Audit 394235

Reference Number: 2025-003 Prior Year Finding: 2024-003 Federal Agency: U.S. Department of Agriculture State Agency: Agency of Agriculture Federal Program: Dairy Business Innovation Initiatives Assistance Listing Number: 10.176 Award Number and Year: 21DBIVT1004 (10/31/2021 – 10/30/2024), AM22DBIVT1015 (9/30/2022 – 9/29/2025), AM21DBIVT1011 (9/30/2022 – 9/29/2026), Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Agency of Agriculture (Agency) were not reported in accordance with FFATA requirements. Context: Sixteen subaward transactions were selected for testing, and the following exceptions were noted: • Two of sixteen subawards selected for testing were not reported to SAM.gov until after they were selected for testing by auditors. The subawards were issued in January 2022 and May 2024 but were not reported to SAM.gov until February 2026. • Six of sixteen subawards selected for testing were not reported timely. The subawards were issued from September 2024 through January 2025 but were not reported to SAM.gov until March 2025 and September 2025, or from 71 to 212 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency had not completed implementation of its corrective action plan from the prior audit year. The Agency’s procedures and controls are not sufficient to ensure that subawards are reported to SAM.gov in accordance with FFATA reporting requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its corrective action plan from the prior year. It should review its procedures and internal controls to ensure that all required subawards and subaward modifications are reported timely to SAM.gov in accordance with FFATA requirements and that all previously issued subawards are reported. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-004 Prior Year Finding: 2024-004 Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT402513 (10/1/2023 – 9/30/2024) 4VT433933 (10/1/2023 – 9/30/2026) 4VT437533 (10/1/2023 – 9/30/2025) Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Eligibility case reviews performed by the Agency of Human Services (Agency) were untimely and lacked proper documentation. Context: The Agency has implemented an Automated Data Processing (ADP) system referred to as the ACCESS system that is utilized in the eligibility determination process of many programs, including SNAP. ACCESS is used to process and store all case file information for eligibility determination and benefit calculations, it automatically terminates household eligibility at the end of their certification period unless recertified and provides data necessary to meet Federal issuance and reconciliation reporting requirements. Sixty participants were selected for testing and the following exceptions were noted: • 6 of 60 participants selected for testing were not reviewed timely. A minimum of four case reviews must be performed by each district in the month in which the applicant is determined eligible in ACCESS. • For 9 of 60 participants selected for testing, supervisory review and verification of the applicants’ eligibility was not dated by the supervisor. • For 2 of 60 participants selected for testing, the reviewer did not check to see if edits were made after the review was performed. Reviewers are required to check to verify that corrective actions were taken. Cause: The Agency’s procedures were not sufficient to ensure that eligibility case reviews were performed timely and were properly documented. Internal controls did not detect or prevent the errors. Effect The failure to perform eligibility case reviews timely and accurately could result in an ineligible applicant receiving benefits. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility case reviews are performed timely, accurately, and are properly documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-005 Prior Year Finding: No Federal Agency: U.S. Department of Housing and Urban Development State Agency: Agency of Commerce and Community Development Federal Program: Community Development Block Grants/State's Program and Non-Entitlement Grants in Hawaii Assistance Listing Number: 14.228 Award Number and Year: B-20-RH-50-0001 (1/17/2022 - 2/1/2029) B-22-RH-50-0001 (3/27/2023 - 9/1/2029) B-23-RH-50-0001 (7/1/2023 - 9/1/2030) B-22-DC-50-0001 (7/1/2022 - 9/1/2029) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Commerce and Community Development (Agency) did not report subaward dates in accordance with FFATA requirements. Context: Two of eight subawards selected for testing were not reported accurately in accordance with FFATA requirements. The subawards with incorrect subaward action dates totaled $615,195. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures and controls are not sufficient to ensure that subawards are reported to SAM.gov in accordance with FFATA reporting requirements. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review its procedures and internal controls to ensure that all required subawards and subaward modifications are reported in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-006 Prior Year Finding: 2024-008 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 25A55UI000119 (10/1/2024 – 12/31/2027) 24A55UI000063 (10/1/2023 – 12/31/2026) UI370952155A50 (9/1/2021 – 5/22/2025) 23A60UB000019 (8/3/2023 – 5/22/2025) 23A60UB000024 (4/1/2023 – 5/22/2025) 24A60UD000052 (8/20/2024 – 8/20/2027) UI347462055A50 (8/20/2024 – 8/20/2027) 23A60UD000013 (7/14/2023 – 7/14/2026) 25A60UD000067 (10/1/2024 – 9/30/2027) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance Criteria or specific requirement: Compliance: ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it takes states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that reports had been reviewed and approved by an authorized State official prior to submission. Context: We selected for testing monthly reports for October 2024, November 2024, January 2025 and May 2025 and the following exceptions were noted: ETA 9050: Support could not be provided that 4 of 4 reports selected for testing had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports selected for testing had been reviewed and approved prior to submission. ETA 9055: Support could not be provided that 4 of 4 reports selected for testing had been reviewed and approved prior to submission. Cause: The Department does not have sufficient internal controls to ensure that reports were reviewed and approved prior to submission. Effect: A lack of review and approval of reports could allow incorrect data to be reported which could misrepresent the State’s financial and programmatic performance in the program. Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all reports are reviewed by an authorized State official prior to submission and that supporting documentation providing evidence of supervisory review is maintained and available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-007 Prior Year Finding: 2024-010 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 25A55UI000119 (10/1/2024 – 12/31/2027) Compliance Requirement: Period of Performance Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance and expenditures were missing evidence of approval prior to issuance of payment. Context: Nine of sixty transactions selected for testing were charged to the award before the allowable period of performance. The grant award start date was October 1, 2024, but costs were incurred in August and September 2024. Two of sixty transactions selected for testing were missing evidence of review and approval prior to issuance of the payment. Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance nor that payments were reviewed and approved prior to issuance. Effect: Unallowable costs were charged to the program. Questioned costs: $2,267, which represents the total incurred before the allowable period of performance. Recommendation: We recommend the Department review and enhance its procedures and controls to ensure that, prior to charging costs to the program, they are incurred within an award’s allowable period of performance and that payments are reviewed and approved by a supervisor who has knowledge of costs that are allowable under the program. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-008 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 23A60UI038010 (1/1/2022 – 9/30/2024) 23A60UR000010 (1/1/2023 – 9/30/2025) 24A60UR000093 (1/1/2024 – 9/30/2026) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. RESEA-related performance reports are due on the 20th day of the second month following the end of the reporting quarter. A state UI staff member must review these reports for accuracy each calendar quarter and prior to submission, in addition to being reviewed by the RESEA program lead (if a different staff member). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not follow proper procedures nor did it thoroughly document RESEA cases. Context: For two of forty cases selected for testing, the Department did not follow proper procedures. The cases were both identified as “Failed to Report” and the Department did not properly document the cases, it did not send the cases to adjudication, nor were eligibility review forms completed. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure it followed procedures and met RESEA program requirements. Effect: Failure to properly document or follow-up on RESEA cases in accordance with its own procedures and program requirements could delay the participants’ reentry into the workforce and prolong their receipt of unemployment benefits. Recommendation: The Department should update its internal controls to ensure that RESEA procedures are followed, that cases are properly documented and appropriate actions are taken when participants fail to meet program requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-009 Prior Year Finding: 2024-009 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 25A55UI000119 (10/1/2024 – 12/31/2027) UI370952155A50 (9/1/2021 – 5/22/2025) 23A60UB000019 (8/3/2023 – 5/22/2025) 24A60UD000052 (8/20/2024 – 8/20/2027) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without documentation of supervisory review and approval. Context: For two of sixty transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment. Cause: The Department’s procedures were not sufficient to ensure that payments were reviewed and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-010 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: National Infrastructure Investments Assistance Listing Number: 20.933 Award Number and Year: 69A36520401930BLDVT (8/1/2020 – 10/31/2026) CA0714 (4/29/2022 – 4/29/2032) CA0751 (5/1/2023 – 10/1/2028) CA0906 (1/24/2025 – 11/1/2030) Compliance Requirement: Reporting – Schedule of Expenditure of Federal Awards Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: The auditee must prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the auditee's financial statements. The schedule must include the total Federal awards expended as determined in accordance with § 200.502. Information reported on the SEFA must include a list of individual Federal programs by Federal agency and the applicable Assistance Listing number(s), and a total of the amount expended for each individual Federal program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Transportation (Agency) reported federal program expenditures on the SEFA under the wrong Assistance Listing Numbers (ALN). Context: When the Agency compiled its SEFA, it reported $11 million under ALN 20.314-Railroad Development. During the audit, it was determined that expenditures reported under ALN 20.314 should have been $0 and $10.7 million of this amount should have been reported under ALN 20.933-National Infrastructure Investment. Additionally, $312,460 should have been reported under ALN 20.326-Federal-State Partnership for Intercity Passenger Rail, and $6,739 should have been reported under ALN 20.325-Consolidated Rail Infrastructure and Safety Improvements. Cause: The Agency’s procedures were not sufficient to ensure that the SEFA was accurate and that program expenditures were reported under the correct ALNs. The Agency assigned an incorrect ALN to the Expenditure Account associated with these payments in the accounting system which led to the SEFA reporting error. Neither payment processing nor SEFA preparation controls prevented or detected the errors. Effect: The Department’s SEFA did not agree with supporting documentation. The Department understated total expenditures under ALN 20.933 by 51%, under ALN 20.325 by 1%, under ALN 20.326 by 100%, and overstated total expenditures under ALN 20.314 by 100%. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures for payment processing and SEFA preparation to ensure that payments are properly coded in the accounting system and that expenditures are reported accurately on the SEFA. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: National Infrastructure Investments Assistance Listing Number: 20.933 Award Number and Year: 69A36520401930BLDVT (8/1/2020 – 10/31/2026) CA0714 (4/29/2022 – 4/29/2032) CA0751 (5/1/2023 – 10/1/2028) CA0906 (1/24/2025 – 11/1/2030) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Transportation (Agency) did not report subawards in accordance with FFATA requirements. Context: One of two subawards selected for testing was not reported timely or accurately in accordance with FFATA requirements. Specifically, we noted the following: • The subaward was issued for $7.7 million, but only $560,000 was reported. • The subaward was issued on 7/3/2024 but was not reported until 4/22/2025. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures and controls were not sufficient to ensure that subawards were reported timely and accurately. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review its procedures and internal controls to ensure that subawards are reported timely and accurately to SAM.gov in no later than the end of the month following the month of issuance or modification. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-012 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration Public Service Department Federal Program: COVID-19 – Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Award Number and Year: CPFFN0202 (2/4/2022 – 12/31/2026) Compliance Requirement: Reporting – Performance Reports Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the State Compliance and Reporting Guidance issued by the Department of the Treasury (Treasury), recipients must submit Performance Reports on a quarterly basis. A Project and Expenditure Report must be completed for each Project included in an approved Program Plan, beginning after a Project has been selected and a subaward has been executed (if applicable). Project and Expenditure Reports will be due each quarter thereafter for the remainder of the period of performance to continue to collect performance data. Additionally, to provide public transparency, Treasury will seek information from Recipients regarding their plans and practices related to promoting on-time and on-budget delivery related to CPF Projects. The following information must be submitted with respect to the use of CPF funds during the period covered in Project and Expenditure Reports: Administrative Expenses and Program Budget Updates. The following information will be required in Project and Expenditure Reports for each Project: Project Information, Obligations and Expenditures, Project Status, Special Statutory Matching Funds Requirements, Labor, Required Performance Indicators and Project Data. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Administration (Agency) and the Department of Public Service (Department), Vermont Community Broadband Board (VCBB), were unable to provide supporting documentation for administrative costs reported on the Quarterly Performance Reports. Context: For two of two Quarterly Performance Reports selected for testing, support for administrative expenses was provided, however the data consisted of VCBB’s actual administrative expenditures combined with the Department of Libraries total drawdown amounts for the quarter rather than actual expenditures incurred. This method caused administrative expenses in the Treasury report to be misstated in the quarters tested during FY 2025. The Performance reports are prepared by VCBB using the compiled data, and the Agency oversees program activities, including reporting. Administrative Expense key line items are: current period obligations, cumulative obligations, current period expenditures, and cumulative expenditures. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it maintained consistency of supporting documentation for the administrative expenses it reported on the Quarterly Performance Reports. The Agency’s controls for oversight of the program were not sufficient to ensure that Quarterly Performance Reports were accurate and agreed with supporting documentation. Effect: The accuracy of the reported administrative expenses could not be verified. Questioned costs: Undetermined. Recommendation: We recommend the Department and the Agency review their respective procedures and internal controls to ensure that Quarterly Performance Reports are accurate, are supported by documentation, and that supporting documentation is maintained and is readily available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-013 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Public Service Department Department of Libraries Federal Program: COVID-19 – Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Award Number and Year: CPFFN0202 (2/4/2022 – 12/31/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Public Service Department and the Department of Libraries (the Departments) did not report subawards timely in accordance with FFATA requirements. Context: Five of five subawards selected for testing were not reported timely in accordance with FFATA requirements. One subaward issued by the Department of Libraries and four subawards issued by the Public Service Department were selected for testing and we noted the following exceptions: • Department of Libraries: 1 of 1 subaward was not reported timely. The subaward was issued on 9/23/2024 but was not reported until 3/31/2025. • Public Service Department: 4 of 4 subawards were not reported timely. The subawards were issued from January to December 2024 but were not reported until 3/31/2025 and 4/1/2025. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Departments indicated that technical limitations in the FSRS system prevented timely subaward reporting. After FFATA reporting transitioned to SAM.gov in March 2025, they were able to access the system and submit the previously unreported subawards. Effect: Subawards were not reported timely in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Departments’ review their procedures and internal controls to ensure that subawards are reported timely to SAM.gov in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-014 Prior Year Finding: No Federal Agency: U.S. Environmental Protection Agency State Agency: Department of Environmental Conservation Federal Program: Drinking Water Sate Revolving Fund Assistance Listing Number: 66.468 Award Number and Year: 99121S23 (10/1/2023 – 9/30/2030) 99121E23 (10/1/2023 – 9/30/2030) Compliance Requirement: Reporting – Schedule of Expenditure of Federal Awards Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: The auditee must prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the auditee's financial statements. The schedule must include the total Federal awards expended as determined in accordance with § 200.502. Information reported on the SEFA must include a list of individual Federal programs by Federal agency and the applicable Assistance Listing number(s), and a total of the amount expended for each individual Federal program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Environmental Conservation (Department) reported federal program expenditures on the SEFA under the wrong Assistance Listing Number (ALN). Context: During audit test work, auditors determined that $3.8 million reported on the SEFA under ALN 66.468-Drinking Water State Revolving Fund should have been reported under 66.458-Clean Water State Revolving Fund. This error was made in both total expenditures and the amount passed through to subrecipients. Correction of the reporting error increased total expenditures reported in ALN 66.458 by 32% and decreased total expenditures reported in ALN 66.468 by 7%. Cause: The Department’s procedures were not sufficient to ensure that the SEFA was accurate and that program expenditures were reported under the correct ALNs. Internal controls did not prevent or detected the errors. Effect: The Department’s SEFA did not agree with supporting documentation. The Department overstated total expenditures under ALN 66.468 by 7% and underreported total expenditures under ALN 66.458 by 32%. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance internal controls and procedures for SEFA preparation to ensure that expenditures are reported accurately on the SEFA. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-015 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Human Services Federal Program: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Award Number and Year: H126A240067 (10/1/2023 – 9/30/2025) H126A240068 (10/1/2023 – 9/30/2025) Compliance Requirement: Reporting – Case Services Report (RSA-911) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Grantees are required to submit the Case Service Report (RSA-911) on a quarterly basis no later than 45 days after the end of each quarter. Supporting documentation must be included in the service record or case management system for the required data elements pursuant to 34 CFR 361.47 and consistent with federal requirements at 2 CFR 200.303. Dates reported in the case management system must match the supporting documentation. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Case Service Reports submitted by the Agency of Human Services (Agency) did not agree with supporting documentation. Context: For 3 of 40 cases selected for testing, the Date of Initial Individualized Plan for Employment (IPE) (element 398) did not agree with supporting documentation. Cause: The Agency’s procedures were not sufficient to ensure that Case Service Reports were accurately prepared. Internal controls regarding review and approval of financial reports prior to submission were not sufficient to prevent or detect the errors. Effect: The reported Date of IPE for several cases did not agree with supporting documentation. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that Case Service Reports are accurate and agree with supporting documentation. The reviewer should verify that reports are tied to supporting documentation before they are approved and submitted. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-016 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000520 (8/1/2019 – 7/31/2027) Compliance Requirement: Reporting – Financial Reports Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Grantees are required to submit annual and final SF-425 Financial Reports which report total funds obligated and expended. Annual financial reports are due within 90 days after the end of the budget period and final financial reports are due within 120 days after the end of the period of performance. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Financial reports submitted by the Agency of Human Services (Agency) did not agree with supporting documentation. Context: Four quarterly financial reports were selected for testing, consisting of two reports for the base award and two for COVID funding for the 12/31/2024 and 3/31/2025 quarters. Specifically, we noted the following exceptions in the COVID funding reports: • For 2 of 4 quarterly reports selected for testing, the amounts reported on multiple line items did not tie to supporting documentation. • In the 12/31/2024 quarterly report, current quarter expenditures were not included in the amount reported. Cause: The Agency’s procedures were not sufficient to ensure that financial reports were accurately prepared. Internal controls regarding review and approval of financial reports prior to submission were not sufficient to prevent or detect the errors. Effect: The expenditure amounts reported did not agree with supporting documentation. Questioned costs: Undetermined Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that financial reports are accurate and agree with supporting documentation. The reviewer should verify that reports are tied to supporting documentation before they are approved and submitted. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-017 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 3/24/2025) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not meet all requirements of state and federal procurement policies when entering into a contract with a vendor. Context: For one of five contracts selected for testing, the Agency was unable to provide documentation that it had performed a cost analysis prior to finalizing the contract. A cost analysis is required by both state and federal regulations. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that a cost analysis was performed as part of the procurement process. Internal controls did not detect or prevent the error. Effect: Failure to perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-018 Prior Year Finding: 2024-018 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 3/24/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards were not reported in accordance with FFATA requirements. Context: Two of fifteen subawards and subaward amendments selected for testing were not reported in accordance with FFATA requirements. The subawards were not reported until after they were selected by auditors for review. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards timely and to review previously issued subawards to ensure that all subawards were reported. The subaward exceptions noted were issued prior to the full implementation of the CAP. Cause: The Agency’s procedures and controls were not sufficient to ensure that subawards were reported in accordance with FFATA reporting requirements. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely in accordance with FFATA requirements and that all previously issued subawards are reported. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-019 Prior Year Finding: 2024-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2401VTCCDD (10/1/2023 – 9/30/2026) 2501VTCCDD (10/1/2024 – 9/30/2027) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address eleven specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Per 45 CFR 98.44(b), a Lead Agency must describe in the State Plan its established requirements for pre-service or orientation (to be completed within three months) and ongoing professional development for caregivers, teachers, and directors of child care providers of services for which assistance is provided under the CCDF that, to the extent practicable, align with the State framework. Accessible pre-service or orientation training in health and safety standards appropriate to the setting and age of children served addresses: (i) Each of the requirements relating to matters described in §98.41(a)(1)(i) through (xi) and specifying critical health and safety training that must be completed before caregivers, teachers, and directors are allowed to care for children unsupervised; (ii) At the Lead Agency option, matters described in § 98.41(a)(1)(xii); and (iii) Child development, including the major domains (cognitive, social, emotional, physical development and approaches to learning); Control: Per 45 CFR Part 98, Child Care and Development Fund recipients must establish and maintain robust internal controls to ensure integrity and accountability of program funds. Recipients must implement procedures designed to investigate and recover fraudulent payments, to impose sanctions on clients or providers in response to fraud, document and verify eligibility, and promote compliance with all applicable laws and regulations. These internal control mechanisms serve to prevent misuse, mismanagement, or fraudulent activity, thereby fostering accountability and transparency in the stewardship of federal funds allocated through the CCDF program. Condition: The Agency of Human Services (Agency) did not ensure that all providers completed required annual training nor that training in health and safety standards addressed the required eleven elements per 45 CFR sections 98.41 and 98.44(b)(1). Context: Nine child care providers were selected for testing and multiple exceptions were noted, including incomplete documentation, lack of training covering all required health and safety topics, and ineffective monitoring controls. Specifically, we noted the following: • For 9 of 9 child care providers selected for testing, the Agency’s provider training did not include all eleven of the required health and safety topics. The HHS Administration for Children & Families, Office of Child Care’s (OCC) monitoring report indicated that training for some of the eleven required health and safety topics was not provided. Since the Agency did not offer training for all required elements, no providers were able to meet this requirement. • For 5 of 9 child care providers selected for testing, the Agency was unable to provide documentation it had ensured the providers completed the required 15 hours of annual training. There was a lack of documentation that training requirements were reviewed as part of the annual site visit and insufficient documentation in provider corrective action plans. Cause: The Agency’s procedures were insufficient to ensure complete monitoring documentation of child care provider training. Training content did not include all 11 required health and safety topics. Internal controls did not detect or prevent these errors. Effect Deficiencies in the content and monitoring of provider health and safety training could result in inadequately trained child care providers, creating a risk to the health and safety of children receiving subsidies under the program. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance training monitoring procedures and controls to ensure that all child care providers complete required health and safety training. The Agency should update its training content to include all required elements and ensure that provider corrective action plans and documentation are properly maintained. Site visit documentation should clearly indicate the results of training requirement monitoring. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Foster Care – Title IV-E Assistance Listing Number: 93.658 Award Number and Year: 2401VTFOST (10/1/2023 – 9/30/2025) 2501VTFOST (10/1/2024 – 9/30/2026) Compliance Requirement: Eligibility Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: The Foster Care program has established eligibility requirements for foster children who receive benefits under the program and for licensed foster care providers. Foster care benefits may be paid on behalf of a child only if all program eligibility requirements are met. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) claimed Foster Care expenses on behalf of children who were not eligible for the program. Context: Auditors selected forty children on whose behalf Foster Care payments were made during FY 2025. Seven of the forty children were determined not to be eligible for Foster Care. The Agency uses the Child Development Division Information System (CDDIS) to manage case data and eligibility for multiple federal programs. Due to a coding error, the children were incorrectly identified in CDDIS as Foster Care eligible. Cause: The Agency’s procedures were not sufficient to ensure that cases in CDDIS were coded to the eligible federal program nor that payments were charged to the correct federal program. Internal controls did not prevent or detect the errors. Effect The Agency claimed Foster Care expenses on behalf of children who were not eligible for the program. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it correctly identifies the eligible federal program for all cases coded in CDDIS. We further recommend that children on whose behalf payments are charged to Foster Care are eligible for benefits under the program. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-021 Prior Year Finding: 2024-024 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2405VT5MAP (10/1/2023 – 9/30/2024) 2505VT5MAP (10/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. Provider health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Context: Sixty providers were selected for testing, and the following exceptions were noted: • For five of sixty providers selected for testing, documentation was incomplete to support that the provider was in good tax standing. The provider’s tax standing was verified by the Agency, but the letter was not signed by the Vermont Tax Department Commissioner and uploaded to the PMM as required. • For one of sixty providers selected for testing, the Agency did not perform a tax standing verification during the provider’s revalidation. Cause: The Agency’s 3rd-Party provider did not consistently maintain verification of tax standing documentation in the PMM. Procedures and controls were not sufficient to ensure that a tax standing verification was performed for all providers during revalidation. Although the Agency indicated it had implemented its corrective action plan from a prior year audit, it noted that exceptions may be identified until all providers have completed their 5-year revalidation by the Agency. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review procedures and controls and complete implementation of its corrective action plan from a prior audit to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.