the Adjutant General (OTAG) National Guard Military Operations and Maintenance (O&M) Projects ALN: 12.401 Award #: W9127P-23-2-1001, W9127P-22-2-1001 Award Period: 10/01/2021 – 09/30/2022 10/01/2022 – 09/30/2023 Criteria – National Guard Bureau O&M cooperative agreements (CA) are funded with one-year appropriations. By policy, only state costs obligated during the period of the federal fiscal year or period of performance identified in the CA are reimbursable. (National Guard Regulation (NGR) 5-1, chapters 3 and 11). The recipient shall not request reimbursement for any expenditure it made before the date that all required parties execute the Master Cooperative Agreement (MCA) unless the United States Property & Fiscal Officer (USPFO) expressly authorizes expenditures made during the funding period, but prior to the date of final signature, the parties may also agree on a specific start or effective date (NGR 5-1, Chapter 11). Within 90 days after the end of the federal fiscal year or upon termination of the CA, whichever is earlier, the recipient shall promptly deliver to the USPFO a final accounting of all funding and disbursements under the agreement for the fiscal year (NGR 5-1, Chapter 11). If unliquidated claims and undisbursed obligations arising from the recipient’s performance of the CA will remain 90 days after the close of the federal fiscal year, the recipient shall provide a detailed listing of uncleared obligations and a projected timetable for their liquidation and disbursement no later than 31 December. The USPFO shall then set an appropriate new timetable for the recipient to submit its final accounting (NGR 5-1, Chapter 11). Costs incurred in a federal fiscal year, which are not disclosed by the recipient within 90 days of the end of the federal fiscal year, except costs associated with unliquidated claims and undisbursed obligations arising from the recipient’s performance of the CA that the recipient has reported, shall not be eligible for reimbursement by NGB. The USPFO may extend the 90-day limit for good cause shown (NGR 5-1, Chapter 11). Additionally, a non-federal entity may charge to the Federal award, allowable costs incurred during the period of performance and any costs incurred before the Federal awarding agency or pass-through entity made the Federal award, only to the extent that they would have been allowable if incurred after the date of the Federal award and only with the written approval of the Federal awarding agency. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Condition – We sampled and selected 163 out of 1,533 transactions and noted the following: - 21 instances where transactions were charged to the incorrect grant award. - 34 instances where the transaction was paid outside the liquidation period. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the period of performance compliance requirements. Questioned Costs – $384,389. Context – This is a condition identified per review of OTAG’s compliance with the specified requirements using a statistically valid sample. The total amount expenditures subject to sampling were $4,170,938 and the total amount of our sample was $937,482. The known amount of the exceptions amounted to $384,389. Effect – OTAG is not in compliance in compliance with the stated provisions. Failure to properly review and support expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – OTAG did not appear to have adequate policies and procedures in place to ensure compliance with the required period of performance stipulations. Recommendation – We recommend that OTAG strengthen its processes with respect to setting up and charging expenditures between various grant awards. We also recommend that OTAG enhance its review process to properly determine the activities of each grant relative to the appropriate period of performance. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. OTAG enhanced grant setup, expenditure charging, and closeout controls to ensure costs are charged to the correct award and within the approved period of performance, including 90-day liquidation monitoring. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-033 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Payroll Activities Program: U.S. Department of the Interior Government Department/Agency: Department of Planning and Natural Resources Fish and Wildlife Cluster ALN: 15.605, 15.611 Award #: Various Award Period: Various Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (1.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its activities allowed or unallowed, allowable cost/cost principal process. CFR 200.403(g) states that for costs to be allowed under federal awards, they must be adequately documented. Additionally, salaries and wages charged to Federal awards are subject to the standards of documentation as described by 2 CFR Section 200.430(i) and must be based on records that accurately reflect the work performed. These records must: - Be incorporated into the organization’s official records. - Reasonably reflect the total activity for which the employee is compensated across all grant-related and non-grant related activities (100%); and - Support the distribution of employee salary across multiple activities or cost objectives. Condition – During our testing of allowable costs for payroll expenditures incurred throughout the year, we sampled and selected 60 of 620 payroll disbursements and noted the following: - 8 instances where the approved timesheet for the pay period selected were not available for review. - 10 instances where an employees assigned project code documented on the Notice of Personnel Action was not a project code associated with the grant. Additionally, the payroll register reflected a different project code for these transactions. - 1 instance with a variance between the hours reported on the payroll register and the hours reported on the Detail Check History. As a result, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – $38,914. Context – This is a condition identified per review of the Government’s compliance with the specified requirements using a statistically valid sample. The total payroll expenditures charged to the program in fiscal year 2023 was $1,572,926. The amount sampled is $165,134. The value of transactions with exceptions totaled $38,914. Effect – An ineffective control system related to review of transactions to ensure that only allowable costs are allocated to federal programs can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements that could ultimately lead to disallowed costs for the major programs. Cause – The Government does not appear to have adequate policies and procedures to ensure compliance with applicable cost principles and ensure that an appropriate level of review and approval was completed prior to charging costs to a federal program. Recommendation – We recommend that the Government reevaluate and improve internal controls to ensure adherence to federal regulations related to the fiscal administrative requirement for expending and accounting for payroll and to ensure proper and accurate funding allocation of payroll cost. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. We recognize that these findings highlight areas where improvements are necessary to ensure better compliance with applicable policies and regulations governing payroll and grant management. We are committed to implementing corrective actions and enhancing the internal controls to prevent recurrence. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-034 Prior Year Finding Number: N/A Compliance Requirement: Equipment and Real Property Management Program: U.S. Department of the Interior Government Department/Agency: Department of Planning and Natural Resources Fish and Wildlife Cluster ALN: 15.605, 15.611 Award #: Various Award Period: Various Criteria – Per 2 CFR section 200.313, Equipment, property records must be maintained that include a description of the property, a serial number or other identification number, the source of property, who holds title, the acquisition date, cost of the property, percentage of Federal participation in the cost of the property, the location, use and conditions of the property, and any ultimate disposition data including the date of disposal and sale price of the property. Further, a physical inventory of equipment should be taken at least once every 2 years and reconciled to the equipment records along with the usage of an appropriate control system to safeguard and maintain equipment. Additionally, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – The Government’s Department of Property and Procurement (DPP) maintains the equipment register for the Government. DPP was unable to provide an accurate and complete property records which met the stated requirements. Further, no physical inventory was taken in fiscal year 2023. Further, we noted that internal controls were not operating at a level of precision to ensure compliance with the equipment management compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of the Government’s compliance with the specified requirements. Equipment purchased in 2023 totaled $259,076. Effect – There is a risk that inadequate recordkeeping of equipment could lead to misappropriation of assets and noncompliance with Federal regulations resulting in a return of Federal awards received. Cause – The Government does not appear to have a process in place to adequately monitor equipment acquired with Federal funds. Recommendation – We recommend that DPP improve internal controls to ensure adherence to Federal regulations related to equipment and its related maintenance. There should be timely coordination and communication amongst all Government departments and/or agencies that are responsible for handling and managing such assets. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The Asset Management Division (AMD) adheres to Federal equipment guidelines. Assets are tagged, and records are created using the Tyler Munis Resource Planning system (ERP). In 2022, AMD inventoried four agencies, ensuring compliance with Federal regulations. The completed Standard Operation Policies and Procedures (SOPP) are pending approval, crucial for enhancing internal controls. Training sessions for fixed assets employees are planned, and additional staff will be needed to support the initiative effectively. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-035 Prior Year Finding Number: 2022-030 Compliance Requirement: Cash Management Program: U.S. Department of the Interior Government Department/Agency: Department of Planning and Natural Resources Virgin Islands Energy Office Economic, Social, and Political Development of the Territories ALN: 15.875 Award #: Various Award Period: Various Criteria – US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing that meet the funding threshold for a major federal assistance program under the CMIA. The CMIA agreement for this program stipulates a reimbursement method with 7-day clearance. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We reviewed 23 out of 109 drawdowns and noted the following: - No supporting invoices were available for review for 2 drawdowns. - No supporting documentation was available for review for 1 drawdown. - Documentation confirming receipt of the funds was not available for review for 2 drawdowns. Further, we noted that internal controls were not operating at a level of precision to ensure compliance with the cash management compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of the Government’s compliance with the specified requirements using a statistically valid sample. Total fiscal year 2023 drawdown requests were $8,059,011. Total amount sampled is $4,705,168. The total amount of the exceptions is $1,023,933. Effect – The Government is not in compliance with the stated provisions. Cause – It appears that policies and procedures, including review over cash management transactions, were not functioning as intended. Recommendation - We recommend that the Government reevaluate its policies and procedures to ensure proper monitoring and continue to be vigilant in following internal procedures to ensure compliance with stated provisions. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The GVI is currently in the process of developing a comprehensive Grants Management Overarching Standard Operating Policies and Procedures (SOPP) to establish uniform guidance for all grant-related processes, including drawdowns, documentation retention, and compliance monitoring. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-036 Prior Year Finding Number: 2022-031 Compliance Requirement: Equipment and Real Property Management Program: U.S. Department of the Interior Government Department/Agency: Various Economic, Social, and Political Development of the Territories ALN: 15.875 Award #: Various Award Period: Various Criteria – Per 2 CFR section 200.313, Equipment, property records must be maintained that include a description of the property, a serial number or other identification number, the source of property, who holds title, the acquisition date, cost of the property, percentage of Federal participation in the cost of the property, the location, use and conditions of the property, and any ultimate disposition data including the date of disposal and sale price of the property. Further, a physical inventory of equipment should be taken at least once every 2 years and reconciled to the equipment records along with the usage of an appropriate control system to safeguard and maintain equipment. Additionally, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – The Government’s Department of Property and Procurement (DPP) maintains the equipment register for the Government. DPP was unable to provide an accurate and complete property records which met the stated requirements. Further, no physical inventory was taken in fiscal year 2023. Further, we noted that internal controls were not operating at a level of precision to ensure compliance with the equipment management compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of the Government’s compliance with the specified requirements. Equipment purchased in 2023 totaled $1,452,046. Effect – There is a risk that inadequate recordkeeping of equipment could lead to misappropriation of assets and noncompliance with Federal regulations resulting in a return of Federal awards received. Cause – The Government does not appear to have a process in place to adequately monitor equipment acquired with Federal funds. Recommendation – We recommend that DPP improve internal controls to ensure adherence to Federal regulations related to equipment and its related maintenance. There should be timely coordination and communication amongst all Government departments and/or agencies that are responsible for handling and managing such assets. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The Department of Property and Procurement (DPP) acknowledges the findings and is actively implementing measures to strengthen compliance with federal equipment requirements. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-037 Prior Year Finding Number: 2022-032 Compliance Requirement: Procurement and Suspension and Debarment Program: U.S. Department of the Interior Government Department/Agency: Various Economic, Social, and Political Development of the Territories ALN: 15.875 Award #: Various Award Period: Various Criteria – When procuring property and services, states must use the same policies and procedures they use for procurements from their non-federal funds (2 CFR section 200.317). Per Procurement Manual, User Agencies are required to submit a written justification letter to the Government’s Department of Property and Procurement (DPP), which was signed by the agency head, which explains the need for the services, the exception in title 31, Virgin Islands Code, chapter 23, section 239(a) being relied upon, the methodology for the selection process, and the rationale for selecting the prospective contractor. The letter must identify the funding source and comply with all other requirements necessary for the acquisition of services under title 31, Virgin Islands Code, chapter 23, sections 239(a) (1), (2) or (3) whichever is applicable. The letter must contain an “approve/disapprove” block for the Commissioner of Property and Procurement. Additionally, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – In our review of 15 out of 78 procurement transactions, we were unable to obtain the contract files for 4 procurement transactions to validate adherence to procurement policy. In addition, we noted 5 procurements did not include the following: - Contract file documents showing the significant history of the procurement, including the rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis of contract price. - The procurement provides full and open competition. - Documentation in support of the rationale to limit competition in those cases where competition was limited and ascertain if the limitation was justified. - Cost or price analysis in connection with procurement action, including contract modifications and that this analysis supported the procurement action. Further, we noted that internal controls were not operating at a level of precision to ensure compliance with the procurement compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of DPP’s compliance with the specified requirements using a statistically valid sample. Total amount of procurement transactions was $4,159,155. Total amount sampled was $2,948,589. The known amount of exceptions is $2,336,143. Effect – DPP could inadvertently contract or make sub-awards to parties that are suspended or debarred from doing business with the Federal government as well as award contracts to vendors whose contract prices are unreasonable. In addition, contracts may be executed to unqualified vendors. Cause – DPP does not appear to have a process in place to adequately monitor and maintain completed contract files comprising of all supporting documents. Recommendation – We recommend that DPP improve internal controls to ensure adherence to federal regulations relating to the procurement of goods and services and review current records retention policies. There should be timely coordination and communication amongst all Government departments and/or agencies that are responsible for handling and managing procurement tasks. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The Government updated its procurement laws and issued revised manuals, along with position-specific Standard Operating Procedures. Processes to enforce internal controls and ensure adherence to procurement laws have been established and are regularly reinforced. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-038 Prior Year Finding Number: 2022-033 Compliance Requirement: Reporting Program: U.S. Department of the Interior Government Department/Agency: Various Economic, Social, and Political Development of the Territories ALN: 15.875 Award #: Various Award Period: Various Criteria – Each State or Territory must file various financial, programmatic, and special reports. Additionally, the requirements necessitate that all submitted reports should be supported by the underlying performance records and presented in accordance with program requirements. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We sampled and selected 18 out of 164 financial and performance reports and noted the following: - 6 financial reports and 4 performance reports were not available for review. - 3 financial reports where sufficient supporting documentation were not available to validate that the respective financial information agreed with the underlying records. - 2 performance reports did not contain evidence of review or approval before submission. Additionally, the Government did not submit FFATA reports where subawards were made for more than $30,000 for fiscal year 2023. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the reporting compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of the Government’s compliance with the specified requirements using a statistically valid sample. Effect – The Government is not in compliance with the stated provisions and inaccurate information may have been reported to the Federal government. Cause – It appears that policies and procedures, including review over reporting procedures were not functioning as intended. Further, the Government does not have adequate control over maintenance of the underlying documentation used in preparing various reports. Recommendation – We recommend that Government reevaluate its policies and procedures to ensure proper retention, monitoring, and review of the required reports by an appropriate official who would ensure that information submitted is complete, accurate, consistent, and submitted within the required timeframe. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The Government plans a high-level review of internal control policies and closely monitoring reports for completeness, accuracy, timeliness, and consistency with Cognizant Agency guidelines. An analyst will be assigned to track reporting schedules, oversee grant activity, and manage document storage, ensuring timely submission of all required reports for each grant award. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-039 Prior Year Finding Number: N/A Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of the Interior Government Department/Agency: Department of Planning and Natural Resources (DPNR) Economic, Social, and Political Development of the Territories ALN: 15.875 Award #: Various Award Period: Various Criteria – A pass-through entity (PTE) must: Identify the Award and Applicable Requirements – Clearly identify to the subrecipient: 1. The award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.331(a)(1); 2. All requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); 3. Any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.331(a)(3)). Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We selected 2 of 4 subrecipients and found the following: - No supporting documentation of monitoring the subawards and evaluating the risk of noncompliance for each subrecipient. - No evidence that pass-through entity verified that subrecipients expected to be audited as required by 2 CFR part 200, subpart F. - No supporting documentation if the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient. Additionally, there was no evidence of review of performance and special reports, as no supporting documentation was available for review by the pass-through entity for 1 of the 2 subrecipients tested. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the subrecipient monitoring compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of DPNR’s compliance with the specified requirements using a statistically valid sample. The total amount of expenditures passed through to subrecipients in fiscal year 2023 were $341,920. The total amount of our sample totaled $131,920. Effect – Failure to properly adhere to policies and procedures can result in noncompliance with laws and regulations and failure to meet the program's objectives. Cause – DPNR does not have policies and procedures in place to ensure personnel adhere to the internal procedures to properly monitor subrecipients to ensure adherence to applicable federal regulations, including expending federal awards for allowable expenditures. Recommendation – We recommend that DPNR implement policies, procedures, and controls to ensure subrecipients are identified and monitored in accordance with federal statutes. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The GVI is currently in the process of developing a comprehensive Grants Management Overarching Standard Operating Policies and Procedures (SOPP) to establish uniform guidance for all grant-related processes, including drawdowns, documentation retention, subrecipient and compliance monitoring. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-040 Prior Year Finding Number: 2022-034 Compliance Requirement: Activities Allowed or Unallowed Program: U.S. Department of Labor Government Department/Agency: Department of Labor (VIDOL) Unemployment Insurance ALN: 17.225 Award #: Various Award Period: Various Criteria – In accordance with the Uniform Guidance in 2 CFR Section Part 200, a State or Territory must adopt its own written fiscal and administrative requirements for expending and accounting for all funds, which are consistent with the provisions of Uniform Guidance and extend such policies to all sub-recipients. These fiscal and administrative requirements must be sufficiently specific to ensure that: funds are used in compliance with all applicable Federal statutory and regulatory provisions, costs are reasonable and necessary for operating these programs, and funds are not used for general expenses required to carry out other responsibilities of a State or Territory or its subrecipients. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – VIDOL was unable to provide reconciled accounting information relating to the majority of the Unemployment Insurance Trust Fund accounts. As such, we are unable to conclude on the fiscal and administrative requirements with respect to expending and accounting for all funds related to the Unemployment Insurance program. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the above referenced compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of VIDOL’s compliance with the specified requirements. Effect – Accounting tasks, such as periodic reconciliations, play a key role in proving the accuracy of accounting data and information included in various interim financial statements and/or Federal reports. A lack of timely preparation of complete and accurate reconciliations results in the absence of adequate control over both cash receipts and disbursements. Cause – VIDOL does not appear to have adequate policies and procedures in an effort to adequately administer the expending and accounting for all funds. Recommendation – We recommend that VIDOL improve internal controls to ensure adherence to Federal regulations related to the fiscal and administrative requirements for expending and accounting for all funds. In order to prevent significant errors in the financial records as well as prevent possible irregularities, including fraud, to exist and continue without notice, we recommend that all accounts, accruals, and reconciliations be reviewed on a periodic basis. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VIDOL acknowledges the auditor's finding regarding balance discrepancies with the general ledger, attributed to an incomplete file for audit. To prevent future issues, VIDOL updated the report writer for balance queries and will work with staff to provide training on VIDOL Standard Operating Policies and Procedures. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-041 Prior Year Finding Number: 2022-035 Compliance Requirement: Eligibility Program: U.S. Department of Labor Government Department/Agency: Department of Labor (VIDOL) Unemployment Insurance ALN: 17.225 Award #: Various Award Period: Various Criteria – Public Law 112-96 Sec. 2101 requires that as a condition of eligibility for regular compensation, a claimant must be able to work, available to work, legally authorized to work in the United States and actively seeking work. Claimants must meet other conditions of eligibility for Pandemic Unemployment Assistance (PUA), Pandemic Emergency Unemployment Compensation (PEUC) and Federal Pandemic Unemployment Compensation (FPUC). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non- Federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We sampled and selected 60 out of 4,741 unemployment claim files and noted the following: - 1 instance where VIDOL was not able to provide evidence that the claimant met the criteria for participating in the UI program but had received benefits during the year. Benefits paid to the individual during 2023 totaled $6,832. - 2 instances where VIDOL was not able to provide evidence to confirm benefit payments were discontinued when the eligibility period expired. Further, it appears internal controls were not designed to ensure documentation is maintained for the proper time period to substantiate claims charged to the program. Questioned Costs – $6,832. Context - This is a condition identified per review of VIDOL’s compliance with the specified requirements using a statistically valid sample. Total amount of unemployment claims charged to the program during fiscal year were $5,125,575. The total amount sampled is $81,571. The known amount of the exceptions is $6,832. Effect – Noncompliance with program requirements could result in disallowances of costs and participants could receive benefits that they are not entitled to receive. Cause – VIDOL does not appear to have adequate policies and procedures in place to ensure a consistent and systematic review of the data in its claimant files. Recommendation – We recommend that VIDOL reevaluate its policies and procedures to ensure proper maintenance and retention of complete program files and confirm that only eligible participants are receiving benefits they are entitled to. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. An electronic record-keeping system for claims files is expected to be launched before the end of FY 2026, enhancing record retention. VIDOL is reviewing its record retention policy and procedures and will provide training to staff on proper maintenance and retention of complete program files. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-042 Prior Year Finding Number: 2022-036 Compliance Requirement: Reporting Program: U.S. Department of Labor Government Department/Agency: Department of Labor (VIDOL) Unemployment Insurance ALN: 17.225 Award #: Various Award Period: Various Criteria – Each State or Territory must file various financial, programmatic, and special reports. Additionally, the requirements necessitate that all submitted reports should be supported by the underlying performance records and presented in accordance with the program requirements. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-Federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We sampled and selected 28 out of 103 financial, performance and special reports required to be submitted. We noted the following reports did not have supporting documentation available for review: - 2 ETA 191, Financial Status of UCFE/UCX reports - 4 ETA 2112, UI Financial Transaction Summary - 2 ETA 2208A, Quarterly UI Above-Base Report - 4 ETA 9050, Time Lapse of All First Payments except Workshare - 4 ETA 9052, Nonmonetary Determination Time Lapse Detection - 4 ETA 9055, Appeals Case Aging – Lower and Higher Authority Appeals Further, it appears internal controls were not designed to ensure documentation is maintained for the proper time period to substantiate reports submitted to the Federal government. Questioned Costs – None. Context - This is a condition identified per review of VIDOL’s compliance with the specified requirements using a statistically valid sample. Effect - VIDOL is not in compliance with the stated provisions and inaccurate information may have been reported to the Federal government. Cause – It appears that policies and procedures, including review over reporting procedures were not functioning as intended. Further, VIDOL does not appear to have adequate control over maintenance of the underlying documentation used in preparing various reports. Recommendation – We recommend that VIDOL reevaluate its policies and procedures to ensure proper retention, monitoring, and review of the required reports by the appropriate official who would ensure that information reported is complete, accurate, consistent, and submitted within the required timeframe. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VIDOL has reviewed its policies and procedures and is working to provide staff training to ensure supporting documentation is secure and readily accessible. VIDOL will update its policies and procedures to ensure that all supporting documentation is certified by the UI Director or designee before a report is submitted to the grantor. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-043 Prior Year Finding Number: 2022-038 Compliance Requirement: Special Tests and Provisions – UI Reemployment Programs (WPRS and RESEA) Program: U.S. Department of Labor Government Department/Agency: Department of Labor (VIDOL) Unemployment Insurance ALN: 17.225 Award #: Various Award Period: Various Criteria – The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The WPRS and RESEA programs service as UI’s primary programs that facilitate the reemployment needs of UI claimants. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of both WPRS and RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. RESEA is a voluntary program and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 7-19 provides RESEA operating guidance for FY 2019. Per 2 CFR section 200.303(a), a nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should comply with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition – During our testing of VIDOL’s compliance with UI Reemployment Programs, we found VIDOL did not submit the 9129 Quarterly RESEA reports. Further, it appears controls are not designed to ensure the timely and proper submission of required reports. Questioned Costs – None. Context - This is a condition identified per review of VIDOL’s compliance with the specified requirements. Effect – It appears that policies and procedures, including review over reporting procedures were not functioning as intended. Cause – VIDOL does not appear to have adequate control over maintenance of the underlying documentation used in preparing various reports. Recommendation – We recommend that VIDOL reevaluate its policies and procedures to ensure proper retention, monitoring, and review of the required reports by the appropriate official who would ensure that information reported is complete, accurate, consistent, and submitted within the required timeframe. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VIDOL has reviewed its policies and procedures and is working to provide staff training to ensure supporting documentation is secure and readily accessible. VIDOL will update its policies and procedures to ensure that all supporting documentation is certified by the UI Director or designee before a report is submitted to the grantor. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-044 Prior Year Finding Number: 2022-042 Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles – Non-Payroll Activities and Procurement and Suspension and Debarment Program: U.S. Department of the Treasury Government Department/Agency: Office of Management and Budget (OMB) COVID-19 - Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Period: 03/03/2021 – 12/31/2024 Criteria – Recipients may use CSLFRF payments for any eligible expenses subject to the restrictions set forth in sections 602 and 603 of the Social Security Act as added by section 9901 of the American Rescue Plan Act of 2021 (codified as 42 USC 802 and 42 USC 803 respectively), Treasury’s Interim Final Rule and Final Rule at 31 CFR sections 35.7 and 35.8. The following activities are not permitted under CSLFRF: - Offset a reduction in net tax revenue (applicable to states and territories) - Deposits into pension funds (applicable to all recipients except Tribes) - Debt service or replenishing financial reserves (e.g., “rainy day funds”) (applicable to all recipients) - Satisfaction of settlements and judgements (applicable to all recipients) - Programs, services, or capital expenditures that include a term or condition that undermines efforts to stop the spread of COVID-19 (applicable to all recipients) Recipients may use payments from CSLFRF to: - Support public health expenditures, by funding COVID-19 mitigation efforts, medical expenses, behavioral healthcare, and certain public health and safety staff; - Address negative economic impacts caused by the public health emergency, including economic harms to workers, households, small businesses, impacted industries, and the public sector; - Replace lost public sector revenue to provide government services; recipients may use this funding to provide government services to the extent of the reduction in revenue experienced due to the pandemic. - Provide premium pay for essential workers, offering additional support to those who have borne and will bear the greatest health risks because of their service in critical infrastructure sectors; and, - Invest in water, sewer, and broadband infrastructure, making necessary investments to improve access to clean drinking water, support vital wastewater and stormwater infrastructure, and to expand access to broadband internet. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – In mid-2024, an inquiry was conducted by the United States Department of Justice (“DOJ”) into potential criminal activity associated with three individuals, each of whom were senior GVI officials working in their respective capacities as Director/Commissioner of the U.S. Virgin Islands Office of Management and Budget, Virgin Islands Police Department, and Department of Sports, Parks, and Recreation. As of January 2025, the DOJ filed formal indictments against the these now former USVI officials (collectively the “Indicted Individuals”). The DOJ alleged that the Indicted Individuals were involved in activities associated with bribery, specifically providing, or attempting to provide, accelerated approval of contracts and payments on invoices to a vendor, Mon Ethos Pro Support, LLC. The court cases are on-going. In 2023, Mon Ethos Pro Support, LLC was paid $60,387 from Coronavirus State and Local Fiscal Recovery Funds, which are considered questioned costs. Further, internal controls over compliance do not appear to be operating effectively to ensure compliance with the allowable activities and procurement compliance requirements. Questioned Costs – $60,387. Context – This is a condition identified per review of current events and specific transactions related to the vendor identified in the DOJ indictment. Effect – Fraudulent transactions associated with a Federal program can lead to an assessment of penalties, claw back of federal funds and termination of awards. Further, an ineffective control system related to procuring of vendors and submission of allowable costs that could ultimately lead to disallowed costs for the major programs. Cause – OMB does not appear to have adequate policies and procedures to ensure compliance with applicable cost principles and procurement standards. Specifically, there appears to be a lack of monitoring controls and an appropriate level of review and approval of transactions prior to charging costs to a federal program. Recommendation – We recommend that OMB evaluate its policies and procedures to ensure appropriate internal controls in order to comply with federal regulations relating to the procurement of goods and services and review current records retention policies. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. A comprehensive corrective action plan has been implemented to strengthen grant management and compliance. Key personnel have been hired, including a Grants Administrator and an external accounting firm, to provide oversight and expertise. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-045 Prior Year Finding Number: N/A Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of the Treasury Government Department/Agency: Office of Management and Budget (OMB) COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Period: 03/03/2021 – 12/31/2024 Criteria – Recipients may use payments from SLFRF to replace lost public sector revenue to provide government services. Recipients may use this funding to provide government services to the extent of the reduction in revenue experienced due to the pandemic. Under the Final Rule, recipients can elect a one-time “standard allowance” of $10.0 million (not to exceed the recipient’s award amount) to spend on the “provision of government services” during the period of performance. Alternatively, recipients can calculate lost revenue for the years 2020, 2021, 2022, and 2023 based on the formula provided in the Final Rule to determine the amount of SLFRF funds that can be used for the “provision of government services.” Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – The Government opted to calculate the lost revenue for the years 2020, 2021, 2022, and 2023 using the formula provided in the Final Rule. We reviewed the revenue loss calculation and noted that there was no evidence of review of the calculation. Questioned Costs – None. Context – This is a condition identified per review of OMB’s compliance with the specified requirements. Effect – Without adequate internal controls to ensure compliance with earmarking requirements, there is an increased risk that earmarking requirements will not be properly applied, and funding could be jeopardized. Cause – OMB does not appear to have adequate policies and procedures to ensure consistent review and monitoring of the requirements. Recommendation – We recommend that OMB improve internal controls to ensure adherence to federal regulations to the earmarking requirements by deploying resources that are given responsibility to ensure periodic monitoring and review of the earmarking requirements. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. Moving forward, OMB will enhance its internal controls to ensure all procedural documentation is thoroughly reviewed and approved, with clear evidence of such approval. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-046 Prior Year Finding Number: 2022-043 Compliance Requirement: Procurement and Suspension and Debarment Program: U.S. Department of the Treasury Government Department/Agency: Office of Management and Budget (OMB) COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Period: 03/03/2021 – 12/31/2024 Criteria – Recipients may use award funds to enter into contracts to procure goods and services necessary to implement one or more of the eligible purposes outlined in sections 602I and 603I of the Act and Treasury’s Interim Final Rule and Final Rule. As such, recipients are expected to have procurement policies and procedures in place that comply with the procurement standards outlined in the Uniform Guidance. Specifically, a state must follow the same policies and procedures it uses for procurements from its non-federal funds and comply with 2 CFR sections 200.321, 200.322, and 200.323. States must also ensure that every contract includes the applicable contract clauses required by 2 CFR section 200.327. Per Procurement Manual, User Agencies are required to submit a written justification letter to DPP, which was signed by the agency head, which explains the need for the services, the exception in title 31, Virgin Islands Code, chapter 23, section 239(a) being relied upon, the methodology for the selection process, and the rationale for selecting the prospective contractor. The letter must identify the funding source, and comply with all other requirements necessary for the acquisition of services under title 31, Virgin Islands Code, chapter 23, sections 239(a) (1), (2) or (3) whichever is applicable. The letter must contain an “approve/disapprove” block for the Commissioner of Property and Procurement. As such, please provide the justification letter for these three Task Order Contracts. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – The Government’s Department of Property and Procurement (DPP) is primarily responsible for procurement transactions. In our review of 10 out of 99 procurement transactions, we noted 5 transactions where documentation demonstrating compliance with the VI Procurement Laws were not available for review. Further, internal controls over compliance do not appear to be designed to ensure relevant procurement documentation is retained to demonstrate compliance with the procurement compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of OMB’s compliance with the specified requirements using a statistically valid sample. Total amount of the procurement transactions was $32,835,869. The total amount of the samples was $5,210,713. The known amount of the exceptions is $4,507,396. Effect – OMB could inadvertently contract or make sub-awards to parties that are suspended or debarred from doing business with the Federal government as well as award contracts to vendors whose contract prices are unreasonable. In addition, contracts may be executed to unqualified vendors. Cause – OMB does not appear to have a process in place to adequately monitor and maintain completed contract files comprising of all supporting documents. Recommendation – We recommend that OMB and DPP improve internal controls to ensure adherence to federal regulations relating to the procurement of goods and services and review current records retention policies. There should be timely coordination and communication amongst all Government departments and/or agencies that are responsible for handling and managing procurement tasks. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The Government updated its procurement laws and issued revised procurement manuals, along with issuing position-specific Standard Operating Procedures. Processes for enforcing Internal controls and adherence to procurement laws have been established and are regularly reinforced. In early 2025, the Government-wide training reinforced expectations for full and open competition. User Agencies now access GVIBUY for informal solicitations in the eProcurement system, with ongoing training to prioritize competition and enhance oversight by the Department of Property and Procurement. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-047 Prior Year Finding Number: 2022-044 Compliance Requirement: Reporting Program: U.S. Department of the Treasury Government Department/Agency: Office of Management and Budget (OMB) COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Period: 03/03/2021 – 12/31/2024 Criteria – There are two types of reporting requirements for the CSLFRF program: Project and Expenditure Report: Report on financial data, projects funded, expenditures, and contracts and subawards over $50,000, and other information. Project and Expenditure Reports are due on a regular, recurring basis after the Interim Reports. The reporting frequency and deadlines vary by type of recipient and total allocation amount. Recovery Plan Performance Report: The Recovery Plan Performance Report (the “Recovery Plan”) will provide information on the projects that large recipients are undertaking with program funding and how they plan to ensure program outcomes are achieved in an effective, efficient, and equitable manner. It will include key performance indicators identified by the recipient and some mandatory indicators identified by Treasury. The Recovery Plan will be posted on the website of the recipient as well as provided to Treasury. In addition, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – Of the 5 reports submitted during the fiscal year, we selected the following reports to review: - Projects and Expenditures Report – Quarter Ended December 31, 2022 - Projects and Expenditures Report – Quarter Ended March 31, 2024 - Recovery Plan Performance Report – Year ended June 30, 2023 We found all reports did not contain evidence of review and approval prior to submission. Further, we noted all reports contained inaccurate data. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the reporting compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of OMB’s compliance with the specified requirements using a statistically valid sample. Effect – OMB is not in compliance with the stated provisions and inaccurate information may have been reported to the Federal government. Cause – It appears that policies and procedures, including review over reporting procedures were not functioning as intended. Further, OMB does not have adequate control over maintenance of the underlying documentation used in preparing various reports. Recommendation – We recommend that OMB reevaluates its policies and procedures to ensure proper retention, monitoring, and review of the required reports by an appropriate official who would ensure that information submitted is complete, accurate, consistent, and submitted within the required timeframe. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. Starting in 2024, OMB has implemented a reporting approval memo, signed by the OMB Director, to confirm the review and approval of Treasury reports. OMB has enhanced the collection and storage of supporting financial information for all projects in quarterly reports, ensuring necessary support is available upon request as of FY23. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-048 Prior Year Finding Number: 2022-045 Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of Treasury Government Department/Agency: Office of Management and Budget (OMB) COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Award #: N/A Award Period: 03/03/2021 – 12/31/2024 Criteria – A pass-through entity (PTE) must: Identify the Award and Applicable Requirements – Clearly identify to the subrecipient: 1. The award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.331(a)(1); 2. All requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); 3. Any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.331(a)(3)). Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We selected 10 of 21 subrecipients and found no evidence the subrecipient monitoring workbook was reviewed by the American Rescue Plan Act (ARPA) Grants Administrator. Questioned Costs – None. Context – This is a condition identified per review of OMB’s compliance with the specified requirements using a statistically valid sample. The total amount of expenditures passed through to subrecipients in fiscal year 2023 were $104,779,873. The total amount of our sample totaled $89,247,731. Effect – Failure to properly adhere to policies and procedures can result in noncompliance with laws and regulations and failure to meet the program’s objectives. Cause – OMB does not have policies and procedures in place to ensure personnel adhere to the internal procedures to properly monitor subrecipients to ensure adherence to applicable federal regulations, including expending federal awards for allowable expenditures. Recommendation – We recommend that OMB implement policies, procedures, and controls to ensure subrecipients are identified and monitored in accordance with federal statutes. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. Starting FY25, OMB will identify and monitor federal awarding agencies, requesting single audit results for applicable recipients and including them in monitoring reviews. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-049 Prior Year Finding Number: N/A Compliance Requirement: Allowable Costs/Cost Principles – Payroll Activities Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) Special Education Cluster ALN: 84.027A, 84.027X Award #: Various Award Period: Various Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its activities allowed or unallowed, allowable cost/cost principal process. CFR 200.403(g) states that for costs to be allowed under federal awards, they must be adequately documented. Additionally, salaries and wages charged to Federal awards are subject to the standards of documentation as described by 2 CFR Section 200.430(i) and must be based on records that accurately reflect the work performed. These records must: - Be incorporated into the organization’s official records. - Reasonably reflect the total activity for which the employee is compensated across all grant-related and non-grant related activities (100%); and - Support the distribution of employee salary across multiple activities or cost objectives. Furthermore, CFR 200.113 requires that an applicant, recipient, or subrecipient of a Federal award must promptly disclose, in writing, whenever it has credible evidence of the commission of a violation of Federal criminal law involving fraud, conflict of interest, bribery, or gratuity violations found in Title 18 of the United States Code, or a violation of the civil False Claims Act, in connection with the Federal award (including any activities or subawards thereunder). The disclosure must be made to the Federal agency, the agency’s Office of Inspector General, and the pass-through entity (if applicable). Condition – During our testing of allowable costs for payroll expenditures incurred throughout the year, we sampled and selected 40 of 2,573 payroll disbursements and noted 2 instances where the employee’s pay rate in the approved Notice of Personnel Action provided did not agree with the pay rate in the payroll register. Additionally, a fraud incident related to falsified payroll timesheet entries charged to this program was discovered and investigated during the year. It was discovered that bus driver timesheets were being approved with falsified time entries. An analysis conducted by VIDE determined the amount of theft to be $5,221. This incident was not disclosed or reported to the Federal awarding agency as required. As a result, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – $5,221. Context – This is a condition identified per review of VIDE’s compliance with the specified requirements using a statistically valid sample. The total payroll expenditures charged to the program in fiscal year 2023 was $5,744,863. The amount sampled is $102,945. Effect – An ineffective control system related to review of transactions to ensure that only allowable costs are allocated to federal programs can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements that could ultimately lead to disallowed costs for the major programs. Cause – VIDE does not appear to have adequate policies and procedures to ensure compliance with applicable cost principles and ensure that an appropriate level of review was completed prior to charging costs to a federal program. Recommendation – We recommend that VIDE reevaluate and improve internal controls to ensure adherence to federal regulations related to the fiscal administrative requirement for expending and accounting for payroll transactions. Additionally, fraud incident should be reported to the appropriate federal awarding agency in accordance with mandatory disclosure requirements. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VIDE is taking immediate action to align payroll controls with our established fiscal improvement plan and to institutionalize a mandatory federal reporting protocol for fraud. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-050 Prior Year Finding Number: 2022-046 Compliance Requirement: Equipment and Real Property Management Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) Special Education Cluster ALN: 84.027A, 84.027X Award #: Various Award Period: Various Criteria – Per the Uniform Guidance in 2 CFR Section 200.313, Equipment, property records must be maintained that include a description of the property, a serial number or other identification number, the source of the property, who holds title, the acquisition date, cost of the property, percentage of Federal participation in the cost of the property, the location, use and conditions of the property, and any ultimate disposition date including the date of disposal and sale price of the property. Additionally, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – The VIDE maintains an equipment listing for fixed assets purchased with federal funding. VIDE was unable to provide complete property records which met the stated requirements. Further, we noted that internal controls were not operating at a level of precision to ensure compliance with the equipment management compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of the VIDE’s compliance with the specified requirements. Effect – There is a risk that inadequate recordkeeping or equipment could lead to misappropriation of assets and noncompliance with Federal regulations resulting in a return of Federal awards received. Cause – VIDE does not appear to have adequate policies and procedures in place to adequately monitor equipment acquired with Federal Funds. Recommendation – We recommend that VIDE improve internal controls to ensure adherence to Federal regulations related to equipment and its related maintenance. There should be timely coordination and communication amongst all personnel that are responsible for handling and managing such assets as well as monitoring of the performance of the recording of the equipment. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. We recognize that while a dual-control workflow exists, high staff turnover and a lack of strict adherence have led to gaps in compliance, and to address this, VIDE is moving to strictly enforce its established protocols and provide targeted training to new personnel in the Procurement and Fixed Asset divisions. VIDE is enforcing strict adherence to its established collaborative dual-control process to ensure timely identification of federally funded equipment, specifically reinforcing the requirement that the Procurement Warehouse must tag assets immediately upon physical receipt so that no asset is permitted to leave the warehouse or enter the ecosystem without a unique identifier. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-051 Prior Year Finding Number: 2022-047 Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) Special Education Cluster ALN: 84.027A, 84.027X Award #: Various Award Period: Various Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Further, in accordance with the Uniform Guidance in 2 CFR Section 200.306, a State may not reduce the amount of State financial support for special education and related services for children with disabilities (or State financial support otherwise made available because of the excess costs of educating those children) below the amount of State financial support provided for the preceding fiscal year. The Secretary reduces the allocation of funds under 20 USC 1411 for any fiscal year following the fiscal year in which the State fails to comply with this requirement by the amount by which the State failed to meet the requirement. Additionally, an LEA can use not more than 15% of the amount of federal Part B funds the LEA receives for any fiscal year (less any amount by which it reduces its expenditures under 20 USC 1413(a)(2)(C)) (see III.G.2.1.b.(6) in this section), in combination with other funds, to develop and implement, early intervening services for children in kindergarten through grade 12 who have not been identified under IDEA but need additional academic and behavioral support to succeed in the general education environment (20 USC 1413(f); 34 CFR section 300.226). Condition – We reviewed the level of effort calculations and noted the following: - At the Local Education Agency (LEA) level, we noted that although the two LEAs appeared to meet the required financial support thresholds on the per child basis based on the level of effort compliance requirement, we were unable to verify the number of students for each LEA. - At the State Education Agency (SEA) level, we were unable to review documentation that included the approval /certification of the amounts in the Maintenance of Financial support at the State Education level. In addition, although the calculation shows that VIDE met the Maintenance of Effort at the State level, we were unable to review documentation that would allow us to verify the number of students served in the current year. We reviewed the earmarking documentation and noted the following: - At the State Education Agency (SEA) level, for the non-ARP grant, we were unable to verify the total numbers of students and the number of students in poverty. We were therefore unable to confirm that the allocation of the remaining funds to the LEA agreed with the relative numbers of children living in poverty. As a result, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the level of effort and earmarking compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of VIDE’s compliance with the specified requirements. Effect – VIDE is not in compliance with the stated provisions. Without adequate internal controls to ensure compliance with level of effort requirements and earmarking, there is an increased risk that level of effort and earmarking requirements will not be properly applied, and funding could be jeopardized. Cause – VIDE did not appear to have adequate policies and procedures in place to ensure consistent and systematic monitoring of the requirements. Recommendation – We recommend that VIDE improve internal controls to ensure adherence to federal regulations relating to the level of effort and earmarking requirements at the SEA and LEA levels by deploying resources that are given the responsibility to ensure periodic monitoring and compliance of the level of effort and earmarking requirements. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VIDE will establish a team for quarterly reviews of documentation, report issues, and recommend corrective actions. The IDEA State Office will set procedures for verifying accuracy of data reported by LEAs. Comprehensive staff training will ensure understanding of new policies and procedures. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number 2023-052 Prior Year Finding Number: N/A Compliance Requirement: Allowable Costs/Cost Principles – Payroll Activities Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) Consolidated Grant to the Outlying Areas ALN: 84.403A Award #: Various Award Period: Various Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (1.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its activities allowed or unallowed, allowable cost/cost principal process. CFR 200.403(g) states that for costs to be allowed under federal awards, they must be adequately documented. Additionally, salaries and wages charged to Federal awards are subject to the standards of documentation as described by 2 CFR Section 200.430(i) and must be based on records that accurately reflect the work performed. These records must: - Be incorporated into the organization’s official records. - Reasonably reflect the total activity for which the employee is compensated across all grant-related and non-grant related activities (100%); and - Support the distribution of employee salary across multiple activities or cost objectives. Condition – During our testing of allowable costs for payroll expenditures incurred throughout the year, we sampled and selected 40 of 4,518 payroll disbursements and noted the following: - 18 instances where the approved timesheet for the pay period selected were not available for review. - 2 instances where the per diem support were not readily identifiable. - 1 instance where the employee’s pay rate in the approved NOPA provided did not agree with the pay rate in the payroll register. As a result, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of VIDE’s compliance with the specified requirements using a statistically valid sample. The total payroll expenditures charged to the program in fiscal year 2023 was $7,738,716. The amount sampled is $95,985. Effect – An ineffective control system related to review of transactions to ensure that only allowable costs are allocated to federal programs can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements that could ultimately lead to disallowed costs for the major programs. Cause – VIDE does not appear to have adequate policies and procedures to ensure compliance with applicable cost principles and ensure that an appropriate level of review and approval was completed prior to charging costs to a federal program. Recommendation – We recommend that VIDE reevaluate and improve internal controls to ensure adherence to federal regulations related to the fiscal administrative requirement for expending and accounting for payroll and to ensure proper and accurate funding allocation of payroll cost. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VIDE is taking immediate action to align payroll controls with the established fiscal improvement plan. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number 2023-053 Prior Year Finding Number: 2022-049 Compliance Requirement: Equipment and Real Property Management Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) Consolidated Grant to the Outlying Areas ALN: 84.403A Award #: Various Award Period: Various Criteria – Per the Uniform Guidance in 2 CFR Section 200.313, Equipment, property records must be maintained that include a description of the property, a serial number or other identification number, the source of the property, who holds title, the acquisition date, cost of the property, percentage of Federal participation in the cost of the property, the location, use and conditions of the property, and any ultimate disposition date including the date of disposal and sale price of the property. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Condition – The VIDE maintains an equipment listing for fixed assets purchased with federal funding. VIDE was unable to provide complete property records which met the stated requirements. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the equipment management compliance requirements. Questioned Costs – Not determinable. Context – This is a condition identified per review of the VIDE’s compliance with the specified requirements. Effect – There is a risk that inadequate recordkeeping or equipment could lead to misappropriation of assets and noncompliance with Federal regulations resulting in a return of Federal awards received. Cause – VIDE does not appear to have adequate policies and procedures in place to adequately monitor equipment acquired with Federal Funds. Recommendation – We recommend that VIDE improve internal controls to ensure adherence to Federal regulations related to equipment and its related maintenance. There should be timely coordination and communication amongst all personnel that are responsible for handling and managing such assets as well as monitoring of the performance of the recording of the equipment. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VIDE plans to improve management and documentation of federally funded equipment by enhancing its asset tracking system and maintaining centralized records with detailed asset information. The Procurement Division will conduct quarterly inventory audits to reconcile records with actual inventory, resolving discrepancies promptly. The Fixed Asset Director will establish communication protocols among Programs/Divisions, requiring monthly status reports to ensure data accuracy and timely updates. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number 2023-054 Prior Year Finding Number: N/A Compliance Requirement: Procurement and Suspension and Debarment Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) Consolidated Grant to the Outlying Areas ALN: 84.403A Award #: Various Award Period: Various Criteria – When procuring property and services, states must use the same policies and procedures they use for procurements from their non-federal funds (2 CFR section 200.317). Per Procurement Manual, User Agencies are required to submit a written justification letter to the Government’s Department of Property and Procurement (DPP), which was signed by the agency head, which explains the need for the services, the exception in title 31, Virgin Islands Code, chapter 23, section 239(a) being relied upon, the methodology for the selection process, and the rationale for selecting the prospective contractor. The letter must identify the funding source and comply with all other requirements necessary for the acquisition of services under title 31, Virgin Islands Code, chapter 23, sections 239(a) (1), (2) or (3) whichever is applicable. The letter must contain an “approve/disapprove” block for the Commissioner of Property and Procurement. Additionally, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – In our review of 40 out of 354 procurement transactions, we noted 2 transactions in which the approved Short Form Contract required for service-related procurement were not available for review. Further, we noted that internal controls were not operating at a level of precision to ensure compliance with the procurement compliance requirements. Questioned Costs – None. Context – This is a condition identified per review of VIDE’s compliance with the specified requirements using a statistically valid sample. Total amount of procurement transactions was $6,434,229. Total amount sampled was $1,428,065. The known amount of exceptions is $95,120. Effect – VIDE could inadvertently contract or make sub-awards to parties that are suspended or debarred from doing business with the Federal government as well as award contracts to vendors whose contract prices are unreasonable. In addition, contracts may be executed to unqualified vendors. Cause – VIDE does not appear to have a process in place to adequately monitor and maintain completed contract files comprising of all supporting documents. Recommendation – We recommend that VIDE improve internal controls to ensure adherence to federal regulations relating to the procurement of services and review current records retention policies. There should be timely coordination and communication amongst all Government departments and/or agencies that are responsible for handling and managing procurement tasks. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VIDE recognizes that the unavailability of approved Short Form Contracts during the audit indicates a gap in record retention and file maintenance. To address this, the Business Office will not process any payment voucher for service-related procurements unless the approved Short Form Contract is attached to the ERP transaction as a mandatory supporting document. To ensure records are maintained and readily available for future reviews, the Procurement Division will digitize all executed Short Form Contracts and upload them to the department’s centralized SharePoint repository immediately upon execution. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number 2023-055 Prior Year Finding Number: 2022-050 Compliance Requirement: Reporting Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) Consolidated Grant to the Outlying Areas ALN: 84.403A Award #: Various Award Period: Various Criteria – Each State or Territory must file various financial, programmatic, and special reports. Additionally, the requirements necessitate that all submitted reports should be supported by the underlying performance records and presented in accordance with program requirements. Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities, receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – VIDE failed to submit subaward data to fulfill the Transparency Act reporting requirements for the first tier subawards of $30,000 or more. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the reporting compliance requirements. Questioned Costs – None. Context – This is a condition per review of VIDE’s compliance with reporting requirements. In fiscal year 2023, VIDE passed through approximately $842,000 to 9 subrecipients. Effect – VIDE is not in compliance with reporting requirements as it failed to provide evidence of identifying and reporting Transparency Act reporting requirements. Cause – It appears that policies and procedures, including review over reporting procedures were not functioning as intended. Recommendation – We recommend that VIDE should implement policies, procedures and controls that will comply with all required laws, guidelines, and requirement under the award. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VIDE plans to address the audit finding on FFATA reporting by developing detailed reporting policies and procedures. These will include guidelines for identifying and tracking subawards, collecting required data, and setting submission timelines. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-056 Prior Year Finding Number: 2022-052 Compliance Requirement: Allowable Costs/Cost Principles – Payroll Activities Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) COVID-19 – Education Stabilization Fund State Educational Agency (Outlying Areas) (ESF-SEA) ALN: 84.425A Award #: S425A200004, S425A210004 Award Period: 06/22/2020 – 09/30/2022 01/13/2021 – 09/30/2023 COVID-19 – American Rescue Plan – Outlying Areas State Educational Agency (ARP-OA SEA) ALN: 84.425X Award #: S425X210004 Award Period: 04/08/2021 – 09/30/2024 Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, salaries and wages charged to Federal awards are subject to the standards of documentation as described by 2 CFR Section 200.430(i) and must be based on records that accurately reflect the work performed. These records must: - Be incorporated into the organization’s official records: - Reasonable reflect the total activity for which the employee is compensated across all grant-related and non-grant related activities (100% effort); and - Support the distribution of employee salary across multiple activities or cost objectives. Condition – For ALN 84.425 subprogram A and X, we sampled and selected 60 of 6,465 payroll expenditures and noted the following: - 29 instances where the timesheet for the pay period selected were not available for review. - 1 instance where the hours recorded on the employees’ timesheets did not agree with the hours recorded per the payroll register. - 1 instance where the check detail payment support was not available for review. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the activities allowed or unallowed and allowable costs/cost principles compliance requirements. Questioned Costs – $74,108. Context – This is a condition identified per review of VIDE’s compliance with the specified requirements using a statistically valid sample. The total payroll expenditures charged to program in fiscal year 2022 is $9,237,083. Total amount sampled is $116,136. The known amount of the exceptions is $74,108. Effect – Failure to properly review and support expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – VIDE does not appear to have adequate policies and procedures in place to ensure compliance with applicable cost principles and maintenance of underlying documentation. Recommendation – We recommend that VIDE improve internal controls to ensure adherence to Federal regulations related to the fiscal and administrative requirements for expending and accounting for payroll expenditures. Where employees work on multiple activities or cost objectives, a distribution of salaries or wages should be supported by personnel activity reports (time and attendance) or equivalent documents. Such information should also be monitored, retained, and approved by a responsible official of VIDE in a timely manner. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. VIDE is addressing audit findings related to payroll activities by enhancing internal controls to ensure compliance with federal regulations. Key measures include improving timesheet management through electronic submission, mandatory supervisor review, and secure storage. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-057 Prior Year Finding Number: 2022-053 Compliance Requirement: Reporting Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) Office of Management and Budget (OMB) COVID-19 - Education Stabilization Fund State Educational Agency (Outlying Areas) (ESF-SEA) ALN: 84.425A Award #: S425A200004, S425A210004 Award Period: 06/22/2020 - 09/30/2022 01/13/2021 - 09/30/2023 COVID-19 - Education Stabilization Fund Governors (Outlying Areas) (ESF-Governor) ALN: 84.425H Award #: S425H200003, S425H210003 Award Period: 06/29/2020 - 09/30/2022 01/13/2021 - 09/30/2023 COVID-19 – American Rescue Plan - Outlying Areas State Educational Agency (ARP-OA SEA) ALN: 84.425X Award #: S425X210004 Award Period: 04/08/2021 – 09/30/2024 Criteria – Each State or Territory must file various financial, programmatic and special reports. Additionally, the requirements necessitate that all submitted reports should be supported by the underlying performance records and presented in accordance with program requirements. Specifically for this program, the CARES Act 15011(b)(2) requires institution receiving funds under ESF II-Governor and ESF II-SEA to submit the required quarterly reports to the Secretary at such time and manner and containing such information as the Secretary may require. Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Furthermore, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non- Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We reviewed OMB and VIDE's compliance with the reporting requirements and noted the following: - OMB was unable to provide evidence of submission of the annual performance review report, quarterly progress update reports, and FFATA reports for ALN 84.425, subprogram H. - Amounts included in the annual performance review report for ALN 84.425, subprograms A and X, did not agree to supporting documents provided. - The annual performance review report for ALN 84.425, subprograms A and X, did not contain evidence that the report was reviewed and approved prior to submission. Further, it does not appear that the controls in place are operating at a level of precision to ensure the timely filing of reports. Questioned Costs – None. Context – This is a condition identified per review of OMB and VIDE’s compliance with the specified requirements using a statistically valid sample. Effect – Failure to properly track all reporting requirements, including the due dates of those reports, could result in missed or late reporting. This could also lead to a reduction in funding due to noncompliance with the terms of the Federal award. Cause – The internal controls established for submission of reporting requirements did not fully operate as designed causing late submission and not in compliance with reporting requirements under the Transparency Act related to the program’s subrecipients. Recommendation – We recommend that OMB and VIDE reevaluate its policies and procedures to ensure proper retention, monitoring, and review of the required reports by an appropriate official who would ensure that information submitted is complete, accurate, consistent, and submitted within the required timeframe. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. VIDE is addressing deficiencies in the reporting processes for the COVID-19 Education Stabilization Fund (ESF-SEA) by committing to enhance reporting practices for compliance with federal requirements. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-058 Prior Year Finding Number: N/A Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) Office of Management and Budget (OMB) COVID-19 - Education Stabilization Fund Governors (Outlying Areas) (ESF-Governor) ALN: 84.425H Award #: S425H200003, S425H210003 Award Period: 06/29/2020 - 09/30/2022 01/13/2021 - 09/30/2023 Criteria A pass-through entity (PTE) must: Identify the Award and Applicable Requirements – Clearly identify to the subrecipient: 1. The award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.331(a)(1); 2. All requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); 3. Any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.331(a)(3)). Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that nonfederal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We selected 10 out of 27 subrecipients and noted that, all 10 samples where VIDE and OMB failed to provide the evidence of monitoring and reviewing sub-grantee to ensure effective management of sub-awards. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the subrecipient monitoring compliance requirements or proper identification of subrecipients. Questioned Costs – None. Context – This is a condition identified per review of VIDE and OMB’s compliance with the specified requirements using a statistically valid sample. The total amount of expenditures passed through to subrecipients in fiscal year 2023 was $4,220,685. The total amount of our sample totaled $3,051,101. Effect – VIDE and OMB are not in compliance with the stated provisions. Failure to properly identify and monitor subrecipients can result in noncompliance with laws and regulations and failure to meet the program's objectives. Cause – VIDE and OMB do not have internal controls in place to properly identify and monitor subrecipients to ensure adherence to applicable federal regulations, including expending federal awards for allowable expenditures. Recommendation – We recommend that VIDE and OMB implement policies, procedures, and controls to ensure subrecipients are identified and monitored in accordance with federal statutes. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. During the period under review, gaps in documentation and monitoring were impacted by staff turnover, leadership transitions, and programmatic shifts, which limited the consistency and precision of subrecipient oversight across programs. In response, Office of Federal Grants (OFG) has taken steps to reinforce its role as the pass-through entity and to formalize monitoring expectations and processes. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-059 Prior Year Finding Number: 2022-054 Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) COVID-19 - Education Stabilization Fund State Educational Agency (Outlying Areas) (ESF-SEA) ALN: 84.425A Award #: S425A200004, S425A210004 Award Period: 06/22/2020 - 09/30/2022 01/13/2021 - 09/30/2023 COVID-19 - Education Stabilization Fund Governors (Outlying Areas) (ESF-Governors I and II) ALN: 84.425H Award #: S425H200003, S425H210003 Award Period: 06/29/2020 - 09/30/2022 01/13/2021 - 09/30/2023 COVID-19 – American Rescue Plan - Outlying Areas State Educational Agency (ARP-OA SEA) ALN: 84.425X Award #: S425X210004 Award Period: 04/08/2021 – 09/30/2024 Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per Compliance Supplement, the State or Territory or agency receiving financial assistance under ESF-SEA I and ESF-Governor I, must provide eligible private school children and their teachers or other educational personnel with equitable services or other benefits under the program. Before an agency, consortium, or entity makes any decision that affects the opportunity of eligible private school children, teachers, and other educational personnel to participate, the agency, consortium, or entity must engage in timely and meaningful consultation with private school officials. Expenditures for services and benefits to eligible private school children and their teachers and other educational personnel must be equal on a per-pupil basis to the expenditures for participating public school children and their teachers and other educational personnel, taking into account the number and educational needs of the children, teachers and other educational personnel to be served. For the programs under ESF-SEA, ESF II-SEA, ESF-Governor, ESF II- Governor will ensure equitable services will be provided to students and teachers in non-public elementary and secondary schools in the same manner provided under section 8501 of the Elementary and Secondary Education Act (ESEA). Condition – We sampled and selected 9 out of 27 non-public schools for VIDE and noted following: - VIDE was not able to provide documentation that they reviewed the planned services and communication. - Computation by VIDE of the amount allocated to nonpublic schools did not contain evidence of review and approval. - VIDE did not provide the Affirmation of Consultation/Intent to Participate for 9 out of 27 nonpublic schools consulted. - VIDE did not provide documentation to support that the educational services that were planned were provided. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the special tests and provisions requirements. Questioned Costs – None. Context – This is a condition identified per review of OMB and VIDE’s compliance with the specified requirements using a statistically valid sample. Effect – Noncompliance with program requirements could result in disallowances of costs and ineligible schools could be participating in the program. Cause – OMB and VIDE do not appear to have an effective system in place to ensure consistent and systematic review of documentation and file maintenance. Recommendation – We recommend that OMB and VIDE implement policies, procedures, and controls that will ensure equitable services are provided to eligible private school children and their teachers and other educational personnel. OMB and VIDE should also review its record retention policies to ensure that complete documentation is maintained, safeguarded, and available for review. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. OMB will develop and implement formal policies and procedures to ensure compliance with federal regulations. This includes establishing guidelines and a schedule for timely consultations with nonpublic schools and collaborating with the Department of Education to ensure equitable per-pupil expenditures for both private and public school children. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-060 Prior Year Finding Number: 2022-055 Compliance Requirement: Special Tests and Provisions – Wage Rate Requirements Program: U.S. Department of Education Government Department/Agency: Department of Education (VIDE) COVID-19 - Education Stabilization Fund State Educational Agency (Outlying Areas) (ESF-SEA) ALN: 84.425A Award #: S425A200004, S425A210004 Award Period: 06/22/2020 - 09/30/2022 01/13/2021 - 09/30/2023 COVID-19 – American Rescue Plan - Outlying Areas State Educational Agency (ARP-OA SEA) ALN: 84.425X Award #: S425X210004 Award Period: 04/08/2021 – 09/30/2024 Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Non-federal entities shall include in their construction contracts subject to the Wage Rate Requirements (which still may be referenced as the Davis-Bacon Act) a provision that the contractor or subcontractor comply with those requirements and the Department of Labor regulations (29 CFR part 5, Labor Standards Provisions Applicable to Contacts Governing Federally Financed and Assisted Construction). This includes a requirement for the contractor or subcontractor to submit to the nonfederal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls). Condition – We reviewed VIDE's compliance with the wage rate requirements and noted the following: - VIDE did not implement a formal process for the wage rate requirements compliance for fiscal year 2023. - We randomly selected 3 contracts for classroom and office repair services and determined it did not indicate a provision that the contractor complies with wage rate requirements. - VIDE did not provide the certified payrolls required to be submitted by the contractor. Further, it does not appear that there are controls in place to ensure compliance with the special tests and provisions compliance requirements. Questioned Costs – Not determinable. Context – This is a condition identified per review of VIDE’s compliance with the specified requirements not using a statistically valid sample. Effect – VIDE is not in compliance with the stated provisions. There is potential that contractor or subcontractors could have paid their employees less than the prevailing wage rates established by the Department of Labor. Cause – VIDE does not appear to have adequate policies and procedures in place to ensure compliance with applicable wage rate requirements. Recommendation – We recommend the VIDE implement policies, procedures, and controls that will ensure adherence to Federal regulations related to wage rate requirements, and to ensure that responsible project management personnel obtain and review the required certified payroll reports for each week in which contract work is performed. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. VIDE is addressing compliance gaps related to wage rate requirements under the COVID-19 Education Stabilization Fund by reviewing all contracts to ensure they include appropriate compliance language. Contract templates will be updated to mandate compliance and specify consequences for noncompliance. Additionally, VIDE will implement a system requiring contractors to submit certified payroll reports weekly, with a designated team responsible for collecting, reviewing, and retaining these reports to verify compliance. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-062 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Non-Payroll Activities Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Head Start Cluster ALN: 93.356, 93.600 Award #: Various Award Period: Various Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – In our review of 42 out of 520 non-payroll transactions, we noted 1 instance in which the expenditure was not approved by the personnel authorized to do so. Questioned Costs – None. Context – This is a condition identified per review of the DHS’ compliance with the specified requirements using a statistically valid sample. The total amount of non-payroll expenditures charged to the program were $6,751,631. Total amount sampled is $4,475,308. The known amount of the exceptions is $441,706. Effect – Failure to properly review and support expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – DHS does not appear to have adequate policies and procedures in place to ensure internal controls are consistently and diligently applied. Recommendation – We recommend that DHS improve internal controls to ensure adherence to the Federal regulations related to the fiscal and administrative requirements for expending and accounting for non-payroll expenditures. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. A workflow is established to ensure the proper review and processing of Accounts Payables payments. This includes a level of approval by the Chief Financial Officer. Any transactions $50,000 and above require approval by the Agency Head or their Designee. The workflow is then automatically released to the Department of Finance for review, approval and check processing. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-063 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles – Payroll Activities Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Head Start Cluster ALN: 93.356, 93.600 Award #: Various Award Period: Various Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. CFR 200.403(g) states that for costs to be allowed under federal awards, they must be adequately documented. Additionally, salaries and wages charged to Federal awards are subject to the standards of documentation as described by 2 CFR Section 200.430(i) and must be based on records that accurately reflect the work performed. These records must: - Be incorporated into the organization’s official records. - Reasonably reflect the total activity for which the employee is compensated across all grant-related and non-grant related activities (100%); and - Support the distribution of employee salary across multiple activities or cost objectives. Condition – During our testing of allowable costs for payroll expenditures incurred throughout the year, we sampled and selected 60 of 2,941 payroll disbursements and noted 1 instance where fringe benefits were incorrectly charged to the program. We found the employer share of fringe benefits charged to the program with no associated time and effort by the employee. The employee retired and the fringe benefit continued to be charged to the program subsequent to retirement. Further, we noted that internal controls identified did not appear to be operating at a level of precision to ensure compliance with the above-mentioned requirements. Questioned Costs - $4,688. Context – This is a condition identified per review of DHS’ compliance with the specified requirements using a statistically valid sample. The total payroll expenditures charged to the program in fiscal year 2023 were $7,037,992. The amount sampled is $150,246. The known amount of instances of noncompliance is $4,688, which represents the fringe benefits charged to the program for the entire fiscal year with no associated time and effort by the employee. Effect – An ineffective control system related to review of transactions to ensure that only allowable costs are allocated to federal programs can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements that could ultimately lead to disallowed costs for the major programs. Cause – DHS does not appear to have adequate policies and procedures to ensure compliance with applicable cost principles and ensure that an appropriate level of review and approval was completed prior to charging costs to a federal program. Recommendation – We recommend that DHS reevaluate and improve internal controls to ensure adherence to federal regulations related to the fiscal administrative requirement for expending and accounting for payroll and to ensure proper and accurate funding allocation of payroll cost. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. DHS has incorporated into its internal controls a step to ensure that the accounts, in retrospect, are reconciled to the actual Flex earning report. DHS intends on meeting with the Department of Finance to identify the nuances that create postings to occur contrary to the Flex Earning Report account coding. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-064 Prior Year Finding Number: 2022-058 Compliance Requirement: Equipment and Real Property Management Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Head Start Cluster ALN: 93.356, 93.600 Award #: Various Award Period: Various Criteria – Real property, equipment, and intangible property, that are acquired or improved with a federal award must be held in trust by the nonfederal entity as trustee for the beneficiaries of the project or program under which the property was acquired or improved. The HHS awarding agency may require the nonfederal entity to record liens or other appropriate notices of record to indicate that personal or real property has been acquired or improved with a federal award and that use and disposition conditions apply to the property (45 CFR section 75.323 and 45 CFR section 1303 – Subpart E). Real property acquired or improved under a federal award must be used for the authorized purpose so long as it is needed for that purpose, during which time the HSA may not dispose of, replace or encumber the property without prior ACF approval (45 CFR section 75.318; 45 CFR section 75.308(c)(1)(xi)). Equipment acquired under a federal award must be used for the authorized purposes of the project during the period of performance, or until the property is no longer needed for the purposes of the project. A HSA may not dispose of, replace, or encumber title to equipment without prior ACF approval (45 CFR section 75.319; 45 CFR section 75.308(c)(1)(xi)). Property records must be maintained for equipment acquired under a federal award that include a description of the property, a serial number or other identification number, the source of funding for the property (including the FAIN), who holds title, the acquisition date, and cost of the property, percentage of federal participation in the project costs for the federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sale price of the property. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that nonfederal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – The Government’s Department of Property and Procurement (DPP) maintains the equipment register for DHS. DPP was unable to provide complete property records which met the stated requirements. Further, no physical inventory of equipment was taken in the previous two years. Further, internal controls were not operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with the specified requirements. Effect – There is a risk that inadequate recordkeeping of equipment could lead to misappropriation of assets and noncompliance with Federal regulations resulting in a return of Federal awards received. Cause – The Government does not appear to have a process in place to adequately monitor equipment acquired with Federal funds. Recommendation – We recommend that DHS and DPP improve internal controls to ensure adherence to Federal regulations related to equipment and its related maintenance. There should be timely coordination and communication amongst all Government departments and/or agencies that are responsible for handling and managing such assets. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. DHS will be onboarding dedicated staff for Head Start inventory. DHS will continue to collaborate with the Department of Property and Procurement to ensure compliance with Federal regulations regarding equipment and its maintenance. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-065 Prior Year Finding Number: 2022-059 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Head Start Cluster ALN: 93.356, 93.600 Award #: Various Award Period: Various Criteria – Each State or Territory must file various financial, programmatic, and special reports. Additionally, the requirements necessitate that all submitted reports should be supported by the underlying performance records and presented in accordance with program requirements. More specifically for the program, in accordance with the compliance supplement, the states and territories are required to submit to the Federal administering agency, the Administration for Children and Families (ACF), the SF-429 Real Property Status Report and SF-429 A General Reporting on an annual basis 90 days after the end of the reporting period and the SF-428, SF-428 B, and if needed, SF-428 S Tangible Personal Property Report at closeout 90 days after the grant closes. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that nonfederal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We sampled and selected 4 out of 14 special reports required to be submitted during the fiscal year and noted program personnel did not ensure 4 SF-429 reports were prepared and submitted to the federal grantor agency as prescribed. Further, internal controls were not operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with the specified requirements not using a statistically valid sample. Effect – DHS is not in compliance with the stated provisions. Failure to submit required reports could result in reduction or disallowance of Federal funding. Cause – It appears that policies and procedures, including oversight over submission of required reports were not functioning as intended. Recommendation – We recommend that DHS strengthen its process with respect to ensuring proper retention, monitoring, and review of the required reports by an appropriate official. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. Training was provided directly by the Federal Partner to ensure the completion of said reports. Additionally, the completion and submission of this report is being repositioned to the Fiscal Office. A review of these reports will be incorporated in the Quarterly standing meetings with the Office of Head Start and the Office of Fiscal Management. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-066 Prior Year Finding Number: 2022-060 Compliance Requirement: Special Test and Provision – Protection of Federal Interest in Real Property and Facilities Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Head Start Cluster ALN: 93.356, 93.600 Award #: Various Award Period: Various Criteria – Head Start uses specific terms related to real property and facilities, which are defined at 45 CFR section 1305.2, including construction, facility, federal interest, major renovation, and modular unit. Facilities activities (purchase, construction, major renovation, subordination of a federal interest, refinancing, and disposition) are initiated through the submission of Form SF429 (cover sheet) and applicable attachments B (Request to Acquire, Improve or Furnish) or C (Disposition or Encumbrance Request). With written prior approval from ACF, a HSA may use Head Start funds to purchase, construct, or renovate (major) a facility, including using Head Start funds to pay ongoing purchase costs which include principal and interest on approved loans (45 CFR sections 1303.40 through 1303.44). A HSA that uses Head Start funds to purchase real property or purchase, construct, or renovate (major) a facility appurtenant to real property (either owned or leased) must record a Notice of Federal Interest (also referred to as “reversionary interest”) (45 CFR sections 1303.46). The Notice of Federal Interest must include the required language content from 45 CFR section 1303.47(a) and be properly recorded in the official real property records for the jurisdiction where the facility is or will be located. A similar Notice of Federal Interest is required for leased facilities on land the HSA does not own (45 CFR section 1303.47(b)). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – Based on audit procedures performed, we identified 5 of 8 facilities with major repairs that did not have evidence of the required Notice of Federal Interest. Further, internal controls were not operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with the specified requirements. Effect – There is a risk that lack of compliance with the stated requirements can result in significant fiscal issues that may put the Head Start program they administer at risk along with loss of funding. Cause – DHS does not appear to have adequate policies and procedures in place to ensure compliance with protection of Federal interest in real property and facilities. Recommendation – We recommend that DHS strengthen and improve internal controls to ensure adherence to Federal regulations related to protection of Federal interest in real property and facilities. This includes incorporating the necessary internal controls to ensure the Notice of Federal Interest is obtained when required. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. Training was provided directly by the Federal Partner to ensure the completion of said reports. Additionally, the completion and submission of this report is being repositioned to the Fiscal Office. A review of these reports will be incorporated in the Quarterly standing meetings with the Office of Head Start and the Office of Fiscal Management.

Finding Number: 2023-067 Prior Year Finding Number: 2022-061 Compliance Requirement: Special Tests and Provisions – Program Governance Program: U.S. Department of Health and Human Services Government Department/Agency:Department of Human Services (DHS) Head Start Cluster ALN: 93.356, 93.600 Award #: Various Award Period: Various Criteria – A Head Start Agency (HAS) must share accurate and regular financial information with the governing body and the policy council, including monthly financial statements, including credit card expenditures and the financial audit (42 USC 9837(d)(2)(A) and (E)). Head Start governing body has a legal and fiscal responsibility for the HSA. The governing body’s responsibilities include approving financial management, accounting, and reporting policies, and compliance with laws and regulations related to financial statements, including the: - approval of all major financial expenditures of the agency; - annual approval of the operating budget of the agency; - selection (except when a financial auditor is assigned by the state under state law or is assigned under local law) of independent financial auditors; and - monitoring of the agency’s actions to correct any audit findings and of other action necessary to comply with applicable laws (including regulations) governing financial statement and accounting practices (42 USC 9837(c)(1)(E)(iv)(VII)(aa) through (dd)). The auditee has provided training and technical assistance to the governing body and policy council to support understanding of financial information provided to them and support effective oversight of the Head Start award (42 USC 9837(d)(3)). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – When evaluating DHS’ compliance with the above-mentioned compliance requirements, we found the following: - DHS was unable to validate that they provided training and technical assistance to the governance board during the fiscal period under review. - Financial information is not shared with the governing board monthly. We observed financial information being shared quarterly. - We found no discussion by the governing board relating to monitoring of DHS’ actions to correct audit findings. Further, internal controls were not operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with the specified requirements. Effect – There is a risk that lack of compliance with the stated requirements can result in significant fiscal issues that may put the Head Start program they administer at risk along with loss of funding. Cause – DHS does not appear to have adequate policies and procedures in place to ensure compliance with program governance. Recommendation – We recommend that DHS strengthen and improve internal controls to ensure adherence to Federal regulations related to program governance training and technical assistance to governing body and policy council. There should be regular training that will enable the governing body to perform it’s legal, fiscal, and oversight responsibilities. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. The Governing Board transitioned to virtual meetings due to the pandemic, which pre-empted the FY22 training, and has incorporated electronic voting into its procedures. Regular trainings are now conducted to enable the governing body to effectively perform its legal, fiscal, and oversight responsibilities. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-068 Prior Year Finding Number: 2022-064 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) CCDF Cluster ALN: 93.575, 93.489 Award #: Various Award Period: Various Criteria – DHS must have in place procedures for documenting and verifying eligibility in accordance with the Federal requirements, as well as the specific eligibility requirements selected by the Territory in its approved Plan. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – The CCDF program appears to have policies and procedures in place for eligibility determinations and childcare provider voucher preparation and distribution. However, DHS was unable to provide a complete listing of childcare provider voucher distributions that includes relevant information to test eligibility of recipients. As a result, it appears DHS did not perform a reconciliation of the benefits paid to eligible participants and the expenditures recorded in the general ledger. Further, internal controls were not operating at a level of precision to ensure compliance with the eligibility compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’s compliance with the specified requirements and general compliance principles. Approximately $1.0 million was expended for child care vouchers. Effect – Noncompliance with program requirements could result in disallowances of costs and program participants could be receiving benefits that they are not entitled to receive. Cause – It appears that policies and procedures, including review over eligibility transactions, were not functioning as intended. Recommendation - We recommend that DHS reevaluate its policies and procedures to ensure proper monitoring and continue to be vigilant in following internal procedures over reviews and authorizations. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The Department of Human Services (DHS) has introduced a checklist as an additional internal control measure to ensure compliance with Federal requirements for review of provider enrollment applications by the provider relations staff. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-069 Prior Year Finding Number: 2022-065 Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) CCDF Cluster ALN: 93.575, 93.489 Award #: Various Award Period: Various Criteria – The annual appropriations law for CCDF Discretionary Funds (Assistance Listing 93.575), the CARES Act (Pub. L. No. 116-136), and the CRRSA Act (Pub. L. No. 116-260) all specify that funds shall be used to supplement, not supplant State general revenue funds for child care assistance for low-income families. Funds appropriated by the ARP Act (Pub. L. No. 117-2) shall be used to supplement and not supplant other federal, state, and local public funds expended to provide child care services for eligible individuals. In accordance with the Compliance Supplement, the State or Territory: - May not spend on administrative costs more than five percent of total CCDF awards expended (i.e., the total of Assistance Listings 93.575, 93.596, and 93.489 with the exception of any ARP Act stabilization funds and of any Disaster Relief funds spent on construction and renovation) and any state expenditures for which Matching Funds (Assistance Listing 93.596) are claimed (42 USC 9858c(c)(3)(C); Pub. L. no. 116-20; CFR section 98.52). - Quality Earmark – For FY 2020 and succeeding fiscal years, states and territory Lead Agencies must spend on quality activities, as provided in the state/territorial plan, not less than nine percent of CCDF funds expended (i.e. the total of Assistance Listing 93.575, 93.596, and 93.489 with the exception of any CARES Act, CRRSA Act, and ARP Act, and of any Disaster Relief funds spent on construction and renovation) and any state expenditures for which Matching Funds (Assistance Listing 93.596) are claimed (45 CFR section 98.53). States and territory Lead Agencies must spend at least an additional three percent on quality improvement for infants and toddlers (45 CFR section 98.50(b)). - Direct Spending Earmarks - (1) From the aggregate amount of Discretionary funds (Assistance Listing 93.575) and Disaster Relief funds (Assistance Listing 93.489) provided for a year (with the exception of any CARES Act, CRRSA Act, and ARP Act, and of any Disaster Relief funds used for construction or major renovation), state Lead Agencies, territory Lead Agencies, as well as those tribal Lead Agencies with allocations of at least $250,000 must reserve funds for administrative costs (described above) and the minimum amount required for quality activities (described above). (2) From the remainder, the Lead Agency must use not less than 70 percent to fund direct services. In addition, states and territories must spend not less than 70 percent of the Mandatory and federal and state share of Matching funds (Assistance Listing 93.596) to provide child care assistance to families who: (a) receive Temporary Assistance for Needy Families (TANF); (b) are attempting through work activities to transition of TANF; and (c) are at risk of becoming dependent on TANF (45 CFR section 98.50(e) and (f)). Direct spending requirements do not apply to supplemental funds provided by the CARES Act (Pub. L. No. 116-136), the CRRSA Act (Pub. L. No. 116-260) and the ARP Act (Pub. L. No. 11702). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We discussed with management the process to ensure compliance with the level of effort requirement noting they do not appear to have adequate policies and procedures to monitor and ensure compliance with level of effort requirements. In addition, for one project that ended during the fiscal year, management was unable to provide a final ACF-696 Financial Reporting Form for State and Territory Child Care and Development Fund (CCDF) Lead Agencies that reconciled to accounting records. As such we are unable to determine if the Administrative, Quality and Direct Spending earmarks for this project have been met. Further, internal controls were not operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’s compliance with the specified requirements. Effect – DHS is not in compliance with the stated provisions. Cause – DHS does not appear to have adequate policies and procedures in place to ensure a consistent and systematic monitoring of the requirements. Recommendation - We recommend that DHS deploy resources that are given the responsibility to ensure periodic monitoring and compliance of the requirements throughout the fiscal year. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. DHS acknowledges the need to strengthen policies, procedures, and monitoring controls to ensure consistent compliance with the Child Care and Development Fund (CCDF) matching, level of effort, and earmarking requirements, as well as to ensure that final financial reporting fully reconciles to accounting records. DHS also emphasizes maintaining internal controls to support timely, accurate federal reporting. While the Child Care program does not require local matching funds, DHS will include the GVI-approved spending plan (in addition to ERP budget journals) with audit submissions so auditors can readily confirm any applicable matching requirements. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-070 Prior Year Finding Number: 2022-067 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) CCDF Cluster ALN: 93.575, 93.489 Award #: Various Award Period: Various Criteria – Pursuant to CCDF regulations at 45 CFR 98.65(g), and as part of the terms and conditions of the grant award, States and Territories are required to complete and submit a quarterly financial status report (ACF-696). The form must be submitted quarterly (reports are due 30 days after the end of the quarter). States must submit quarterly reports for each federal fiscal year until all funds are expended or when the liquidation period expires. Since CCDF funds are awarded each federal fiscal year, a Lead Agency might submit multiple separate quarterly ACF-696 forms for multiple overlapping grant award years simultaneously. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We sampled and selected 9 reports of 31 reports expected to be filed during the fiscal year. During our testing, we found the following: - 8 financial reports had not been submitted in a timely manner, ranging from 95 to 399 days late. - 1 financial report that did not appear to be submitted as required. - 8 financial reports where we could not determine if the amounts reported were complete and accurate. Further, internal controls were not operating at a level of precision to ensure compliance with the reporting compliance requirement. Questioned Costs – None. Context – This is a condition identified per review of DHS’s compliance with the specified requirements using a statistically valid sample. Effect – DHS is not in compliance with stated provisions and inaccurate information may have been reported to the Federal government. Cause – It appears that policies and procedures, including review over reporting procedures were not functioning as intended. Further, DHS does not have adequate control over maintenance of the underlying documentation used in preparing various reports. Recommendation – We recommend that DHS reevaluate its policies and procedures to ensure proper retention, monitoring, and review of the required reports by an appropriate official who would ensure that information submitted is complete, accurate, consistent and submitted within the required timeframe. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. A Federal Grants Financial Analyst for CCDF program has been hired and is tasked with ensuring the accuracy and submission of financial reports. Internal controls have been established, requiring final review and approval by a supervisor. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-071 Prior Year Finding Number: 2022-068 Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) CCDF Cluster ALN: 93.575, 93.489 Award #: Various Award Period: Various Criteria – As part of their CCDF plans, Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address 11 specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that nonfederal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We sampled and selected 9 of 66 child care providers and noted no evidence of monitoring of the child care service providers for applicable minimum health and safety requirements. Further, internal controls were not operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’s compliance with the specified requirements using a statistically valid sample. The total amount of child care expenditures charged to the program were $1,020,396. Total amount sampled is $315,509. Effect – DHS in not in compliance with the stated provisions. Noncompliance with program requirements could result in disallowances of costs and ineligible providers could be participating in the program. Cause – DHS does not appear to have adequate policies and procedures in place to ensure consistent and systematic monitoring of requirements. Recommendation – We recommend that DHS deploy resources that are given the responsibility to ensure periodic monitoring and compliance of the health and safety requirements are documented throughout the fiscal year. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. DHS remains in compliance with this finding from previous audit years, the untimely submission led to the issue in current year. To address this, a shared file will be established to ensure that the necessary information for each year is readily available for audit purposes. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-072 Prior Year Finding Number: 2022-069 Compliance Requirement: Special Tests and Provisions – Fraud Detection and Repayment Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) CCDF Cluster ALN: 93.575, 93.489 Award #: Various Award Period: Various Criteria – Lead Agencies shall recover childcare payments that are the result of fraud. These payments shall be recovered from the party responsible for committing the fraud (45 CFR section 98.60). The Lead Agency must correctly identify and report fraud and take steps to recover payment. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – While DHS has a procedure for identifying and recovering payments resulting from fraud, via its internal audit process, it was unable to evidence that such audit(s) had been conducted during the fiscal year. Further, internal controls were not operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’s compliance with the specified requirements. Effect – There may be prolonged, ongoing cases of unnecessary utilization and fraud that may be unnoticed and remain unreported by the program. Funds available are possibly being used inappropriately. Cause – DHS does not appear to have adequate policies and procedures in place to ensure consistent and systematic monitoring of requirements. Recommendation – We recommend that DHS deploy resources that are given the responsibility to ensure periodic monitoring and compliance with fraud detection and repayment requirements throughout the fiscal year. DHS should also review its records retention policies to ensure that complete documentation is maintained, safeguarded, and available for review. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. DHS is in the process of developing an internal audit and compliance unit. With the requisite staffing, internal audits will be conducted to ensure alignment with the Federal mandates in addition to ensuring overall compliance. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-073 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Child Care Provider Eligibility for ARP Act Stabilization Funds Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) CCDF Cluster ALN: 93.575, 93.489 Award #: Various Award Period: Various Criteria – To be qualified to receive ARP Act stabilization funds, a provider on the date of application for the award must either be: (1) open and available to provide child care services, or (2) closed due to public health, financial hardship, or other reasons relating to the COVID-19 public health emergency. In addition, the provider must either (1) be eligible to serve children who receive CCDF subsidies at the time of application for stabilization funds, or (2) be licensed, regulated, or registered in the state, territory, or tribe as of March 11, 2021 and meet applicable state and local health and safety requirements at the time of application for stabilization funds. In their application for stabilization funds, a child care provider must certify: a. That the provider will, when open and providing services, implement policies in line with guidance and orders from corresponding state, territorial, tribal, and local authorities and, to the greatest extent possible, implement policies in line with guidance from the CDC. b. For each employee, the provider must pay at least the same amount in weekly wages and maintain the same benefits for the duration of the stabilization funding. c. The provider will provide relief from copayments and tuition payments for the families enrolled in the provider’s program, to the extent possible, and prioritize such relief for families struggling to make either type of payment. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We selected a sample of 10 of 45 child care providers that received ARP Act stabilization funds. During our testing, were not provided evidence to substantiate that the child care providers selected for testing were eligible to receive ARP Act stabilization funds. Further, internal controls were not operating effectively to ensure compliance with the compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’s compliance with the specified requirements using a statistically valid sample. The total amount of ARP Act stabilization expenditures charged to the program were $14,833,930. Total amount sampled is $4,572,894. Effect – DHS in not in compliance with the stated provisions. Noncompliance with program requirements could result in disallowances of costs and ineligible providers could be participating in the program. Cause – DHS does not appear to have adequate policies and procedures in place to ensure consistent and systematic monitoring of requirements. Recommendation – We recommend that DHS deploy resources that are given the responsibility to ensure periodic monitoring and compliance of the ARP Act stabilization provider eligibility requirements throughout the fiscal year. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. DHS is in the process of developing an internal audit and compliance unit. With the requisite staffing, internal audits will be conducted to ensure alignment with the Federal mandates in addition to ensuring overall compliance. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-074 Prior Year Finding Number: 2022-071 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Social Services Block Grant ALN: 93.667 Award #: Various Award Period: Various Criteria – CFR 200.403(g) states that for costs to be allowed under federal awards, they must be adequately documented. Additionally, salaries and wages charged to Federal awards are subject to the standards of documentation as described by 2 CFR Section 200.430(i) and must be based on records that accurately reflect the work performed. These records must: - Be incorporated into the organization’s official records. - Reasonably reflect the total activity for which the employee is compensated across all grant-related and non-grant related activities (100%); and - Support the distribution of employee salary across multiple activities or cost objectives. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Condition – We sampled and selected 60 of 1,380 payroll transactions and noted the following: - 2 instances in which the project code on an employee’s Notice of Personnel Action (NOPA), which is used to record time and effort to the appropriate grant, was expired and had not been updated. During the fiscal year, program personnel did make adjustments to ensure the employee’s time and effort was recorded to the correct grant. - 1 instance in which the hours noted per the employee’s timesheet did not agree to the hours in the payroll register. We also sampled 60 of 251 non-payroll transactions and noted the following: - 18 expenditures that do not seem to conform to DHS requirements for disbursing program funds. - 6 instances where the approved requisition was not available for review. - 1 instance where the invoice date is prior to the date of the Purchase Order. - 1 instance where no supporting documentation was available for review other than the approved requisition. Questioned Costs – Not determinable. Context – This is a condition identified per review of compliance with the specified requirements using a statistically valid sample. Total amount of payroll expenditures charged to the program in fiscal year 2023 were $3,343,590. Total amount sampled is $180,273. The known amount of the exceptions is $408. Total amount of non-payroll expenditures charged to the program in fiscal year 2023 were $2,551,775. Total amount sampled is $1,004,88. The known amount of the exception is $388,742. Effect - Failure to properly review and support expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – DHS does not appear to have adequate policies and procedures in place to ensure compliance with applicable cost principles and maintenance of underlying documentation. Recommendation – We recommend that DHS improve internal controls to ensure adherence to federal regulations related to the fiscal and administrative requirements for expending and accounting for payroll and non-payroll expenditures. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. The Department of Human Services (DHS) adopted the electronic Timeforce (STATS) system for payroll, replacing manual processes. Time and attendance are approved through management levels, with payroll based on Notice of Personnel Action (NOPA) cost centers. Financial Analysts reconcile payroll, and a workflow ensures accurate NOPA listings for payroll purposes. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-075 Prior Year Finding Number: 2022-072 Compliance Requirement: Period of Performance Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Social Services Block Grant ALN: 93.667 Award #: Various Award Period: Various Criteria – A Non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance and any costs incurred before the Federal awarding agency or pass-through entity made the Federal award, only to the extent that they would have been allowable if incurred after the date of the Federal award and only with the written approval of the Federal awarding agency. Additionally, the Uniform Guidance in 2 CFR Section 200.344(b), states that unless the federal awarding agency or pass-through entity authorized an extension, a non-Federal entity must liquidate all financial obligations incurred under the Federal award not later than 120 calendar days after the end date of the period of performance as specified in the terms and conditions of the Federal award. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Condition - We sampled and selected 10 out of 91 expenditures recorded during the grant’s liquidation period. We found 6 expenditures that were charged to the grant during the liquidation period and incurred outside the period of availability. Such expenditures totaled $7,081. Additionally, internal controls do not appear to be operating at a level of precision to ensure grant expenditures are charged to the correct grant and within the allowable period of performance. Questioned Costs – $7,081. Context – This is a condition identified per review of DHS’ compliance with the specified requirements using a statistically valid sample. Total amount of expenditures subject to sampling were $56,385. Total amount sampled is $12,211. Effect - DHS is not in compliance with the stated provisions. Failure to properly review and support expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – DHS does not appear to have adequate policies and procedures in place to ensure compliance with the required period of performance stipulations. Recommendation – We recommend that DHS strengthen its process with respect to charging expenditures between various grant awards. We also recommend that DHS enhance its review process to properly determine the activities of each grant relative to the appropriate period of performance. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. As part of the close-out process, all open purchase orders are now submitted to the Department of Finance for closure. The grant close-out process has been shifted to the OMB to ensure the grant is no longer available for transaction entries or liquidations. Additionally, a dedicated Fiscal Analyst is being integrated into the workflow to ensure compliance. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-076 Prior Year Finding Number: 2022-073 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Social Services Block Grant ALN: 93.667 Award #: Various Award Period: Various Criteria – Each State or Territory must file various financial, programmatic, and special reports. Additionally, the requirements necessitate that all submitted reports should be supported by the underlying performance records and presented in accordance with program requirements. More specifically for the program, in accordance with the compliance Supplement, the states and territories are required to submit to the Federal administering agency, the Office of Community Services (OCS), SF-425 ‘Federal Financial Report’ and an annual ‘Post Expenditure Report’ (42 USC 1397e) no later than six months following the close of the fiscal year. Further, in accordance with OCS SSBG Supplemental Terms and Conditions, SSBG is required to submit an interim and final SF- 425 report covering Year 1 and the entire 2-year of the project period, 90 days following Year 1 (FFY 1) and 90 days following the end of Year 2 (FFY 2), respectively. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Condition - We sampled and selected 2 out of 4 financial (SF-425) and special (Post-Expenditure) reports and noted the following: - 1 financial report was not available for review. - For 1 special report, we noted no evidence of the date the report was prepared, reviewed, and submitted to the Federal grantor. Additionally, we were not able to agree the key line item of the report to the underlying records. Additionally, internal controls do not appear to be operating at a level of precision to ensure federal reports are prepared accurately, reviewed and submitted timely, and maintained for inspection. Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with the specified requirements using a statistically valid sample. Effect - DHS is not in compliance with the stated provisions. Failure to submit required reports could result in reduction or disallowance of Federal funding. Cause – It appears that policies and procedures, including oversight over submission of required reports were not functioning as intended. Recommendation – We recommend that DHS strengthen its process with respect to ensuring proper retention, monitoring, and review of the required reports by an appropriate official. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. Currently, there is a collaboration with Federal Partners to consolidate reporting in the Payment Management System portal, as there is no single report for the SSBG as required. Report requests are currently inconsistent with one consolidated grant. Additionally, pre and post expenditures are submitted through the portal, accompanied by a submission log. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-077 Prior Year Finding Number: N/A Compliance Requirement: Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Medicaid Cluster ALN: 93.775, 93.778 Award #: 75X0512 Award Period: 10/01/2015 – 09/30/2023 Children’s Health Insurance Program ALN: 93.767 Award #: 2205VQ5021 Award Period: 10/01/2021 – 09/30/2023 Criteria – Federal funds can be used only for Medicaid and CHIP benefit payments (as specified in the state plan, federal regulations, or an approved waiver/demonstration), expenditures for administration and training, expenditures for the State Survey and Certification Program, and expenditures for the establishment and operation of state MFCUs (42 CFR 435.10, 440.210, 440.220, and 440.180). Payments may only be made to providers determined by the SMA to be eligible to participate in the Medicaid program. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (1.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Condition – DHS was unable to provide a reconciliation of claims paid between the Medicaid Management Information System (MMIS) and the general ledger, which is used to prepare the Schedule of Expenditures of Federal Awards (SEFA). Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the allowable costs/cost principles compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with the specified requirements and general compliance principles. Effect – DHS is not in compliance with the stated provisions. Failure to properly review and report expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – DHS does not appear to have adequate policies and procedures in place to ensure compliance with stated provisions. Recommendation – We recommend that DHS deploy resources that are given the responsibility to ensure monitoring and compliance of stated requirement throughout the fiscal year. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. DHS will strengthen internal controls by implementing clearer, auditable reconciliation processes to support SEFA preparation and demonstrate compliance. DHS will continue coordinating with auditors and stakeholders to ensure required documentation is received and compliance can be readily determined. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-078 Prior Year Finding Number: 2022-075 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Medicaid Cluster ALN: 93.775, 93.778 Award #: 75X0512 Award Period: 10/01/2015 – 09/30/2023 Children’s Health Insurance Program ALN: 93.767 Award #: 2205VQ5021 Award Period: 10/01/2021 – 09/30/2023 Criteria – Plan and eligibility requirements must comply with various Federal requirements. The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-Federal entities receiving Federal awards (i.e. auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Additionally, in accordance with the State Plan under Title XIX of the Social Security Act, Section 4.7, Maintenance of Records, the Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provisions of medical assistance, and administrative costs, statistical, fiscal and other records necessary for reporting and accountability. Condition – In our review of 60 out of 34,534 participant case files, we noted 29 instances where there was no documentation to support the eligibility determinations made. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with the specified requirements using a statistically valid sample. Effect – Noncompliance with program requirements could result in disallowances of costs and program participants could be receiving benefits that they are not entitled to receive. Cause – DHS does not appear to have adequate policies and procedures in place to ensure a consistent and systematic review and maintenance of the data in its participant case files. Recommendation – We recommend that DHS perform regular reviews of the data in its participant case files to ensure accuracy and completeness and confirming that only eligible participants are receiving the entitled benefits. Additional levels of review by a supervisor or manager can provide more timely quality assurance oversight over the eligibility process. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. Currently, a Standard Operating Policies and Procedures (SOPPs) for certification and recertification procedures is being updated. Additionally, DHS hired a Program Integrity Director in August 2023 and Medical Eligibility Quality Control (MEQC) Reviewer in June 2025 also tasked with the responsibility of reviewing completed case files. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-079 Prior Year Finding Number: N/A Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Medicaid Cluster ALN: 93.775, 93.778 Award #: 75X0512 Award Period: 10/01/2015 – 09/30/2023 Children’s Health Insurance Program ALN: 93.767 Award #: 2205VQ5021 Award Period: 10/01/2021 – 09/30/2023 Criteria – The state is required to pay part of the costs of providing Medicaid and CHIP services and part of the costs of administering the program. The percentage of federal funding is determined based on the amount of the expenditure and the application of the FMAP that is determined for each state using a formula set forth in section 1905(b) of the Act (42 USC 1396d), or other applicable federal matching rates specified by the statute. In particular, the matching rates for states’ administrative expenditures authorized by the Act are found in section 1903(a) of the Act (42 USC 1396b). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (1.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Condition – DHS was unable to readily exhibit and provide its computation of the matching calculation or provide evidence that it was monitoring compliance with said requirement. Therefore, we were unable to determine if the matching requirement has been met. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the allowable costs/cost principles and matching compliance requirements. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with the specified requirements and general compliance principles. Effect – DHS is not in compliance with the stated provisions. Failure to properly review and report expenditures can result in noncompliance with laws and regulations along with loss of funding. Cause – DHS does not appear to have adequate policies and procedures in place to ensure compliance with stated provisions. Recommendation – We recommend that DHS deploy resources that are given the responsibility to ensure monitoring and compliance of stated requirement throughout the fiscal year. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-080 Prior Year Finding Number: 2022-076 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Medicaid Cluster ALN: 93.775, 93.778 Award #: 75X0512 Award Period: 10/01/2015 – 09/30/2023 Children’s Health Insurance Program ALN: 93.767 Award #: 2205VQ5021 Award Period: 10/01/2021 – 09/30/2023 Criteria – Each State or Territory must file various financial, programmatic, and special reports. Additionally, the requirements necessitate that all submitted reports should be supported by the underlying performance records and presented in accordance with program requirements. In accordance with the Compliance Supplement, the State or Territory is required to submit CMS-64, Quarterly Statement of Expenditures for the Medicaid Assistance Program, thirty days after the end of the quarter. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non- Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We reviewed 2 out of the 4 quarterly CMS-64 reports submitted during the fiscal year and noted the reports did not contain evidence of review or approval. Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with the specified requirements using a statistically valid sample. Effect – DHS is not in compliance with stated provisions and inaccurate information may have been reported to the Federal government. Cause – It appears that policies and procedures, including review over reporting procedures were not functioning as intended. Recommendation – We recommend that DHS reevaluate its policies and procedures to ensure proper monitoring and review of the required reports by an appropriate official who would ensure the information submitted is complete, accurate, consistent, and submitted within the required timeframe. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. To ensure access for audit purposes, the Department has implemented a shared folder where copies of approval emails and any time extension requests are stored, since the submission portal does not allow for attachments. Additionally, a Director of Federal Grants has been on-boarded who will assume the role of preparing the reports. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-081 Prior Year Finding Number: 2022-077 Compliance Requirement: Special Tests and Provisions - Utilization Control and Program Integrity Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Medicaid Cluster ALN: 93.775, 93.778 Award #: 75X0512 Award Period: 10/01/2015 – 09/30/2023 Criteria – The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services. In addition, the state must have (1) methods of determining criteria for identifying suspected fraud cases; (2) methods for investigating these cases; and (3) procedures, developed in cooperation with legal authorities, for referring credible allegations of fraud cases to law enforcement officials (42 CFR parts 455, 456, and 1002). Credible allegations of provider fraud must be referred to the state MFCU or an appropriate law enforcement agency in states with no certified MFCU (42 CFR Part 455.21). The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity (42 CFR 456.5, 456.22 and 456.23). In addition, the SMA as required per Section 1902(a)(68) – [42 USC 1396a(a)(68)] False Claims Education must ensure that providers and contractors receiving or making payments of at least $5 million annually under a state’s Medicaid program have (a) established written policies for all employees (including management) about the Federal False Claims Act, whistleblower protections, administrative remedies, and any pertinent state laws and rules; (b) included as part of these policies detailed provisions regarding detecting and preventing fraud, waste, and abuse; and (c) included in any employee handbook a discussion of the False Claims Act, whistleblower protections, administrative remedies, and pertinent state laws and rules. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non- Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – Upon investigation, DHS was not able to provide evidence of compliance with the above referenced compliance requirements. Specifically, we found the following: - No evidence of a method of determining criteria for identifying suspected fraud cases. - No evidence of a method for investigating these cases. - No evidence of procedures, developed in cooperation with legal authorities, for referring credible allegations of fraud cases to law enforcement officials. Further, we noted DHS had not provided evidence of established and used written criteria for evaluating the appropriateness and quality of Medicaid services, including procedures for the ongoing post-payment review. Additionally, DHS did not provide evidence they ensure that providers and contractors receiving or making payments of at least $5 million annually under a state’s Medicaid program have (a) established written policies for all employees (including management) about the Federal False Claims Act, whistleblower protections, administrative remedies, and any pertinent state laws and rules; (b) included as part of these policies detailed provisions regarding detecting and preventing fraud, waste, and abuse; and (c) included in any employee handbook a discussion of the False Claims Act, whistleblower protections, administrative remedies, and pertinent state laws and rules. Finally, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with the specified requirements. Effect – There may be prolonged, ongoing cases of unnecessary utilization and fraud which may be unnoticed and remain unreported by the program. Funds available are possibly being used inappropriately, with no methodology of properly identifying or tracking the amounts. Cause – DHS does not appear to have an effective system in place to address the program’s requirements. Recommendation – DHS should reconsider whether it would like to be directly responsible for Utilization Control and Program Integrity, or if the use of a QIO would better suit current needs. Once this is decided, DHS should take the necessary steps to ensure compliance with this requirement. The written procedures should reflect the actual actions to be taken. In the event a QIO is used, DHS should be involved throughout, so that it is aware of the program’s vulnerabilities and has the opportunity to make the necessary changes for improvement in a timely manner. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. The Program Integrity Unit has established SOPPs which identifies the method for identifying fraud cases, investigating cases, and developed procedures in collaborating and cooperating with legal authorities, for referring credible allegations of fraud cases to law enforcement officials. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-082 Prior Year Finding Number: 2022-078 Compliance Requirement: Special Tests and Provisions - Inpatient Hospital and Long-Term Care Facility Audits Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Medicaid Cluster ALN: 93.775, 93.778 Award #: 75X0512 Award Period: 10/01/2015 – 09/30/2023 Criteria – The SMA pays for inpatient hospital services and long-term care facility services through the use of rates that are economic and efficient and are in accordance with the state plan. To the extent the state pays reconciled costs, the SMA must provide for the filing of uniform cost reports for each participating provider in order to establish payment rates. The SMA must provide for the periodic audits of financial and statistical records of participating providers. The specific audit requirements will be established by the state plan (42 CFR 447.253). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non- Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – DHS provides Medicaid services to eligible Territory residents through inpatient hospitals and long-term care facilities. These hospitals and facilities include various Territory agencies and third-party service providers. The costs incurred by these facilities are summarized in a cost report that is submitted to DHS. DHS awarded a contract in August 2017 for the audit of these cost reports; however, we noted that DHS had not received any audited cost reports for fiscal year 2023. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs - None. Context – This is a condition identified per review of DHS’ compliance with the specified requirements. Effect – Without timely audits of the cost reports, DHS has no assurance that the costs incurred by the medical facilities are actual costs incurred. Further, the difference between costs submitted for reimbursement and the costs actually reimbursed result in the use of local, rather than Federal, dollars to fund Medicaid expenditures. Cause – DHS does not appear to have adequate policies and procedures in place for the provision of audited cost reports of its participating providers. Recommendation – We recommend that DHS evaluate and develop policies and procedures to obtain and audit the cost reports. This will allow DHS to reduce the time between the Medicaid expenditures being incurred and the ultimate reimbursement from the Federal government. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. The Department of Human Services intends to shift the responsibility of Cost Reports internally to the Fiscal Office, under the supervision of Director of Audit and Compliance. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-083 Prior Year Finding Number: 2022-079 Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Medicaid Cluster ALN: 93.775, 93.778 Award #: 75X0512 Award Period: 10/01/2015 – 09/30/2023 Criteria – SMAs must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the ADP system security installations involved in the administration of HHS programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR 95.621). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non- Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – DHS performed two ADP Risk Analysis and System Security Reviews for the systems that support the Medicaid Programs. A SOC1, Type 2 review was performed over the MMIS system covering the period October 1, 2022 through September 30, 2023 as well as a Cybersecurity review released in September 2024. Both reviews were performed by third-party organizations. Upon review of the reports, we noted the following: - The SOC1, Type 2 contained a qualified opinion stating that controls were not operating effectively to prevent unauthorized changes to the application and supporting infrastructure. - They Cybersecurity review was performed outside of fiscal year 2023. Additionally, the conclusion reached noted several critical vulnerabilities that need immediate attention. We did not note any analysis performed by DHS to assess the risk of the opinion qualification over their internal control environment nor the steps being taken to remedy the critical vulnerabilities noted in the Cybersecurity review. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs - None. Context – This is a condition identified per review of DHS’ compliance with the specified requirements. Effect - The absence of policies to ensure these analyses and reviews are performed may lead to physical and data security issues and noncompliance with program requirements. Further, DHS’ risk of incomplete or inaccurate data processing, or worse, the risk of fraud, increases. Cause – DHS’ records do not permit a determination as to the sufficiency of the design and operation of key controls surrounding the environment in which the Medicaid claims reside. Recommendation - We recommend that management should perform and review a risk analysis and system security review for all systems that support the Medicaid program. All issues should be addressed by management. If management becomes aware that such a report will not be available, we recommend that management conduct its own review. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. DHS has conducted an overall cybersecurity risk assessment for entire IT infrastructure. The strategy to become compliant with the VIBES System Security Review includes updating the scope of work with contracted vendor for this system. The scope of work will now include annual Risk Assessments and Security Reviews. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-084 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Provider Eligibility Program: U.S. Department of Health and Human Services Government Department/Agency: Department of Human Services (DHS) Medicaid Cluster ALN: 93.775, 93.778 Award #: 75X0512 Award Period: 10/01/2015 – 09/30/2023 Children’s Health Insurance Program ALN: 93.767 Award #: 2205VQ5021 Award Period: 10/01/2021 – 09/30/2023 Criteria – Medicaid – In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. Providers who have been barred from participation by the OIG exclusion list are not eligible to be enrolled in the Medicaid program (see 42 CFR 455.436). CHIP – In order to receive CHIP payments, CHIP providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the CHIP program (42 CFR 457.900); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR 457.990(a), cross referencing 455.107). CHIP managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. Guidance was provided to states in the Medicaid Provider Enrollment Compendium (MPEC) to enroll CHIP providers into their Medicaid programs to ensure that they meet federal requirements. Providers who have been barred from participation by the OIG exclusion list are not eligible to be enrolled in the CHIP program (42 CFR 457.990, 42 CFR 455 Subpart E). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non- Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We sampled 20 of 194 providers that provided Medicaid and CHIP services during fiscal year 2023. DHS was unable to provide documentation that the providers selected were: - screened, licensed, and enrolled in accordance with the state plan and the requirement of 42 CFR 455 Subpart E. - comply with the requirements of the state plan, including the disclosure requirement of 42 CFR 455 Subpart B. - comply with the requirements of the state plan, including the disclosure requirements of 42 CFR 455 Subpart B and Section 1.4 of the MPEC. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the compliance requirement. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with the specified requirements using a statistically valid sample. Effect – DHS is not in compliance with the stated provisions. Noncompliance with program requirements could result in disallowances of cous and ineligible providers could be participating in the program. Cause – DHS does not appear to have adequate policies and procedures in place to ensure documentation is maintained and available to be inspected. Recommendation - We recommend that DHS implement policies and procedures to ensure provider enrollment documentation is maintained and available for inspection. Views of Responsible Officials - The Government concurs with the auditor’s findings and recommendations. DHS continues working with a vendor on the implementation of the Provider Enrollment Application (PEA). Beginning in February 2026, the vendor will assume responsibility for enrolling all USVI providers—both in-territory and out-of-territory. Their enrollment process will address the three bulleted conditions. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-085 Prior Year Finding Number: 2022-081 Compliance Requirement: Reporting Program: U.S. Department of Homeland Security Government Department/Agency: Virgin Islands Territorial Emergency Management Agency (VITEMA) Disaster Grants - Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Award#: FEMA-4335-DR, FEMA-4340-DR-VI, FEMA-4513-DR Award Periods: 09/20/2017 – 09/07/2026 09/07/2017 – 09/16/2025 04/02/2020 – 05/11/2023 Criteria – Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We selected 11 projects with first-tier subawards greater than $30,000 and found that internal controls over compliance with FFATA reporting provisions had not been implemented. Questioned Costs – None. Context – This is a condition identified per review of VITEMA’s compliance with the specified requirements using a statistically valid sample. Effect – Lack of internal controls over compliance may lead to material noncompliance with stated provision. Cause – It appears that policies and procedures, including review over reporting procedures, were not functioning as intended. Recommendation – We recommend that VITEMA reevaluate its policies and procedures to ensure proper review of the required reports by an appropriate official who would ensure that information submitted is complete, accurate, consistent and submitted within the required timeframe. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. A formalized process for the preparation and submission of financial and performance reports is now established, with clearly defined roles and responsibilities. The Disaster Program Financial Specialist is tasked with preparing the reports quarterly and submitting them to the Territorial Public Assistance Officer for review. The reports and associated certifications will be placed in a centralized database. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-086 Prior Year Finding Number: 2022-082 Compliance Requirement: Subrecipient Monitoring Program: U.S. Department of Homeland Security Government Department/Agency: Virgin Islands Territorial Emergency Management Agency (VITEMA) Disaster Grants - Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Award#: FEMA-4335-DR, FEMA-4340-DR-VI, FEMA-4513-DR Award Periods: 09/20/2017 – 09/07/2026 09/07/2017 – 09/16/2025 04/02/2020 – 05/11/2023 Criteria – A pass-through entity (PTE) must: Identify the Award and Applicable Requirements – Clearly identify to the subrecipient: 1. The award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR section 200.331(a)(1); 2. All requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); 3. Any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR section 200.331(a)(3)). Evaluate Risk – Evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward (2 CFR section 200.332(b)). This evaluation of risk may include consideration of such factors as the following: 1. The subrecipient’s prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives single audit in accordance with 2 CFR Part 200, Subpart F, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of federal awarding agency monitoring (e.g., if the subrecipient also receives federal awards directly from a federal awarding agency). Monitor – Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals (2 CFR sections 200.332(d) through (f)). In addition to procedures identified as necessary based upon the evaluation of subrecipient risk or specifically required by the terms and conditions of the award, subaward monitoring must include the following: 1. Reviewing financial and programmatic (performance and special reports) required by the PTE. 2. Following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the federal award provided to the subrecipient from the PTE detected through audits, on-site reviews, and other means. 3. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient from the PTE as required by 2 CFR section 200.521. Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We selected 8 of 27 subrecipients and found the following: - 4 instances where we were unable to obtain subrecipient agreements. - 8 instances with no supporting documentation that VITEMA verified that subrecipients expected to be audited as required by 2 CFR part 200, subpart F. Further, it does not appear that the controls in place are operating at a level of precision to ensure compliance with the subrecipient monitoring compliance requirements or proper identification of subrecipients. Questioned Costs – None. Context – This is a condition identified per review of VITEMA’s compliance with the specified requirements using a statistically valid sample. The total amount of expenditures passed through to subrecipients in fiscal year 2023 was $134,242,935. The total amount of our sample totaled $124,398,401. Effect – VITEMA is not in compliance with the stated provisions. Failure to properly identify and monitor subrecipients can result in noncompliance with laws and regulations and failure to meet the program's objectives. Cause – VITEMA does not have internal controls in place to properly identify and monitor subrecipients to ensure adherence to applicable federal regulations, including expending federal awards for allowable expenditures. Recommendation – We recommend that VITEMA implement policies, procedures, and controls to ensure subrecipients are identified and monitored in accordance with federal statutes. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. The formal process for completing and retaining Subrecipient Agreements is now operational to ensure compliance with programmatic obligations. As the Recipient, the Territory is responsible for notifying the Subrecipient when federal funds are obligated and providing them with a subrecipient agreement outlining the program's terms and conditions. The Disaster Program Financial Specialist is responsible for ensuring that the subrecipient agreement is signed by both the Applicant and the Governor's Authorized Representative and provided to the Territorial Public Assistance Officer. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-087 Prior Year Finding Number: N/A Compliance Requirement: Matching, Level of Effort, Earmarking Program: U.S. Department of Homeland Security Government Department/Agency: Virgin Islands Territorial Emergency Management Agency (VITEMA) Homeland Security Grant Program ALN: 97.067 Award#: Various Award Periods: Various Criteria – The Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires the non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonable ensure compliance with Federal statutes, regulations, and other terms and conditions of the Federal Award. Management is responsible for establishing and maintaining a system of internal control that should include controls over its activities allowed or unallowed, allowable cost/cost principal process. As directed by section 2008(b)(2) of the Homeland Security Act of 2002 (codified as amended at 6 USC 609(b)(2)), all personnel and personnel-related costs, including those of intelligence analysts and operational overtime, are allowed up to 50 percent of HSGP funding without time limitation placed on the period of time that such personnel can serve. FEMA may provide a waiver at the request of the recipient to allow personnel expenses to exceed 50 percent of the amount awarded. Condition – It appears that controls do not exist, such as monitoring controls, to ensure VITEMA is in compliance with the earmarking requirements at the end of each grant period. Questioned Costs – None. Context – This is a condition identified per review of VITEMA’s compliance with the specified requirements. Effect – An ineffective control system related to monitoring of earmarking requirements can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements that could ultimately lead to disallowed costs for the major programs. Cause – VITEMA does not appear to have adequate policies and procedures to ensure compliance with the earmarking requirements and ensure that an appropriate level of monitoring is completed prior to closing out of the grant. Recommendation – We recommend that VITEMA reevaluate and improve internal controls to ensure each grant is monitored throughout its life to ensure compliance with the earmarking requirement at the end of a grants period of performance. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. This information is documented in BSIR as part of the submittal process and does not allow for the submittal of reporting if not verified to meet this requirement. VITEMA will also document this information when preparing the SF 425 report by including this information in the notes section of this report. This will be conducted on a quarterly basis. The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.

Finding Number: 2023-088 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Homeland Security Government Department/Agency: Virgin Islands Territorial Emergency Management Agency (VITEMA) Homeland Security Grant Program ALN: 97.067 Award#: Various Award Periods: Various Criteria – Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Public Law 110-252, hereafter referred as the “Transparency Act” that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Further, the Uniform Guidance in 2 CFR Section 200.303, Internal Controls, requires that non-federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition – We selected 2 of 3 projects with first-tier subawards greater than $30,000 and found the following: - No evidence of review of the reporting prior to submission. - We are unable to verify the timeliness of FFATA reporting. - We are unable to agree amounts reported to adequate source documentation. Questioned Costs – None. Context – This is a condition identified per review of VITEMA’s compliance with the specified requirements using a statistically valid sample. Effect – A lack of internal controls over compliance may lead to material noncompliance with stated provision. Cause – It appears that policies and procedures, including review over reporting procedures, were not functioning as intended. Recommendation – We recommend that VITEMA reevaluate its policies and procedures to ensure proper review of the required reports by an appropriate official who would ensure that information submitted is complete, accurate, consistent and submitted within the required timeframe. Views of Responsible Officials – The Government concurs with the auditor’s findings and recommendations. VITEMA's Deputy Director of Grants Management will review the FFTA information and validate that the information is true and correct based on the amount approved by DHS and sub-recipient agreement. This FFTA document will be signed and dated by the Deputy Director of Grants Management within the 30 days of required enrollment The planned corrective actions are presented in the Government’s Corrective Action Plan attached as Appendix B to the Single Audit Report.