Audit 390319

Reference Number: 2025-005 Prior Year Finding: 2024-007 Federal Agency: U.S. Department of Agriculture State Agency: Department of Education State Division Name: Child Nutrition Cluster Federal Program: 10.553, 10.555, 10.556, 10.559, 10.582 Assistance Listing Number: 1WV300301 (10/1/2024 – 9/30/2025) Award Number and Year: 1WV310309 (10/1/2024 – 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Education (Department) did not report subaward information timely. Context: Sixty subawards were selected for testing and we noted the following exceptions: • 36 of 60 subawards were not reported timely. The subawards were reported from approximately 1 to 8 months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department does not have sufficient procedures or internal controls to ensure that subaward information is reported timely. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department review and enhance internal controls and procedures to ensure that all subawards are reported timely, no later than the end of the month following the month of issuance. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-006 Prior Year Finding: 2024-009 Federal Agency: U.S. Department of the Interior State Agency: Department of Environmental Protection Federal Program: Abandoned Mine Land Reclamation Assistance Listing Number: 15.252 Award Number and Year: S19AF20000-05 (1/1/2019 – 12/31/2026) S20AF20008-03 (1/1/2020 – 12/31/2026) S20AF20094-02 (1/1/2021 – 12/31/2026) S22AF00013-02 (1/1/2022 – 12/31/2026) S22AF00039-03 (1/1/2022 – 12/31/2024) S23AF00013-04 (10/1/2022 – 9/30/2027) S23AF00059-00 (1/1/2023 – 12/31/2025) S23AF00107-00 (1/1/2023 – 12/31/2025) S24AF00007-00 (1/1/2024 – 12/31/2026) S24AF00032-01 (1/1/2023 – 9/30/2028) S24AF00064-00 (10/1/2023 – 12/31/2026) S25AF00103-01 (10/1/2024 – 9/30/2029) S25AF00162-00 (1/1/2025 – 12/31/2027 Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Environmental Protection did not report subaward information in accordance with FFATA reporting requirements. Context: Two of six subawards selected for testing were not reported timely. Of the two exceptions noted, one subaward was issued in April 2023 and one subaward was issued in July 2024. Both subawards were reported in November 2024. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department does not have sufficient procedures or internal controls to ensure that subaward information is reported timely. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Department review and enhance internal controls and procedures to ensure that all subawards are reported timely no later than the end of the month following the month of issuance. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-007 Prior Year Finding: 2024-015 Federal Agency: U.S. Department of Labor State Agency: Department of Commerce, Workforce West Virginia Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 25A55UI000073 (10/1/2024 – 12/31/2027) 24A55UI000043 (10/1/2023 – 12/31/2026) 23A55UI039356 (10/1/2022 – 12/31/2025) Compliance Requirement: Special Tests and Provisions: UI Benefit Payments Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70% of cases must be completed within 60 days of the week ending date of the batch; • a minimum of 95% of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98% of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not complete BAM case investigations within the requirements established in the ET Handbook No. 395. Context: The Department performed 481 reviews of paid cases and 151 reviews of denied cases during FY 2025. The Department did not meet the required time limits for closing paid or denied cases within 60, 90, or 120 days. Specifically, we noted the following exceptions: • 63% of paid cases were closed within 60 days, which is less than the required 70%. • 89% of paid cases were closed within 90 days, which is less than the required 95%. • 92% of paid cases were closed within 120 days, which is less than the required 98%. • The remaining paid cases were closed in more than 120 days. • 96% of denied monetary cases were closed within 120 days, which is less than the required 98%. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls over BAM case reviews were not sufficient to ensure that case reviews were closed within the time limits required by ET Handbook No. 395. Effect: Noncompliance with the time limits for closing cases could delay the detection and correction of inaccurate benefit payments. Recommendation: We recommend the Department review and enhance procedures and controls to ensure that case reviews are completed timely in accordance with the time limits established in the ET Handbook No. 395. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-008 Prior Year Finding: 2024-013 Federal Agency: U.S. Department of Labor State Agency: Department of Commerce, Workforce West Virginia Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 25A55UI000073 (10/1/2024 – 12/31/2027) 24A55UI000043 (10/1/2023 – 12/31/2026) 23A55UI039356 (10/1/2022 – 12/31/2025) Compliance Requirement: Special Tests and Provisions: UI Program Integrity – Overpayments Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement: Compliance: States are (1) required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments, and (2) states are prohibited from providing relief from charges to an employer’s UI account when overpayments are the result of the employer’s failure to respond timely or adequately to a request for information. States may continue to waive recovery of overpayments in certain situations and must continue to offer the individual a fair hearing prior to recovery. In addition, states may approve “blanket waivers” where individuals are eligible for payment under an unemployment benefit program for a given week, but through no fault of the individual, they were paid incorrectly under either the PUA or PEUC program at a higher WBA, or specific to PUA, when, through no fault of the individual, the state paid the individual a minimum WBA based on DUA guidance other than UIPL No. 03-20 (UIPL No. 20-21, section 4.d.ii). Program requirements for overpayments include the State must identify the basis for the overpayment consistent with its written procedures. An overpayment memorandum is created summarizing the details of the overpayment and submitted to UI cross-match staff or claims deputy for review. Upon review, the overpayment is established, and a Deputy Decision or WVUC-B-14-J Overpayment Determination is generated and sent to the claimant. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Commerce (Department) was not in compliance with program requirements for recovering overpayments. Context: For 1 of 60 claimants selected for testing, the Department did not establish an overpayment memo. Questioned costs: Undetermined. Cause: The Department’s procedures and controls are not sufficient to ensure that overpayments are recovered in accordance with program requirements. Effect: Failure to recover overpayments in accordance with federal requirements compromises the integrity and sustainability of the UI program. Unrecovered overpayments reduce funds available to pay legitimate benefits, increase the risk of fraud and improper payments, and undermine compliance with federal program standards. Recommendation: The Department should strengthen its procedures and controls to ensure overpayments are identified, recorded, and recovered in a timely manner and in full compliance with federal requirements. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-009 Prior Year Finding: 2024-035 Federal Agency: U.S. Department of the Treasury State Agency: Office of the Governor Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP0004 (2021-2024) SLFRP2625 (2021-2024) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Per the Compliance and Reporting Guidance issued by the Department of the Treasury (Treasury), recipients must submit quarterly Project and Expenditure Reports. Required project information includes current period obligation, cumulative obligation, current period expenditure, and cumulative expenditure. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The West Virginia Office of the Governor (Office) incorrectly reported expenditures for multiple projects on quarterly Project and Expenditure Reports submitted during FY 2025. The Office was also unable to provide documentation supporting obligations reported for one project. Context: Twenty-eight projects were selected for testing Project and Expenditure Reports, consisting of nine projects in the 9/30/2024 quarter and nineteen projects in the 3/31/2025 quarter. The Office contracts with a third-party to compile and submit quarterly Project and Expenditure reports. The contractor relies on the Office to populate the upload worksheets that are submitted to Treasury’s reporting portal. The following exceptions were noted: Expenditures: For 2 of 9 projects selected for testing in the 9/30/2024 quarter, expenditures reported were incorrect. • For the Revenue Replacement project, an expenditure summary analysis prepared by the contractor during the FY 2025 Single Audit identified $3.4 million in expenditures from the 6/30/2023 quarter that were not reported as of 6/30/2025. • For the Revenue Replacement project, reporting errors identified during the FY 2024 Single Audit continued through the 9/30/2024 quarter. Prior quarter cumulative reporting errors in the amount of $375 million were corrected in the 12/31/2024 quarterly report as part of the prior year corrective action plan. • For the Broadband project, an internal review by the contractor during FY 2025 identified that duplicate expenditures had been reported through the 12/31/2024 quarterly report. An adjustment was made in the 3/31/2025 quarter to correct the cumulative expenditures reported in prior quarters. Obligations: For 1 of 9 projects selected for testing in the 9/30/2024 quarter, auditors were unable to verify obligations reported. • The project for the Dilapidated Properties Program contains multiple subawards. The contractor relies on reporting upload worksheets prepared by the Office for submission to the Treasury reporting portal. The Office was unable to provide supporting documentation that agreed with the subaward current and cumulative obligations included on the upload worksheet. Cause: The Office’s corrective action plan from the prior year’s audit was in-process during FY 2025. In addition, internal reviews conducted during FY 2025 and during the audit identified additional reporting errors. Effect: Significant adjustments were required to be made to expenditures reported through the 12/31/2024 quarter, $3.4 million in expenditures from the 6/30/2023 quarter were not reported as of 6/30/2025, and supporting documentation for obligations for the Dilapidated Properties Program was not readily available for audit. Questioned costs: Undetermined. Recommendation: The Office should enhance its procedures and internal controls to ensure that the project expenditures and obligations reported are accurate, allowable, and agree to supporting documentation. In addition, supporting documentation should be readily available for audit. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-019 Prior Year Finding: 2024-052 Federal Agency: National Science Foundation State Agency: Higher Education Policy Commission Federal Program: Research and Development Cluster Assistance Listing Number: 47.076 Award Number and Year: 1834586 (09/01/2018 – 08/31/2025) Compliance Requirement: Suspension and Debarment Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement: Compliance: 2 CFR 200.214 Suspension and Debarment restricts awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. 2 CFR 180.300 states that an entity may determine suspension and debarment status by: (a) Checking SAM (System for Award Management) Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Higher Education Policy Commission (HEPC) did not properly verify and document the suspension and debarment status of subrecipients. Context: Nine transactions were selected for testing, including five for West Virginia University, one for Shepherd University, two for HEPC, and one for the Department of Agriculture. The following exceptions were noted: HEPC: • For 1 of 2 transactions selected for testing, HEPC performed the suspension and debarment verification after the subaward issuance date. The subaward was issued on 10/31/2023 but the suspension and debarment verification occurred on 12/4/2024. • For 1 of 2 transactions selected for testing, HEPC performed a suspension and debarment verification, but it was not dated and auditors were unable to determine if it occurred prior to issuance of the subaward. Questioned costs: None noted. The subrecipients were not suspended or disbarred. Cause: HEPC’s procedures and internal controls were not sufficient to ensure that it performed suspension and debarment verifications prior to issuance of subawards nor that documentation of the verifications was maintained and was complete. Effect: Failure to verify the suspension and debarment status of subrecipients prior to issuance of subawards could result in HEPC entering into agreements with subrecipients who are ineligible to participate in the program. Recommendation: HEPC should review and enhance its controls and procedures to ensure that it verifies the suspension and debarment status of subrecipients prior to issuance of subawards and include documentation for when the check occurred. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-010 Prior Year Finding: 2024-039 Federal Agency: U.S. Department of Education State Agencies: Glenville State University (GSU), Southern West Virginia Community and Technical College (SWVCTC) Federal Program: Student Financial Assistance Cluster Assistance Listing Number: 84.063, 84.268 Award Number and Year: Various (7/1/2024-6/30/2025) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matter Criteria or Specific Requirement: Compliance: The Code of Federal Regulations, 34 CFR 685.300(b)(5) requires the College on a monthly basis, to reconcile the institutional records with the Direct Loan funds received from the Secretary and the Direct Loan disbursement records submitted to and accepted by the Secretary. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: GSU - Direct loan reconciliations between the COD, G5 and student accounts were not being performed monthly. SWVCTC - Direct Loan reconciliations among COD, G5, and student accounts were not subjected to monthly review. Context: GSU did not prepare the required monthly direct loan reconciliation between COD, G5, and student accounts for one out of two months selected for testing. SWVCTC was unable to provide documentation supporting the review of monthly reconciliations for two months selected for testing. Questioned costs: None. Cause: GWU - The department did not have sufficient procedures or internal controls in place to ensure appropriate review and sign-off of federal student aid reconciliation amounts. SWVCTC - The process of review was being completed, however, there wasn’t adequate documentation to reflect the review of the reconciliations. Effect: The institutions are not compliant with internal policy and federal requirements to ensure funds are properly reconciled. Recommendation: Management at GSU should implement a monthly Direct Loan reconciliation in accordance with 34 CFR 685.300(b)(5). In addition, documentation over review and approval of the reconciliation for accuracy and completeness should be retained to evidence the operating effectiveness of internal controls. Management at SWVCTC should strengthen its existing internal control to ensure the monthly Direct Loan reconciliation is consistently prepared, reviewed, and approved to evidence the operating effectiveness of internal controls. In addition, documentation over review and approval of the reconciliation for accuracy and completeness should be retained to evidence the operating effectiveness of internal controls. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-012 Prior Year Finding: 2024-047 Federal Agency: U.S. Department of Education State Agencies: West Virginia University (WVU), West Virginia School of Osteopathic Medicine (WVSOM), Southern West Virginia Community and Technical College (SWVCTC) Federal Program: Student Financial Aid Assistance Listing Number: 84.063, 84.268 Award Number and Year: Various (7/1/2024 - 6/30/2025) Compliance Requirement: Special Tests and Provisions: NSLDS Reporting Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement: Compliance: In accordance with 34 CFR 685.309(b) and the National Student Loan Data System (NSLDS) Enrollment Reporting Guide published by the Department of Education, schools must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. In addition, schools must report enrollment status changes within 30 days of becoming aware of the status change or in their next scheduled enrollment submission if the schedule submission is within 60 days. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: WVU & WVSOM - There were discrepancies between the program enrollment effective date and the campus enrollment effective date. SWVCTC - There were discrepancies in enrollment reporting. Context: WVU - Ten out of twenty-six samples tested have instances where the program enrollment effective date did not match the campus enrollment effective date reported to NSLDS. WVSOM - Four out of six samples tested have instances where the program enrollment effective date did not match the campus enrollment effective date reported to NSLDS. SWVCTC - One sample tested had multiple discrepancies in enrollment reporting: • The date of the student’s status change was inconsistent between the College’s records and NSLDS. • The student’s enrollment status was not certified within the required 60-day timeframe. • The program enrollment status did not align with the campus enrollment status. • The program enrollment effective date differed from the campus enrollment effective date. Questioned costs: None. Cause: WVU - The department did not have sufficient procedures or internal controls in place to ensure the accuracy and reliability of National Student Clearinghouse (NSC) file generation following the Information Technology Services (ITS) system upgrade. WVSOM - The cause was updated process and a missed parameter in a large spreadsheet submitted to NSLDS upload. SWCTC - Data files weren’t being transmitted from the school to the Clearinghouse to NSLDS correctly. Effect: Inaccurate information is reflected on the NSLDS database. A student’s enrollment data protects the rights of borrowers by ensuring that loan interest subsidies are based on accurate enrollment data, ensures loan repayment dates are accurately based on the last data of attendance, allows in-school deferments to be automatically granted using NSLDS enrollment data, and provides vast amounts of critical data about the effectiveness of Title IV aid programs, including completion data. Recommendation: We recommend the institutions review their reporting procedures and controls to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-011 Prior Year Finding: 2024-040 Federal Agency: U.S. Department of Education State Agency: West Virginia State University (WVSU) Federal Program: Student Financial Assistance Cluster Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Number and Year: Various (7/1/2024-6/30/2025) Compliance Requirement: Special Tests and Provisions: Gramm-Leach-Bliley Act Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement: Compliance: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Certain elements of the University’s information security program were not maintained in written form. Context: The University did not have adequate documentation retained to evidence that a review and approval of the information security program were performed during the fiscal year to ensure compliance with Federal regulations. The University’s written information security program did not cover the following requirements: • Assess apps developed by the institution • Implement multi-factor authentication for anyone accessing customer information on the institution’s system • Dispose of customer information securely • Anticipate and evaluate changes to the information system or network. • Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). Questioned costs: None. Cause: WVSU did not have sufficient procedures or internal controls in place to ensure the timely development, completion, and approval of a formal cybersecurity policy. Effect: Information security management may not be optimized and responses delayed without the written plan. Recommendation: We recommend the University ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Agriculture Federal Program: Research and Development Cluster Assistance Listing Number: 93.103 Award Number and Year: Various Compliance Requirement: Equipment and Real Property Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR 200.313 prescribes the requirements for non-federal entities regarding equipment and real property management. Requirements include the following: Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the federal award identification number), who holds title, the acquisition date, cost of the property, percentage of federal participation in the project costs for the federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sales price of the property. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Agriculture did not manage equipment purchased with federal program funds in accordance with federal requirements. Context: Sixty items were selected for testing which included three from the Department of Agriculture (Department), five from Bluefield State College (BSC), and fifty-two from West Virginia University. We noted the following exceptions: Department of Agriculture: For one of three property records selected for testing, the Department did not maintain property records. Cause: The Department does not have sufficient procedures or internal controls to ensure that equipment and property acquired with federal funds is maintained in accordance with federal requirements. Effect: Failure to adequately manage federal equipment and property could allow for undetected loss, theft, damage, or unauthorized use of the property. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance internal controls and procedures to ensure that equipment and property acquired using federal funds is managed in accordance with federal requirements. The Department should maintain property records and perform a physical inventory for all equipment. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-021 Prior Year Finding: 2024-054 Federal Agency: Department of Health and Human Services State Agency: Department of Agriculture Federal Program: Research and Development Cluster Assistance Listing Number: 93.103 Award Number and Year: 5U2FFD007445-04 (7/01/2024 – 06/30/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Agriculture did not include all required information in subaward agreements. Context: One of eight subawards selected for testing were missing required federal award information. The eight subawards tested consisted of six subawards from West Virginia University (WVU), one subaward from the Department of Agriculture (Department) and one subaward from the Higher Education Policy Commission (HEPC). The following exceptions were noted: Department of Agriculture: The subaward tested did not contain all required federal award information. The Assistance Listing Number and identification of whether the Federal award was for research and development was omitted from the subaward agreement. Questioned costs: None noted. Cause: The Department does not have sufficient procedures and internal controls to ensure that subawards are issued in compliance with Federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-022 Prior Year Finding: 2024-021 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 2401WVTANF (10/1/2023 – 9/30/2024) 2503WVTANF (10/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions - Income Eligibility and Verification System Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows: (a) Wage information from the state Wage Information Collection Agency should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d) Information from the US Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e) Unearned income from the Internal Revenue Service (IRS). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not perform data exchange matches on cases or did not perform the data matches prior to disbursement of benefits. Context: Sixty cases were selected for testing, and the following exceptions were noted: • 10 of 60 cases did not perform a data match with other federally assisted benefit programs as required by the program. Benefits selected for testing were disbursed on 5/1/2025 and 6/1/2025 but the Department was unable to provide documentation that a data match had been performed. • 4 of 60 cases did not perform a data match with other federally assisted benefit programs prior to disbursement of benefits to the participants. The match check was performed from twelve to twenty-four days after benefits were disbursed. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it complied with IEVS data match requirements prior to issuance of benefits to participants in the program. The Department had not fully implemented its corrective action plan from the prior audit year. Effect: Failure to perform data exchanges with other federally assisted benefit programs could allow ineligible participants to receive benefits under the program. Questioned costs: Undetermined. Based upon information available at the time of audit, auditors were unable to determine if benefits were paid to ineligible participants. Recommendation: We recommend the Department complete implementation of its corrective action plan from theprior audit year. The Department should reevaluate its current process, implement proper controls, and perform additional training to ensure that, prior to disbursing benefits to participants, it has performed a data match with other federally assisted benefit programs and ensure that only eligible participants receive benefits under the program. Supporting documentation should be maintained and be readily available for audit. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-013 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2401WVLIEA (10/1/2023 – 9/30/2025) Compliance Requirement: Reporting – Special Reporting – LIHEAP Carryover and Reallotment Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Grant recipients must submit an initial LIHEAP Carryover and Reallotment Report no later than August 1 and a final report by December 31 indicating the amount expected to be carried forward for obligation in the following fiscal year and the planned use of those funds. Funds more than the maximum carryover limit are subject to reallotment to other LIHEAP recipients in the following federal fiscal year and must also be reported. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) did not submit the final LIHEAP Carryover and Reallotment Report timely. Context: The final Carryover and Reallotment Report for FFY 2024 was due 12/31/2024 but was not filed by the Department until 1/21/2025, or 21 days late. Cause: The Department controls failed to ensure that the final LIHEAP Carryover and Reallotment Report was submitted timely. Effect: Failure to submit the LIHEAP Carryover and Reallotment Report timely could impact the Federal agency’s ability to manage the program. Questioned costs: None noted. Recommendation: We recommend that the Department review and enhance internal controls and procedures to ensure that the final LIHEAP Carryover and Reallotment Report is submitted by December 31 each year. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-014 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2401WVCCDD (10/1/2023 – 9/30/2026) 2501EVCCDD (10/1/2024 – 9/30/2027) 2401WVCCDF (10/1/2023 – 9/30/2026) 2501WVCCDF (10/1/2024 – 9/30/2027) 2501EVCCDF (10/1/2024 – 9/30/2027) 2501EVCCDM (10/1/2024 – 9/30/2026) 2104WVCCDM (10/1/2024 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Compliance: Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address eleven specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Control: Per 45 CFR Part 98, Child Care and Development Fund (CCDF) recipients must establish and maintain robust internal controls to ensure integrity and accountability of program funds. Recipients must implement procedures designed to investigate and recover fraudulent payments, to impose sanctions on clients or providers in response to fraud, document and verify eligibility, and promote compliance with all applicable laws and regulations. These internal control mechanisms serve to prevent misuse, mismanagement, or fraudulent activity, thereby fostering accountability and transparency in the stewardship of federal funds allocated through the CCDF program. Condition: The Department of Human Services (Department) did not adequately monitor childcare providers to ensure compliance with the program’s health and safety standards. Context: Sixty childcare providers were selected for testing and exceptions were found for multiple health and safety monitoring controls. Specifically, we noted the following: • For 15 of 60 childcare providers selected for testing, the site visit conducted by the Department was not performed timely. Site visits are required within one year of license issuance. • For 4 of 60 childcare providers selected for testing, the Department did not perform the required annual site visit to verify the providers’ compliance with health and safety requirements. • For 2 of 15 childcare providers selected for testing, the Department’s monitoring checklist was not complete. The checklists were missing observations, including verification of required training, and lacked corrective actions. Cause: The Department’s procedures were insufficient to ensure that childcare providers were adequately monitored to ensure they met health and safety requirements. Internal controls did not prevent or detect the errors. Effect Failure to adequately monitor childcare providers for compliance with health and safety standards could result in deficiencies to be undetected or uncorrected, creating risks to the children receiving subsidies under the program. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance provider monitoring procedures and controls to ensure that childcare providers are compliant with health and safety standards. Site visits should be performed annually, should be thoroughly documented, and documentation should clearly indicate the results of monitoring, including requirements for correcting deficiencies noted. The Department should also ensure that its staff are adequately trained in conducting and documenting site visits in accordance with program requirements. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-015 Prior Year Finding: 2024-025 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Foster Care – Title IV-E Assistance Listing Number: 93.658 Award Number and Year: 2502WVFOST (10/1/2024 – 9/30/2025) 2401WVFOST (1/1/2024 – 3/31/2025) Compliance Requirement: Allowable Costs/Cost Principles, Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: Allowable Costs/Cost Principles – Per 2 CFR section 200.403, except where otherwise authorized by statute, costs must meet certain criteria to be allowable under Federal awards. Criteria includes that costs must be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. Costs must also conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. Eligibility – Funds may be expended for foster care maintenance payments on behalf of eligible children, in accordance with the Title IV-E agency’s foster care maintenance payment rate schedule and in accordance with 45 CFR section 1356.21, to individuals serving as foster family homes, to child-care institutions, directly to a youth aged 18 or older who is in a supervised independent living setting if no actual provider or other child placing intermediary is involved, or public or private child-placement or child-care agencies. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) charged the Foster Care program for payments made to psychiatric facilities which is an unallowable cost under the program. Context: One of sixty cases selected for testing included payments to a psychiatric facility. Payments to psychiatric facilities are not allowable under the Foster Care program. Cause: The Department’s corrective action plan from the prior audit indicated that a system change was made during FY 2025 to prevent future payments to psychiatric facilities from being charged to the Foster Care program. The exception noted was prior to the implementation of the correction action plan. Effect: Ineligible expenditures were charged to the Foster Care program. Questioned costs: $665, the amount paid to the psychiatric facility for the case tested. Recommendation: The Department should ensure its corrective action plan from the prior audit has been fully implemented and ensure that payments to psychiatric facilities are no longer charged to the Foster Care program. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-016 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Foster Care – Title IV-E Assistance Listing Number: 93.658 Award Number and Year: 2502WVFOST (10/1/2024 – 9/30/2025) 2401WVFOST (1/1/2024 – 3/31/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) was unable to provide supporting documentation for costs charged to the program. Context: For two of sixty cases selected for testing, the Department was unable to provide supporting documentation for the transactions. Auditors were unable to verify that the expenditures were allowable nor that they had been reviewed and approved prior to issuance. Cause: While the Department has established procedures in place, a clerical error resulted in supporting documentation not being properly maintained for certain program expenditures. Although the Department's multi-layered review process identified the missing documentation before the automated financial system issued payment, the error was not corrected prior to issuance. Consequently, internal controls did not prevent these errors. Effect: Expenditures without supporting documentation were charged to the Foster Care program. Questioned costs: $50, the amount charged to the program without supporting documentation. Recommendation: The Department should reevaluate its current process, implement proper controls, and perform additional training to ensure that, prior to charging costs to the program, it has supporting documentation which is reviewed and approved by a supervisor who is knowledgeable of the regulations regarding allowable program costs. Supporting documentation should be maintained and be readily available for audit. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-017 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Human Services Federal Program: Adoption Assistance Assistance Listing Number: 93.659 Award Number and Year: 2502WVADPT (10/1/2024 – 9/30/2025) 2502WVADPT (1/1/2024 – 3/31/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Human Services (Department) was unable to provide supporting documentation for costs charged to the program. Context: For one of sixty cases selected for testing, the Department was unable to provide supporting documentation for the transaction. Auditors were unable to verify that the expenditure was allowable nor that it had been reviewed and approved prior to issuance. Cause: While the Department has established procedures in place, a clerical error resulted in supporting documentation not being properly maintained for certain program expenditures. Although the Department's multi-layered review process identified the missing documentation before the automated financial system issued payment, the error was not corrected prior to issuance. Consequently, internal controls did not prevent these errors. Effect: An expenditure without supporting documentation was charged to the Adoption Assistance program. Questioned costs: $26, the amount charged to the program without supporting documentation. Recommendation: The Department should reevaluate its current process, implement proper controls, and perform additional training to ensure that, prior to charging costs to the program, it has supporting documentation which is reviewed and approved by a supervisor who is knowledgeable of the regulations regarding allowable program costs. Supporting documentation should be maintained and be readily available for audit. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-018 Prior Year Finding: No Federal Agency: Various State Agency: Higher Education Policy Commission (HEPC) Bluefield State University Federal Program: Research and Development Cluster Assistance Listing Number: Various Award Number and Year: Various Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: 2 CFR 200.320 (a)(1)(iv) states that a recipient or subrecipient may establish a micro-purchase threshold higher than the micro-purchase threshold identified in the FAR in accordance with the requirements of this section. The recipient or subrecipient may self-certify a threshold up to $50,000 on an annual basis and must maintain documentation to be made available to the Federal agency or pass-through entity and auditors in accordance with § 200.334. The self-certification must include a justification, clear identification of the threshold, and supporting documentation of any of the following: A. A qualification as a low-risk auditee, in accordance with the criteria in § 200.520 for the most recent audit; B. An annual internal institutional risk assessment to identify, mitigate, and manage financial risks; or, C. For public institutions, a higher threshold is consistent with State law. Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HEPC and Bluefield State University utilized micro‑purchase procedures for purchases charged to Federal awards at amounts exceeding the Federal micro‑purchase threshold based on thresholds established in its Board approved policies. However, the entities did not complete and retain the required annual self‑certification supporting the higher thresholds utilized. Context: HEPC applied a micro‑purchase threshold of $50,000 and Bluefield State University applied a micro‑purchase threshold of $25,000. Questioned costs: None noted. Cause: HEPC’s and Bluefield State University’s internal control processes did not include a documented control activity to ensure annual self‑certification of the micro‑purchase threshold was completed, approved by appropriate authority, and retained in accordance with Uniform Guidance requirements. Effect: By applying micro‑purchase procedures to transactions exceeding the Federal micro‑purchase threshold without maintaining required self‑certification documentation, the entities increase the risk of noncompliance with Uniform Guidance procurement standards, insufficient competition or price reasonableness documentation, and the potential for unallowable or unsupported costs charged to Federal awards. Recommendation: HEPC and Bluefield State University should formally establish and document an annual self‑certification of their micro‑purchase thresholds in accordance with 2 CFR §200.320(a)(1)(iv). The self‑certification should clearly identify the approved threshold, include a written justification, and retain supporting documentation demonstrating compliance with one of the allowable criteria. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.

Reference Number: 2025-004 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury, U.S. Department of Agriculture, U.S. Department of Labor, U.S. Department of Education, U.S. Department of Health and Human Services, U.S. Department of Homeland Security State Agency: State Treasurer’s Office Federal Program: SNAP Cluster National School Lunch Program Unemployment Insurance Title I Grants to Local Educational Agencies Special Education -- Grants to States Education Stabilization Fund Temporary Assistance for Needy Families Low-Income Home Energy Assistance Child Care and Development Block Grant Foster Care -- Title IV-E Adoption Assistance Children's Health Insurance Program Medical Assistance Program Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 10.551, 10.561, 10.555, 17.225, 84.010, 84.027, 84.425, 93.558, 93.568, 93.575, 93.658, 93.659, 93.767, 93.778, 97.036 Award Number and Year: Various Compliance Requirement: Reporting - Cash Management Improvement Act Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The State Treasurer’s Office (Department) did not submit the FY 2025 Annual Report timely. Context: Treasury granted the Department an extension until January 9, 2026 to submit the FY 2025 Annual Report. The Department did not submit the report until January 14, 2026. Cause: Due to extenuating circumstances, the Department requested an extension beyond the regulatory filing deadline but did not seek an additional extension when the issues remained unresolved. Effect: Untimely submission of the Annual Report may delay Treasury’s settlement of applicable annual interest payments. Questioned costs: None noted. Recommendation: The Department should enhance its procedures and internal controls to ensure that the Annual Report is submitted timely in accordance with CMIA requirements and the terms of deadline extension, if applicable. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.