Audit 385911

Reference Number: 2024-010 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Department of Human Services Federal Program: COVID-19 – Pandemic EBT Assistance Listing Number: 10.542 Award Number and Year: 2022-2023 Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Performance reports must be certified monthly and submitted no later than the due date prescribed in the reporting schedule provided by the Food and Nutrition Service (FNS). Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) submitted the July 2023 performance report untimely. Context: For one of eight reports selected for testing, the Department submitted the report untimely. The report was due 11/6/2023 but it was submitted on 11/7/2023. Cause: The Department’s procedures were not sufficient to ensure that monthly performance reports were submitted timely. Internal controls did not prevent or detect the error. Effect: A programmatic report was submitted untimely. Questioned costs: None noted. Recommendation: We recommend the Department enhance its procedures and internal controls to ensure that it submits programmatic reports on a timely basis. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-011 Prior Year Finding: No Federal Agency: U.S. Department of Defense State Agency: Military Department Federal Program: National Guard Military Operations and Maintenance (O&M) Projects Assistance Listing Number: 12.401 Award Number and Year: W912K6-24-2 (10/1/2023 – 9/30/2024) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Military Department (Department) charged costs to the federal grant prior to the allowable start of the period of performance. The expenditures were incurred from six to twenty-three days prior to the start of the award period. Context: Two of forty transactions selected for testing were incurred prior to the allowable start of the period of performance. Cause: The Department’s procedures were not operating sufficiently to ensure that expenditures charged to the program were incurred within the awards’ period of performance. Internal controls did not prevent or detect the errors. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: $ 4,699, which represents the total of the expenditures incurred prior to the awards’ period of performance. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-012 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 2023 - 2024 Compliance Requirement: Allowable Activities/Costs Eligibility Matching Period of Performance Reporting Special Tests and Provisions – UI Benefit Payments Special Tests and Provisions – Match with IRS 940 FUTA Tax Form Special Tests and Provisions – UI Program Integrity-Overpayments Special Tests and Provisions – UI Reemployment Programs: Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) was unable to provide documentation supporting its compliance with program requirements for Allowable Activities/Costs, Matching, Period of Performance, Special Tests and Provisions – UI Benefit Payments, Special Tests and Provisions – Match with IRS 940 FUTA Tax Form, Special Tests and Provisions – UI Program Integrity-Overpayments, Special Tests and Provisions – UI Reemployment Programs: Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA). The Department provided all requested reports but some of the compliance requirements were not tested due to missing supporting documentation. We noted that documentation supporting key line items, timeliness of the submitted report, and/or review and approval of the report was not provided. Context: The Department failed to provide supporting documentation to auditors. Therefore, compliance with program requirements were not tested. Reporting: Financial Reports ETA 2112-UI Financial Transaction Summary, supporting documentation of submitted data and evidence of review was not provided for four of the four reports selected for testing. ETA 191-Financial Status of UCFE/UCX, supporting documentation of submitted data and evidence of review was not provided for two of the two reports selected for testing. Reporting: Performance Reports ETA 9050-Time Lapse of All First Payments except Workshare, supporting documentation for key line items, evidence of submission date and evidence of review was not provided for four of the four reports selected for testing. ETA 9052-Nonmonetary Determination Time Lapse Detection, supporting documentation for key line items, evidence of submission date and evidence of review was not provided for four of the four reports selected for testing. ETA 9055-Appeals Case Aging – Lower and Higher Authority Appeals, supporting documentation for key line items, evidence of submission date and evidence of review was not provided for four of the four 5eports selected for testing. Reporting: Special report ETA 2208A-Quarterly UI Above-Base Report evidence of review was not provided for two of the two reports selected for testing. Cause: The Department experienced significant transition in management and staffing during FY 2024. Due to lack of written procedures and processes, information related to the unemployment insurance compliance requirements was transitioned to the current UI team. Effect: Auditors were unable to verify the Department’s compliance with program requirements. Questioned costs: Undetermined due to lack of audit documentation. Recommendation: We recommend the Department implement procedures and internal controls to ensure that it complies with program requirements, that it maintains documentation, and that documentation is readily available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-013 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Department of Labor Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 23A55AT000018 (7/1/2023 – 6/30/2026) 23A55AW000021 (7/1/2023 – 6/30/2026) 23A55AY000028 (4/1/2023 – 6/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) was not in compliance with FSRS reporting requirements. Subawards were not reported to FSRS. Context: Five of five subawards selected for testing were not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department does not have procedures and internal controls to ensure that subawards are reported timely and accurately to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department develop internal controls and procedures to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-014 Prior Year Finding: 2023-008 Federal Agency: U.S. Department of the Treasury State Agency: Department of Housing and Community Development Federal Program: COVID-19 – Emergency Rental Assistance Program Assistance Listing Number: 21.023 Award Number and Year: 3/1/2021- 9/30/2025 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR 200, a non-federal entity must determine whether amounts provided to or on behalf of eligible participants or groups of participants were calculated in accordance with program requirements. For ERA2, a grantee may only use the funds provided in the ERA to provide financial assistance and housing stability services to eligible households. To be eligible, a household must be obligated to pay rent on a residential dwelling and the grantee must determine that: a. one or more individuals within the household has qualified for unemployment benefits or experienced a reduction in household income, incurred significant costs, or experienced other financial hardship during or due, directly or indirectly, to the coronavirus pandemic. b. one or more individuals within the household can demonstrate a risk of experiencing homelessness or housing instability; and c. the household is a low-income family (as such term is defined in section 3(b) of the United States Housing Act of 1937 (42 U.S.C. 1437a(b))). Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Housing and Community Development (Department) did not consistently issue ERA the approval letter prior to disbursing funds. We identified disbursements that were approved during 2023 and 2024, and the approval letter was issued in February 2025. Context: ERA: For 4 of 60 participants selected for testing, the assistance approval letter was signed after funds were disbursed. Cause: The Department’s procedures and internal controls were did not identify the untimely issuance of the approval letters. Effect: Inconsistent performance of procedures and internal controls increases the risk of noncompliance. Questioned costs: None noted, the disbursements were issued for eligible participants. Recommendation: We recommend that the Department review and enhance supervisor review and approval to ensure that program requirements are consistently performed. Documentation to support compliance with the requirements should be maintained and readily available for review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-015 Prior Year Finding: 2023-009 Federal Agency: U.S. Department of the Treasury State Agency: Department of Housing and Community Development Federal Program: COVID-19 – Homeowner Assistance Fund Assistance Listing Number: 21.026 Award Number and Year: 11/1/2021 – 9/30/2026 Compliance Requirement: Allowable Costs/Activities – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vii) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Housing and Community Development (Department) did not have effective controls in place for monitoring and obtaining adequate support to validate actual payroll expenses charged to the federal program. Context: One of sixty timesheets selected for testing could not be located by the Department and was unavailable for testing. Cause: Controls were not operating effectively to ensure that time and effort reporting was performed and documented in a timely manner in accordance with federal requirements. Effect: Documentation could not be provided for costs charged to the program. Questioned costs: Undetermined. Recommendation: The Department should reevaluate current process, implement proper controls, and perform additional training over time and effort reporting. The Department should not seek federal reimbursement unless they can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-011 Federal Agency: U.S Department of the Treasury U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 - Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) COVID-19 – Education Stabilization Fund (ESF) Assistance Listing Number: 21.027 84.425 C, D, R, U, V, W Award Number and Year: CSLFRF: 2021 ESF: S425C210002, 2021-2023 S425D210005, 2021-2023 S425R210006, 2021-2023 S425U210005, 2021-2024 S425V210006, 2022-2024 S425W210021, 2021-2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR 200 section 200.332 (a)1 (ii) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required federal award information at the time of the subaward. If any of the data elements change, include the changes in subsequent subaward modifications. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: Subrecipient's unique entity identifier. Per 2 CFR 200 section 200.332 (a)1(d) a non-Federal entity should monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) was unable to provide documentation that it had subrecipient monitoring procedures in place, nor that monitoring activities were performed. The Department also did not include all required information in subawards it issued to subrecipients. The Department’s 2023 corrective action plan noted that resolution of the finding would not be until FY 2025. The auditor obtained the Department’s project monitoring plan and monitoring survey implemented during fiscal year 2025. Context: ESF: Twenty-nine subrecipients were selected for testing and the following exceptions were noted: • For 29 of 29 subrecipients selected for testing, the Department was unable to provide documentation that subrecipient monitoring procedures were in place nor that subrecipient monitoring was performed. • For 2 of 29 subrecipients selected for testing, the subrecipient’s unique identifier was not obtained. The subaward did not contain the required information nor did the Department provide documentation of obtaining the information for the subrecipient. CSLFRF: For seven of seven subrecipients selected for testing, the Department was unable to provide documentation that subrecipient monitoring procedures were in place nor that subrecipient monitoring was performed. Cause: The subawards for non-public schools did not contain the required information, which was not identified during the review process. The Department’s 2023 corrective action plan noted that resolution of the finding would not be until FY 2025. The auditor obtained the Department’s project monitoring plan and monitoring survey implemented during fiscal year 2025. Effect: The Department is not in compliance with the grantor’s reporting requirements during the audit period. Questioned costs: None noted. Recommendation: We recommend that the Department continue to implement the sub recipient monitoring procedures and develop internal controls to ensure that the monitoring requirements are performed in a consistent and timely manner. Furthermore, the procedures should ensure that the documentation supporting compliance is maintained and readily available for review. We also recommend that the subawards contain all required federal award information. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-017 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 – Education Stabilization Fund Assistance Listing Number: 84.425 C, D, R, U, V, W Award Number and Year: S425C210002, 2021-2023 S425D210005, 2021-2023 S425R210006, 2021-2023 S425U210005, 2021-2024 S425V210006, 2022-2024 S425W210021, 2021-2024 Compliance Requirement: Reporting – Annual Report Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Annual Reporting: (OMB No. 1810-0749 for ESSER; 1810-0748 for GEER; and 1810-0765 for EANS) with data on expenditures, planned expenditures, subrecipients, and uses of funds, including for mandatory reservations. LEAs/subrecipients submit data to the SEA/Governor for the SEA’s/Governor’s report. The annual performance reports can be found on the Grantee Help page of ED’s ESF Transparency Portal. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) did not provide documentation to support submission of the annual report. The documentation provided by the Department to support the annual report was not in a format that could be audited. As a result, auditors were unable to test the accuracy of the report’s key line items. The data was in the prescribed format for compilation and transmission to the U.S. Department of Education but was not identifiable by the auditor. Context: The annual report is for all grants. Cause: The Department was unable to provide the requested documentation in a timely manner to allow auditors to test compliance with the federal requirement. Effect: The Department was not able to support compliance with the grantor’s reporting requirements. Questioned costs: None noted. Recommendation: We recommend that the Department develop internal controls and procedures to ensure that all reporting requirements are performed in a consistent and timely manner, and that the documentation supporting compliance is maintained and readily available for review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-018 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 – Education Stabilization Fund Assistance Listing Number: 84.425 C, D, R, U, V, W Award Number and Year: S425C210002, 2021-2023 S425D210005, 2021-2023 S425R210006, 2021-2023 S425U210005, 2021-2024 S425V210006, 2022-2024 S425W210021, 2021-2024 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) was not in compliance with FSRS reporting requirements. Subawards were not reported or not reported accurately to FSRS. Context: Sixty subawards were selected for testing and the following exceptions were noted: • 52 of 60 subawards were not reported to FSRS. • 5 of 60 subawards were reported to FSRS approximately one year after they were due. One subaward was issued in December 2021 and was not reported until January 2023. Four subawards were issued in February and March 2023 but were not reported until April 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and internal controls are not sufficient to ensure that subawards are reported timely and accurately to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-019 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: COVID-19 – Education Stabilization Fund Assistance Listing Number: 84.425R Award Number and Year: S425R210006, 2021-2023 Compliance Requirement: Special Tests and Provisions - Identifying Non-Public Schools under ARP EANS that Enroll a Significant Percentage of Students from Low-Income Families and are Most Impacted by the COVID-19 Emergency (SEA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Under section 2002(a) of the ARP Act, services or assistance to non-public schools under the ARP EANS program are limited to nonpublic schools that enroll a significant percentage of students from low-income families and are most impacted by the COVID–19 emergency. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) was unable to provide documentation supporting its compliance with program requirements related to identifying non-public schools under ARP EANS that enroll a significant percentage of students from low-income families and are most impacted by the COVID-19 emergency. Context: The Department failed to provide supporting documentation to auditors. Therefore, compliance with program requirements could not be tested. Cause: The Department did not provide the requested documentation in a timely manner to allow auditors to test compliance with the federal requirement. Effect: The Department was not able to support compliance with the grantor’s reporting requirements. Questioned costs: Undetermined, based on the information provided during the audit, questioned costs could not be determined. Recommendation: We recommend the Department develop internal controls and procedures to ensure compliance with program requirements related to identifying non-public schools under ARP EANS that enroll a significant percentage of students from low-income families and are most impacted by the COVID-19 emergency and that the documentation supporting compliance is maintained and readily available for review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-020 Prior Year Finding: 2023-012 Federal Agency: U.S. Department of Education State Agency Name: Bowie State University (BSU) Federal Program: Higher Education Institutional Aid Assistance Listing Number: 84.031B, 84.031E, 84.031K Award Number and Year: P031B220039(10/1/2022-9/30/2024), P031E200007 (10/1/2022-9/30/2024), P031K190021 (10/1/2022-9/30/2024) Compliance Requirement: Allowable Activities/Costs Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: Per 2 CFR § 200.403, except where otherwise authorized by statute, costs must meet the following general criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award to be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award regarding types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also §200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also §200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Time and Effort documentation was not documented and reviewed timely. Questioned costs: None. Context: For all seventeen samples selected for testing, Time and Effort was not documented in a timely manner or reviewed appropriately. Cause: The Institution’s internal controls were not operating effectively to ensure that time and effort reporting was performed and documented in a timely manner in accordance with federal requirements. Effect: Expenditures may be incorrectly charged to the program. Recommendation: We recommend that the Institution strengthen its internal controls to ensure that Time and Effort is documented, and expenditures are reviewed and adjusted for, if necessary, in a timely manner. Views of responsible officials: There is no disagreement with the audit finding.

Reference Number: 2024-021 Prior Year Finding: 2023-013 Federal Agency: U.S. Department of Education State Agency Name: Coppin State University (CSU) Federal Program: Higher Education Institutional Aid Assistance Listing Number: 84.031B, 84.031E Award Number and Year: P031B170054(10/1/2021-9/30/2024), P031B220065(10/1/2022-9/30/2024), P031E200078 (10/1/2022-9/30/2024) Compliance Requirement: Allowable Activities/Costs Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: Per 2 CFR § 200.403, except where otherwise authorized by statute, costs must meet the following general criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award to be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award regarding types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. See also §200.306 Cost sharing or matching paragraph (b). (g) Be adequately documented. See also §§200.300 Statutory and national policy requirements through 200.309 Period of performance of this part. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Coppin State University (Institution) did not adjust the employee’s payroll costs to reflect the reported effort. We noted that the actual time and effort charged to the grant did not agree to the time and effort report. Questioned costs: $45 Context: For one out of ten samples selected for testing, the payroll calculation did not agree to the employee's time and effort report. Cause: The Institution’s internal controls were not operating effectively to ensure that time and effort reporting was accurate and agreed with supporting documentation. Effect: Expenditures may be incorrectly charged to the program. Recommendation: We recommend that the Institution strengthen its internal controls to ensure that Time and Effort is documented, expenditures are reviewed and adjusted for, if necessary, in a timely manner. Views of responsible officials: There is no disagreement with the audit finding.

Reference Number: 2024-022 Prior Year Finding: 2023-015 Federal Agency: U.S. Department of Education State Agency Name: Coppin State University (CSU), Bowie State University (BSU), University of Maryland Eastern Shore (UMES) Federal Program: Higher Education Institutional Aid Assistance Listing Number: 84.031B, 84.031E, 84.031K Award Number and Year: CSU - P031B170054(10/1/2021-9/30/2024), P031B220065(10/1/2022-9/30/2024), P031E200078 (10/1/2022-9/30/2024), BSU - P031B220039(10/1/2022-9/30/2024), P031E200007 (10/1/2022-9/30/2024), P031K190021 (10/1/2022-9/30/2024), UMES - P031B220031(10/1/2022-9/30/2024), P031E200003 (10/1/2022-9/30/2024), P031K190004 (10/1/2022-9/30/2024) Compliance Requirement: Suspension & Debarment Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: Per 2 CFR 200.213 Suspension and Debarment restricts awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. 2 CFR 180.300 states that an entity may determine suspension and debarment status by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The institutions listed above did not determine the suspension and debarment status of contractors with expenditures exceeding $25,000 during the fiscal year as required by federal regulations. Questioned costs: Undetermined. Context: The suspension and debarment status for six out of fifteen items tested were not documented before the time of procurement. Cause: The Universities’ controls were not sufficient to ensure that contractors’ suspension and debarment status was documented prior to Effect: Federal funds may be paid to parties that are ineligible. Recommendation: We recommend the Universities evaluate their policies procedures to ensure that suspension and debarment requirements are being met prior to entering into transactions with contractors. Policies and procedures should reiterate the three options for determining suspension and debarment status listed in 2 CFR 180.300. Views of responsible officials: There is no disagreement with the audit finding.

Reference Number: 2024-023 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Education Federal Program: Special Education Cluster (IDEA) Assistance Listing Number: 84.027, 84.173 Award Number and Year: H027A230035 (7/1/2023 – 9/30/2024) H173A230089 (7/1/2023 – 9/30/2024) Compliance Requirement: Period of Performance Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Education (Department) charged costs to the federal grant prior to the allowable start of the period of performance. We noted that five of the seven exceptions were incurred from 213 to 92 days prior to the beginning of the period of performance. Context: Seven of eleven transactions selected for testing were incurred prior to the allowable start of the period of performance. Cause: The Department’s procedures were not operating sufficiently to ensure that expenditures charged to the program were incurred within the awards’ period of performance. Internal controls did not prevent or detect the errors. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: $4,411, which represents the total of the expenditures incurred prior to the awards’ period of performance. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Refugee and Entrant Assistance State Administered Programs Assistance Listing Number: 93.566 Award Number and Year: 2201MDRSSS (10/1/2021 – 9/30/2024) 2301MDRSSS (10/1/2022 – 9/30/2026) 2301MDRCMA (10/1/2022 – 9/30/2024) 2401MDRCMA (10/1/2023 – 9/30/2025) Compliance Requirement: SEFA Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: 2 CFR, Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart F, §200.510(b) requires that auditees prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with §200.502. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: A material error was made by the Department of Human Services (Department) in the amount reported for the program on the Schedule of Expenditures of Federal Awards (SEFA). Context: The Department made a late adjustment to their SEFA reporting for the program which reduced total expenditures by $3.77 million, or approximately 10%. Cause: The General Accounting Department consulted with Department to “reasonably” determine the current year federal program expenditures. However, the Department incorrectly accounted for and reported the federal program expenditures as part of their closing reporting package and subsequently reduced expenditures by approximately 10%. Effect: The SEFA was not prepared in accordance with OMB requirements which could impact the major program risk assessment. Questioned costs: None noted. Recommendation: We recommend that the Department review and enhance its reporting procedures and internal controls to ensure that expenditures reported on the SEFA are accurate. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-025 Prior Year Finding: No Federal Agency: Department of Health and Human Services State Agency: Department of Human Services Federal Program: Low-Income Home Energy Assistance Program Assistance Listing Number: 93.568 Award Number and Year: 2401MDLIEA (10/1/2023-9/30/2025) Compliance Requirement: Period of Performance Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) charged costs to the federal grant prior to the allowable start of the period of performance. The expenditures were incurred from one to twenty-six days prior to the start of the award period. Context: Seventeen of forty transactions selected for testing were incurred prior to the allowable start of the period of performance. Cause: The Department’s procedures were not operating sufficiently to ensure that expenditures charged to the program were incurred within the awards’ period of performance. Internal controls did not prevent or detect the errors. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: $778,473, which represents the total of the expenditures incurred prior to the awards’ period of performance. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Children’s Health Insurance Program, Medicaid Cluster Assistance Listing Number: 93.767, 93.775, 93.777, 93.778 Award Number and Year: 2205MD5021 (10/1/2021 – 9/30/2023) 2305MD5021 (10/1/2022 – 9/30/2024) 2405MD5MAP (10/1/2023 – 9/30/2024) 2405MD5ADM (10/1/2023 – 9/30/2024) 2305MD5MAP (10/1/2022 – 9/30/2023) 2305MD5ADM (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions – Refunding of Federal Share of Medicaid Overpayments to Providers Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 42 CFR 433 Subpart F, State Medicaid Agencies (SMAs) are required to refund the federal share of Medicaid overpayments made to providers. States have up to one (1) year from the date of discovery of the overpayment to recover or attempt to recover the overpayment before the federal share must be refunded to CMS via Form CMS-64 regardless of whether recovery is made from the provider. The state must credit the federal share to CMS as outlined under 42 CFR 433.320(a)(2) either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier, with limited exceptions. Under 42 CFR 433.316(d), for overpayments resulting from fraud, if not collected within one year of discovery, the SMA has until 30 days after the final judgment of a judicial or administrative appeals process to return the federal share. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Health (Department) did not report an overpayment timely. The overpayment should have been reported on the 12/31/2023 quarterly CMS-64 report, but the Department did not report it until FY 2025. Context: One of eight overpayments selected for testing was not reported timely to CMS. Cause: The Department’s procedures were not sufficient to ensure that overpayments were reported timely. Internal controls did not detect or prevent the error. Effect: Overpayment reporting and return of Medicaid funds to CMS was untimely. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and internal controls to ensure that overpayments are reported to CMS either in the quarter in which the recovery is made or in the quarter in which the one-year period following discovery ends, whichever is earlier. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2405MD5MAP (10/1/2023 – 9/30/2024) 2405MD5ADM (10/1/2023 – 9/30/2024) 2305MD5MAP (10/1/2022 – 9/30/2023) 2305MD5ADM (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions – Medicaid Recovery Audit Contractors (RACs) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States are required to establish programs to contract with one or more Medicaid Recovery Audit Contractors (RACs) to identify underpayments and overpayments, and recouping overpayments under the state plan and under any waiver of the state plan with respect to all services for which payment is made to any entity under such plan or waiver. States must establish these programs in a manner consistent with State law, and generally in the same manner as the Secretary contracts with contingency fee contractors for the Medicare Fee-For-Service RAC program under Section 1893(h) of the Act (42 USC 1395ddd). The Medicaid State Plan requires the State to conduct a desk audit on every provider each year and to conduct periodic field audits based on the results of annual desk audits. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: RAC desk audits and field audits were not performed timely. The Department procured and contracted a vendor to perform the audits in August 2022 (fiscal year). The contractor is currently performing desk audits for 2021, which is the last time the audits were performed. Context: For 60 of 60 providers selected for testing, the RAC contractor engaged by the Department of Health (Department) did not perform timely audits. Cause: The Department’s procedures and internal controls are not sufficient to ensure that annual desk audits and periodic field audits are performed timely. Effect: Failure to perform RAC audits timely could result in underpayment and overpayment errors to be undetected which could result in overpayments not being recouped timely. Questioned costs: Undetermined. Recommendation: We recommend that the Department enhance its procedures and internal controls to ensure that RAC desk and field audits are performed timely and that overpayments are recouped. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-028 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 5H79TI085742 (9/30/2023 – 9/29/2024) 6H79TI085742 (9/30/2023 – 9/29/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Health (Department) was not in compliance with FSRS reporting requirements. Subawards were not reported timely to FSRS. Context: Eight of eight subawards selected for testing were not reported timely to FSRS. The subawards were issued in September 2023 but were not reported to FSRS until August 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and internal controls are not sufficient to ensure that subawards are reported timely to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-029 Prior Year Finding: 2023-024 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Health Federal Program: Block Grants for Substance Use Prevention, Treatment, and Recovery Services Assistance Listing Number: 93.959 Award Number and Year: 24B1MDSAPT (10/1/2023 – 9/30/2025) B08TI085811 (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Health (Department) was not in compliance with FSRS reporting requirements. Subawards were not reported timely to FSRS. Context: Eight of eight subawards selected for testing were not reported timely to FSRS. The subawards were issued in October 2022 but were not reported to FSRS until August 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and internal controls are not sufficient to ensure that subawards are reported timely to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that all required subawards are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-030 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Morgan State University (MSU) Federal Program: Higher Education Institutional Aid Assistance Listing Number: 84.031B, 84.031E, 84.031K Award Number and Year: P031B220083 (10/1/2022-9/30/2024), P031E200073 (10/1/2022-9/30/2024), P031K190016 (10/1/2022-9/30/2024) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: It was observed that the University did not maintain supporting documentation supporting the review and approval process over cash management. Context: The condition occurred for the two drawdowns selected for testing. Cause: The University’s process over review and approval for cash management was not documented. Effect: Federal funds may be incorrectly drawn. Questioned costs: None. Recommendation: We recommend the institution implement a formal process for conducting and documenting regular reviews of cash management. Views of responsible officials: There is no disagreement with the audit finding.