Audit 394493

Finding Number 2025-001 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2024-002 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, Tennessee State University continued to have inadequate procedures to ensure Title IV credits were refunded in accordance with federal guidelines, and in the current year, did not properly provide disbursement notifications BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. These Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, a student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of the total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. As a condition of these programs, institutions must provide notifications of the amounts awarded and loans disbursed. In addition, institutions are required to refund credits to the student’s account within 14 days of posting the award to the student’s account. CONDITION AND CAUSE In response to the prior finding, which noted compliance issues during the 2024 academic year, management, in collaboration with outside consultants, had begun to refine financial aid procedures, including reactivating the automatic refund process for spring 2025 with enhanced automatic notifications for all students receiving loan disbursements. Management also emphasized the need to fill the vacant Account Manager position in the Bursar’s office. However, refining these procedures did not adequately address compliance issues for the 2025 academic year. We tested a sample of 40 Title IV recipients at Tennessee State University (the university) to determine whether the university met disbursement requirements, and we identified errors in 40 (100%) of the Title IV recipients. These requirements included refunding any credits to student accounts created by Title IV aid within 14 days of the disbursement; sending a general notification to Title IV recipients that included the expected disbursement date, amount, and type of aid awarded; and notifying Direct Loan borrowers when their loans were disbursed. The university had disbursement errors with all 40 students selected for testing, resulting in a total of 72 disbursement errors. Figure 1 details the number of students with multiple errors identified. See Schedule of Findings and Questioned Costs for figure. Refund Timeliness Of the 40 students tested, 23 had a credit balance resulting from the disbursed Title IV aid. We noted that 3 of the 23 students (13%) had Title IV credits that were not refunded within 14 days of the disbursement date. These 3 separate refunds were not refunded timely, ranging from 19 to 84 days late. · For 1 student, the university did initially provide a timely refund; however, the refund was insufficient. The university applied the complete refund 84 days late. · For 2 students, the university applied Title IV aid retroactively to the fall 2024 term, creating a credit balance. The university refunded these balances 19 and 57 days late. Award and Direct Loan Disbursement Notifications We also tested our sample to determine whether 2 required notifications were sent to students. The first required letter notifies students of the amount and type of Title IV funds they are expected to receive, as well as how and when the disbursements will be made. This notification must be sent prior to the university making any disbursements. The university uses an automated system to notify students of the Title IV aid they have been awarded. The template used for the general award notifications does not specify when students can expect to receive their aid. Because the university did not include expected disbursement dates in the general award notifications sent to students, and every Title IV recipient in our sample received at least 1 general award notification, this error was recorded for all 40 students (100%). In addition, we identified other general award notification errors for 25 of the 40 students (63%) tested. · For 22 of the students tested, the university did not provide notification of their Title IV aid to be applied for the spring 2025 term. · For 2 of the students tested, the university did not provide notification of their Title IV aid to be applied for the fall 2024 term. · For 1 of the students tested, the university did not provide notification of their Title IV aid until after the disbursement date. The student was notified 3 times, representing 1, 2, and 8 days late. The second required letter is specific only to those students receiving Direct Loans or Teacher Education Assistance for College and Higher Education (TEACH) Grants. The letter notifies students of 1) the date and amount of the disbursement, 2) the student’s or parent’s right to cancel, and 3) the procedure and time by which the student or parent must notify the institution that they wish to cancel. We noted that 30 students in our sample received Direct Loans and should have received a disbursement notification. However, 4 of these 30 students (13%) did not receive a disbursement notification for their Direct PLUS Loans. Management did not send these notifications because the notification system was not programmed to trigger when a student only received Direct PLUS Loans. Management acknowledged that a change in administration delayed system access, resulting in the failure to correct the system and properly notify students of fall 2024 disbursements in a timely manner. CRITERIA The 2024–2025 Federal Student Aid Handbook, Volume 4, Chapter 2, states, If FSA [federal student aid] disbursements to a student’s account at the school create a Title IV credit balance, the school must pay the credit balance directly to the student or parent as soon as possible but no later than 14 days after: [emphasis in original] • the first day of class of a payment period if the credit balance occurred on or before that day, or • the balance occurred if that was after the first day of class. In addition, Volume 4, Chapter 2, of the handbook states, A school must notify a student of the amount of funds the student and their parent can expect to receive from each FSA program, including FWS [Federal Work Study], and how and when those funds will be disbursed. This notification must be sent before any disbursements are made. Finally, Volume 4, Chapter 2, of the handbook also states,: Except in the case of loan funds made as part of a post-withdrawal disbursement (see Volume 5 for notification requirements in such cases), when Direct Loan or TEACH funds are being credited to a student’s ledger account, the school must also notify the borrower in writing (paper or electronically) of the: • anticipated date and amount of the disbursement; • student’s or parent’s right to cancel all or a portion of a Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Department; and • procedures and deadlines by which the student or parent must notify the school that they wish to cancel the Direct Loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. EFFECT Timely refunding credits to students is essential to fulfilling the goals of Title IV programs. Students may depend on these refunds to pay for non-institutional charges, such as off-campus housing, transportation, or meals. Furthermore, if the university does not notify students of expected aid, this could impact decision-making for students and their families when determining whether to attend the university. Without these funds, students may not have the resources to pay for these potentially significant costs, which can be a barrier to a successful college career. In addition, failure to notify students of important deadlines and information regarding their Direct Loans or TEACH Grants could cause students to incur loans they wished to cancel, resulting in unwanted debt. Finally, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate the university’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. RECOMMENDATION Management should revise and adequately document procedures to ensure that students receive the required disbursement notifications and to ensure that credits on student accounts are refunded within 14 days of Title IV aid being disbursed. In addition, leadership should take necessary steps to provide adequate staffing and training to ensure compliance. Finally, management should establish additional review procedures to meet disbursement requirements. MANAGEMENT’S COMMENT We concur. The Refund Timeliness and Disbursement Notification Accountabilities are owned by the Bursar’s Office and the Financial Aid Office, respectively, and as such have required separate remediation. While we have made significant improvements, including updating process documents, increasing external staffing support, and internal training, the University’s “last dollar” scholarship approach creates more complexity that we continue to address. Post fiscal-end June 30, 2025, we have updated the text scripts to ensure all required information is included, as well as activated non-term specific automated notifications. These updates were put into place for the Fall 2025 semester and are expected to provide additional safeguards from these errors going forward. Additionally, our comprehensive corrective action is to rebuild our application of payment sequencing, including creating new detail codes with accurate parameters for all awards. This will allow our Banner system to properly automate refunds without the manual initiation and interventions currently required. We expect this project to be completed by the Fall 2026 semester.

Finding Number 2025-002 Assistance Listing Number 84.063 and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2024-003 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, for the federal Direct Loan and Pell Grant programs, Tennessee State University continued to not report timely and accurate information regarding students’ enrollment statuses BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For student recipients of Pell Grants or Direct Loans, ED requires institutions to report students’ enrollment statuses for each term to the National Student Loan Data System (NSLDS). The institution is also required to report changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. Tennessee State University’s (the university) Enrollment Reporting Office reports directly to the National Student Clearinghouse (NSC). The data entered into NSC is automatically uploaded to NSLDS. It is then the responsibility of the university’s management to maintain the data in NSLDS and make any necessary changes or updates. CONDITION AND CAUSE University management, in response to the prior finding, hired additional staff, reviewed and updated operational procedures, and communicated the withdrawal process in training and staff meetings; however, these corrections did not resolve the issues around enrollment reporting and withdrawal dates. We tested a sample of 60 Direct Loan borrowers and/or Pell Grant recipients at the university. During our testing, we found that the university did not correctly report status changes in NSLDS for 9 of the 60 students (15%). These 60 students had a total of 93 reportable status changes during the academic year, and management incorrectly reported 11 of those 93 (12%) status changes to NSLDS as of July 30, 2025 (the date of our testwork). As stated above, a status change includes changes to students’ enrollment, such as graduations, withdrawals, and transitions between full-time and part-time status. There were instances where management reported the proper enrollment information in NSC; however, we noted the information in NSLDS was incorrect. Despite management’s responsibility to ensure that enrollment information is correctly reported in NSLDS, management either did not properly update the enrollment information in NSLDS or did not review the information to ensure statuses were accurate. Management was unable to determine the cause of the discrepancies that led to improper reporting in NSLDS. The errors included instances of statuses not reported and reported incorrectly. Specifically, we found the following: Not Reported · For 1 student, the university did not report the student as attending three-quarters time for the fall 2024 term. There was no enrollment history in NSLDS for this student until the spring 2025 term. · For 1 student, the university did not report the student’s status, despite the student being enrolled in 9 credit hours. · For 1 student, the university had not reported the student’s full-time status to NSLDS, as of the date of our testwork, July 30, 2025. During the first week of the spring 2025 term, 1 student increased enrollment to half-time and then changed to full-time 9 days later. This error is likely due to the half-time status being reported 58 days late. · For 1 student, management could not provide any enrollment history in NSLDS. The student had 2 status changes that should have been reported for the 2024 fall term. According to management, the cause was likely due to the student being purged and then reinstated in the middle of the semester. · For 1 student who completed academic requirements in fall 2024 and graduated in May 2025, the university did not update the reporting roster to reflect the student’s graduation status. · For 1 student, the university did not report the student’s May 2025 graduation. As of July 30, 2025, the date of the testwork, NSLDS still showed the student as attending full-time. In addition to failing to report the student’s graduation status, because the student had federal loans, the university was required to report the status change within 60 days, but failed to do so. Reported Incorrectly · For 1 student, the university incorrectly reported the student as three-quarters time, despite the student being enrolled in 12 credit hours for the entire spring 2025 term. Management should not have reported a status change. · For 1 student, the university incorrectly reported the student as less than half-time despite the student being enrolled in 11 credit hours, which should have been three-quarters time. · For 1 student, management reported an incorrect effective date. The student began attending full-time on August 23, 2024. However, the university did not update the student’s enrollment status to full-time until the following spring semester and reported an effective date of January 3, 2025—133 days after the actual status date. CRITERIA The 2024–2025 Federal Student Aid Handbook, Volume 2, Chapter 3, states that institutions “must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that file.” In the introduction to Chapter 1, the NSLDS Enrollment Reporting Guide states, “Accurate and timely Enrollment Reporting to NSLDS is essential to the Department of Education’s successful delivery of Title IV aid.” The requirements are established in Title 34, Code of Federal Regulations, Part 685, Section 309(b). Chapter 4.4.2 of the NSLDS guide states, Enrollment Status Effective Date is the date that the current enrollment status reported for a student was first effective. . . . Effective Date, and its related enrollment status, must be reported for both the Campus-Level (Campus Enrollment Effective Date) and the Program-Level (Program Enrollment Effective Date), however the dates may not always match, depending on the student’s circumstance. In addition, Chapter 7.14.4 of the NSLDS guide states, “NSLDS records must be accurately matched with your enrollment records. You should review, update, or verify student enrollment statuses and other information with information that appears on the Enrollment Reporting Roster file.” EFFECT Timely and accurate enrollment reporting is critical for effective management of ED programs. The accurate administration of the Title IV programs depends heavily on the accuracy of the enrollment information reported by schools. Accurate, timely, and complete enrollment data is also important to the students, who can view their current campus enrollment information and their program enrollment history. Also, if an individual no longer attends the university but their lack of attendance is not reported, the individual’s loan repayment grace period could be improperly extended, resulting in the student’s loan repayments being improperly deferred. In addition, if the university violates federal requirements, ED could impose a fine on the university and could limit, suspend, or terminate its participation in a Title IV program. These actions would negatively affect the university’s operations and the students impacted by the loss of Title IV aid. RECOMMENDATION Management should review and update its processes as necessary to ensure the Enrollment Services Office uploads and submits the correct information to NSLDS. In addition, the Assistant Vice President of Admissions and Records should ensure that staff know reporting deadlines and the importance of reporting enrollment status changes. The Assistant Vice President of Admissions and Records should also ensure that enrollment status changes are reported timely and the Financial Aid Office is promptly notified. Management should implement a review throughout each term to verify that accurate information is reported in NSLDS. MANAGEMENT’S COMMENT We concur. The management of and the compliance with Title IV programs accountability is jointly owned by the Admissions & Records Office and the Financial Aid Office, and as such require commingled remediation. While we have made significant improvements in the activities in the separate areas, including hiring additional staff, updating process documents, and re-emphasizing the process during staff meetings, these findings reflect there is more to do related to the connectivity activities and procedures of the Offices to ensure both accurate and timely reporting of students’ enrollment statuses. We have identified this is particularly critical in the compliance procedures that require sequential actions by different departments. Starting in the Fall 2025 semester, the Financial Aid Office receives an automated file of the students who have withdrawn that day. This report serves as a notice to review and update students’ enrollment statuses. The additional procedure helps to ensure accurate dates are being captured timely. In addition to the process improvements, we continue to create a higher standard of operating effectiveness to ensure all critical policies and procedures are being executed properly without exception.

Finding Number 2025-003 Assistance Listing Number 84.007, 84.063, and 84.268 Program Name Student Financial Assistance Cluster Federal Agency Department of Education State Agency Tennessee State University Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding 2024-004 Pass-Through Entity N/A Questioned Costs Assistance Listing Number 84.063 Federal Award Identification Number P063P070381 Amount $10,757 Assistance Listing Number 84.268 Federal Award Identification Number P268K250381 Amount $743 FINDING As noted in the two prior audits, Tennessee State University continued not to return Title IV funds in compliance with federal regulations BACKGROUND The Student Financial Assistance programs provide financial assistance to eligible students attending institutions of postsecondary education. The Title IV programs include assistance such as Pell Grants, Direct Student Loans, and Federal Work Study. To be eligible for student financial assistance, the student must first complete the Free Application for Federal Student Aid (FAFSA). Each school listed on a student’s FAFSA will receive the student’s Student Aid Report. The school then notifies the student of their total aid package. The U.S. Department of Education (ED) has established certain requirements for each school to participate in the student financial assistance programs. For Title IV recipients who did not complete at least 60% of the semester, the school is required to perform a calculation to determine the amount of unearned aid that it must return to ED. The university is responsible for the institution’s calculated return. The university has no role in returning any portion of the student’s calculated return when the only impacted aid is Direct Loans. CONDITION In response to the prior audit finding, management stated that the university would improve the communication process between the Registrar’s Office and the Financial Aid Office by sending a confirmation acknowledgement email upon receiving the daily withdrawal report. This update was insufficient in addressing the ongoing compliance issues. We tested two groups of students who officially or unofficially withdrew from classes at Tennessee State University (the university) during the 2024–2025 award year: those who completed less than 60% of the semester and those who completed more than 60% of the semester. Testwork on Students Who Completed Less Than 60% of the Semester First, we selected 38 student withdrawals from a population of 106 students who had an official or unofficial withdrawal before the 60% completion date. We tested these withdrawn students to ensure that their withdrawal dates were accurate, that staff performed return calculations correctly, and that the university returned the correct amounts to ED within the required timeframes. All 38 student withdrawals (100%) we reviewed contained errors, with a total of 55 distinct issues. The university did not properly identify 3 withdrawals (8%) as official, did not return unearned funds or disburse post-withdrawal earned funds within the required timeframe for 34 withdrawals (89%), and miscalculated the Title IV funds to be returned to ED for 16 withdrawals (42%). Additionally, university management could not support the last date of attendance for 2 withdrawals (5%). We tested these cases using the withdrawal dates recorded in the university’s system; however, we were unable to verify their accuracy. Errors related to timeliness and calculation are detailed below. Timeliness Of the 38 student withdrawals, the university did not return funds within the required timeframe for 34 student withdrawals (89%). For 3 of these students, the university had not returned any funds as of the testwork date, October 8, 2025 (making the university 306 to 373 days late). The remaining 31 withdrawals were returned more than 45 days after the date of determination, with delays ranging from 99 to 203 days. Calculation Errors Of the 38 student withdrawals, 16 involved miscalculations of return of funds, resulting in questioned costs of $9,042 and over-returns of $13,872. Specifically, we found the following: • For 2 students, the university incorrectly determined the withdrawal date to be before the 60% completion point. However, 1 student’s last date of attendance and another student’s manual withdrawal occurred after the 60% point. The university should not have returned Title IV aid because both students completed at least 60% of the semester, resulting in an over-return of $6,265. • For 2 students, the university incorrectly calculated that the students were eligible for an additional disbursement of funds; however, a return should have been calculated, resulting in questioned costs of $1,169. • For 1 student, the university calculated and returned the correct amount, but later reversed the return and re-credited the student’s account. These funds should have been returned, resulting in questioned costs of $843. • For 1 student, the university used an incorrect withdrawal date of October 3, 2024, instead of the official date of September 18, 2024. Additionally, management incorrectly identified funds as undisbursed. By using a later withdrawal date and overreporting undisbursed aid, the university reduced the calculated institutional return amount; however, the university returned both the institution’s and the student’s share. These errors resulted in an over-return of $3,269. • For 2 students, the university used incorrect withdrawal dates. For the first student, management recorded the withdrawal date as October 1, 2024, instead of the correct date of September 27, 2024. For the other student, management treated the withdrawal as unofficial with a date of October 10, 2024, although the student had submitted an official withdrawal form dated September 10, 2024. These errors resulted in questioned costs of $2,530. • For 4 students, the university used incorrect dates for the beginning and ending of the term in the return calculation. For the fall term, the university used August 26 to December 6 instead of August 19 to December 5. For the spring term, the university used January 3 to May 5 instead of January 14 to May 2. Additionally, for 2 of these students, the university returned funds that only affected Direct Loans and were not the institution’s responsibility. These errors resulted in questioned costs of $667 and an over-return of $3,568. • For 4 students, the university miscalculated the return of funds, but we could not identify why the errors occurred. These cases resulted in questioned costs of $3,833 and an over-return of $770. Testwork on Students Who Completed More Than 60% of the Semester We also reviewed all 14 student withdrawals where students had completed more than 60% of the semester in which they withdrew. We tested these withdrawn students to ensure that the university recorded the withdrawal date correctly, had adequate attendance records to support the withdrawal date, and did not remove Title IV funds from the account. Of the 14 student withdrawals, we identified 6 errors (43%). For 1 student withdrawal (7%), management was unable to support an official withdrawal. For 5 student withdrawals (36%), the university recorded inaccurate withdrawal dates, with discrepancies ranging from 1 to 40 days. Due to the withdrawal date errors, management misclassified 1 student, marking them as withdrawn after the 60% point when they actually withdrew before completing 60% of the term. In this case, the university should have calculated and returned Title IV aid, resulting in questioned costs of $2,458. CRITERIA The 2024–2025 Federal Student Aid Handbook, Volume 5, Chapter 1, states, A pro rata schedule is used to determine the amount of Title IV funds the student has earned at the time of withdrawal up through the 60% point in each payment period or period of enrollment. After the 60% point in the payment period or period of enrollment, a student has earned 100% of the Title IV funds the student received and was scheduled to receive during the period [emphasis in original]. The 2024–2025 Federal Student Aid Handbook, Volume 5, Chapter 2, Part 2, states, • [Student’s Withdrawal Date] Official Notification – The date the student begins the school’s withdrawal process, or the date that the student otherwise provides notification (If both circumstances occur, use the earlier withdrawal date) [emphasis in original]. • Official Notification Not Provided – The date that the school determines is related to the circumstance beyond the student’s control, or the midpoint of the payment period or period of enrollment, as applicable. . . • [Alternative approach] In place of the dates listed, a school may always use, as a student’s withdrawal date, the student’s last date of attendance at an academically related activity if the school documents that the activity is academically related and that the student attended the activity. The 2024–2025 Federal Student Aid Handbook, Volume 4, Chapter 3, states, Schools must return funds disbursed to a student who failed to begin attendance as soon as possible but no later than 30 days after the date they become aware that the student has not begun and will not begin attendance [emphasis in original]. The 2024–2025 Federal Student Aid Handbook, Volume 5, Chapter 2, Part 1, states, An institution is not required to return the inadvertent overpayment immediately but must return it within 45 days of the date of the institution’s determination that the student withdrew (the time frame for an institution’s return of Title IV funds under 34 CFR [Code of Federal Regulations] 668.22(j)(1)). An institution must return an inadvertent overpayment in accordance with the applicable regulations for returning overpayments. Please see Volume 4, Chapter 3 for more information on overpayment procedures [emphasis in original]. CAUSE Based on our review, it appears that management did not have proper oversight and review procedures over the return of Title IV funds, as we noted multiple issues regarding both the calculation itself as well as the timing. Specifically, the university performed the Title IV return calculation using cost of attendance instead of institutional charges and entered the withdrawal date as the date the withdrawal was processed instead of the last date the student attended or the date on the signed withdrawal forms. In addition, management did not have a system in place to ensure all withdrawals and returns were processed timely. The Director of Financial Aid also stated that the Financial Aid Office temporarily lost access to federal systems due to significant staff turnover. Additional delays occurred during the implementation of policy changes under the new federal administration. EFFECT For the 52 students tested, the university over-returned $13,872 and under-returned $11,500 to students. The $11,500 was identified as questioned costs. Violations of the federal requirement to timely return Title IV funds to ED could result in ED imposing a fine on the university and/or limiting, suspending, or terminating the university’s participation in a Title IV program. These actions could hurt the university and the students impacted by the loss of Title IV aid. In addition, incorrect return calculations and/or withdrawal dates can negatively impact students. If the university incorrectly calculates and returns the amount of unearned aid to ED, the errors could impact the amount of aid the student is eligible to receive in future terms or could result in a student having an incorrect account balance. RECOMMENDATION The Registrar’s Office and the Financial Aid Office should follow federal regulations. Management should ensure that the Financial Aid Office reperforms all return of Title IV funds calculations and makes necessary corrections to student and federal fund accounts for the 2024–2025 academic year. Finally, management should ensure that the Registrar’s Office communicates any withdrawals to the Financial Aid Office in a timely manner. MANAGEMENT’S COMMENT We concur. The management of and the compliance with Title IV programs accountability is jointly owned by the Registrar’s Office and the Financial Aid Office, and as such requires commingled remediation. We have made significant improvements by automating the potential return calculation for students with less than 60% of the semester complete and documenting the procedures for these instances. However, these findings reflect there is more to do related to the validation of the input data (i.e., dates) to ensure output accuracy (i.e., the calculation) as well as the coordination between the two offices to initiate action when a student withdrawal occurs. We have identified this step as particularly critical and pervasive to our compliance. As stated in the response to Finding 2025-002, the Financial Aid Office now receives an automated file of the students who have withdrawn that day. This report serves as a notice to review and update students’ enrollment statuses. The additional procedure helps to ensure accurate dates are being captured timely. Additionally, our comprehensive corrective action, referred to in Finding 2025-001, to rebuild our application of payment sequencing will allow the automation of the returns once calculated. In addition to the process improvements, we continue to create a higher standard of operating effectiveness to ensure all critical policies and procedures are being executed properly without exception.

Finding Number 2025-005 Assistance Listing Number 84.048 Program Name Career and Technical Education – Basic Grants to States Federal Agency Department of Education State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2022 and 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Matching, Level of Effort, Earmarking Repeat Finding 2024-006 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, Department of Education management did not establish internal controls related to Maintenance of Effort (MOE) and matching requirements, and did not comply with state administrative MOE requirements BACKGROUND AND COMPLIANCE CRITERIA The U.S. Department of Education provides federal grant funds through the Carl D. Perkins Career and Technical Education (CTE) Act of 2006 (Perkins Act). The Perkins Act was reauthorized and amended by the Strengthening Career and Technical Education for the 21st Century Act, which provides grants to states to develop the academic knowledge and technical and employability skills of secondary and post-secondary students. As a recipient of federal funding, the department is subject to federal Matching and Level of Effort – Maintenance of Effort (MOE) requirements. Section 112(b) of the Perkins Act requires the department to match federal funds reserved for State Administration with non-federal funds, such as state appropriations, on a dollar-for-dollar basis. Sections 211(b) and 223(a) of the Perkins Act specify the following MOE requirements: • Section 211(b) requires the department to maintain its fiscal effort from state appropriations for CTE at a level not less than that of the preceding fiscal year. For example, state resources allocated for fiscal year 2025 must be equal to or greater than the amount allocated for fiscal year 2024. • Section 223(a)(7) additionally requires the department to contribute, from non-federal sources, an amount for State Administration that is at least equal to the amount contributed in the previous fiscal year. See Schedule of Findings and Questioned Costs for footnote. Each year, the U.S. Department of Education requires Perkins recipients to submit financial and performance information through the Consolidated Annual Report (CAR). The CAR includes data used to verify compliance with MOE requirements, including both Section 211(b) and 223(a) of the Perkins Act. Department staff prepare the CAR in January using data from the most recently completed fiscal year. For example, the CAR submitted in January 2025 included fiscal data for fiscal year 2024, and the CAR submitted in January 2024 included fiscal data for fiscal year 2023. PRIOR AUDIT RESULTS In the two prior single audits, we reported a finding related to the Matching, Level of Effort – Maintenance of Effort, and Earmarking compliance requirement. Specifically, we noted that department management had not developed or implemented adequate policies and procedures to ensure compliance with the matching(8) or MOE(9) requirements. The absence of controls limited management’s ability to provide sufficient documentation demonstrating compliance. See Schedule of Findings and Questioned Costs for footnote. As a result of these internal control deficiencies, we reported the following compliance-related conditions: • department management was unable to provide documentary evidence supporting compliance with matching requirements; and • department management was unable to provide documentation supporting adjustments or final amounts reported in the CAR for compliance with MOE. Department management concurred with the prior audit finding and stated that they would take corrective action, including assigning clear responsibility for control activities and compliance related to these requirements, developing policies and procedures, and maintaining documentation of review activities. CONDITION AND CAUSE Repeated Conditions Based on our review of controls and testwork to determine compliance, we found that although the department met both matching and overall MOE requirements for the program, management had still not established controls for the matching and MOE process. Specifically, management has yet to develop policies and procedures and maintain documentation of management’s review activities. The following repeated conditions are described as follows. Matching Based on our discussions with department management, CTE program staff attend monthly budget meetings to review and discuss program expenditures, which include both federal and state expenditures, and determine if any adjustments are needed. Department management thought that matching requirements were a part of this review; however, based on discussion with CTE program staff, the monthly budget meetings consist of a review for program allowability and not matching requirements specifically. Maintenance of Effort According to the Fiscal Director, the department’s Budget Director provides the financial data for the CAR each year from Edison, the state’s accounting system. The Fiscal Director stated that she reviews the financial data and discusses any concerns or questions with CTE Program Managers. However, the Fiscal Director was unable to provide any documentation of her review or discussion with the program managers. New Condition Additionally, we noted one new condition in the current audit. According to the CARs for fiscal years 2023 and 2024, the department reported non-federal contributions of $1,784,950 in 2023 and $1,262,644 in 2024 for State Administration. As a result, the department’s non-federal contributions decreased by $522,306 from fiscal year 2023 to fiscal year 2024, and department management was unable to provide any additional documentation to demonstrate compliance with Section 223(a) of the Perkins Act. Department management stated that their normal process is to review administrative expenditures and make necessary adjustments each year to meet state administrative MOE requirements; however, this process did not occur during fiscal year 2024. Current Risk Assessment and Internal Control Criteria In the department’s December 2024 Financial Integrity Act Risk Assessment, management identified risks associated with determining and meeting matching requirements for external grants, as well as risks related to maintaining compliance with overall MOE requirements. Management identified scheduled reviews as a control activity intended to mitigate these risks. However, based on the results of our review, we determined that management’s review procedures were not effective in reducing the risks of noncompliance with matching and MOE requirements. CRITERIA According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303, a non-federal entity must (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . (c) Evaluate and monitor the non-Federal entity’s compliance with statutes, regulations, and the terms and conditions of Federal awards. The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 10.03, “Design of Appropriate Types of Control Activities,” states, Management clearly documents internal control and all transactions and other significant events in a manner that allows the documentation to be readily available for examination. Also, Green Book Principle 12.03, “Documentation of Responsibilities Through Policies,” states, Management documents in policies for each unit its responsibility for an operational process’s objectives and related risks, and control activity design, implementation, and operating effectiveness. Green Book Principle 12.04, “Documentation of Responsibilities Through Policies,” states, Management communicates to personnel the policies and procedures so that personnel can implement the control activities for their assigned responsibilities. EFFECT Without appropriate internal controls over matching and MOE requirements, there is an increased risk that the department will not comply with applicable federal requirements and may miscalculate the state's required matching and MOE amounts. Such miscalculations could result in noncompliance, placing the department at risk of a reduction in federal funding for CTE activities in subsequent award years. A reduction in federal funding could, in turn, adversely affect the department's ability to provide essential services to students in Tennessee schools. Federal regulations outline the actions that federal agencies may take if a state entity fails to comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given performance period; (3) Requiring additional, more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the non-Federal entity to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Department management should design and implement effective internal controls to ensure compliance with federal matching and MOE requirements. These controls should include developing and documenting key processes and procedures to promote consistent and ongoing compliance. Management should also ensure they maintain documentation of review activities to demonstrate compliance and support ongoing monitoring of matching and MOE requirements. In addition, management should periodically evaluate the effectiveness of these control activities in mitigating identified risks and update the department’s annual risk assessment to reflect any new or revised controls implemented as a result of this finding. MANAGEMENT’S COMMENT The department concurs with this finding. Matching On July 10, 2025, cross‑divisional staff members from the Tennessee Department of Education (TDOE) participated in a virtual training with Andrew Johnson from the U.S. Department of Education (ED), Office of Career, Technical, and Adult Education (OCTAE). The training agenda included an overview of matching requirements for the Perkins grant. Additionally, TDOE has procured training scheduled for April 1, 2026. Cross‑divisional staff members will engage in a full day of training focused on both programmatic and fiscal topics, including matching requirements, to further build team capacity. To support internal collaboration, CTE program staff currently attend monthly budget meetings to review and discuss program expenditures—including both federal and state funds—and determine whether adjustments are needed. Historically, these meetings focused primarily on program allowability; however, they were expanded to include a review of matching requirements specifically. Maintenance of Effort (MOE) On July 10, 2025, cross‑divisional staff members from the Tennessee Department of Education (TDOE) participated in a virtual training with Andrew Johnson from the U.S. Department of Education (ED), Office of Career, Technical, and Adult Education (OCTAE). The training agenda included an overview of Maintenance of Effort (MOE) requirements for the Perkins grant. Additionally, TDOE has procured training scheduled for April 1, 2026. Cross‑divisional staff members will engage in a full day of training focused on both programmatic and fiscal topics, including MOE requirements, to further build team capacity. The Fiscal Director reviews financial data and discusses any concerns or questions with CTE Program Managers. Processes have been updated to include documentation of these discussions. The team is implementing internal controls to ensure compliance with federal matching and MOE requirements. These controls include developing and documenting key processes and procedures to promote consistent and ongoing compliance. Documentation of review activities will be collected to demonstrate compliance and support ongoing monitoring of fiscal practices. In addition, leadership will evaluate the effectiveness of these control activities in mitigating identified risks and update the department’s annual risk assessment to reflect any new or revised controls implemented as a result of this finding.

Finding Number 2025-007 Assistance Listing Number 93.069 Program Name Public Health Emergency Preparedness Federal Agency Department of Health and Human Services State Agency Department of Health Federal Award Identification Number N/A Federal Award Year 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Subrecipient Monitoring Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Health did not comply with subrecipient monitoring requirements for the Public Health Emergency Preparedness program BACKGROUND The Department of Health, as a pass-through entity, administers the Public Health Emergency Preparedness (PHEP) program. The department provides subawards to subrecipients with the aim of strengthening the capacity and capability of state and local public health systems to prepare for, respond to, and recover from public health threats and emergencies. The department uses eight subrecipients for this program. According to the schedule of expenditures of federal awards, subrecipient spending accounts for approximately 30% of the total program. Federal regulations require pass-through entities to establish and implement effective internal controls to monitor subrecipients’ activities to ensure they use federal funds in compliance with statutes, regulations, and grant terms and conditions. As a part of these responsibilities, management must evaluate each subrecipient’s risk of fraud and noncompliance, which includes reviewing the results of subrecipients’ Single Audits when applicable. Based on this risk assessment, management must perform appropriate monitoring to ensure subrecipients meet programmatic and financial requirements. This monitoring could include providing technical assistance, reviewing Single Audit reports, issuing management decisions related to PHEP funding, conducting site visits, or performing other monitoring procedures. CONDITION AND CAUSE Our audit identified deficiencies in the department’s monitoring of PHEP subrecipients, specifically related to tracking Single Audit Reports and performing monitoring reviews. Single Audit Report Tracking First, as of October 27, 2025, management had not ensured that any of the eight PHEP subrecipients obtained required Single Audits in accordance with Title 2, Code of Federal Regulations (CFR), Part 200, Subpart F, nor had management followed up when subrecipients did not submit Single Audit reports on time. No staff member was responsible for tracking which subrecipients were required to obtain a Single Audit, confirming whether subrecipients submitted audits, or following up when the department did not receive the required reports. After we brought it to their attention, management assigned a staff member to verify subrecipient Single Audit submissions on October 27, 2025. Monitoring Reviews Additionally, although the department’s documented risk assessment identified plans to conduct monitoring reviews of two subrecipients for the PHEP program during the audit period, the department did not perform these reviews. The staff member assigned to perform the reviews left the team on May 28, 2025, and management did not reassign the monitoring duties. CRITERIA Although revisions to 2 CFR 200 became effective during the audit period, the subrecipient monitoring requirements relevant to this finding—including evaluating subrecipient risk, performing appropriate monitoring activities, and verifying whether subrecipients were audited under Subpart F—remain substantively unchanged under both the prior and current versions of the Uniform Guidance. Federal regulations require pass-through entities to establish and maintain effective internal controls over federal awards and to monitor the activities of subrecipients to ensure compliance with applicable requirements. Under 2 CFR 200.332, the department, as a pass-through entity, must • evaluate each subrecipient’s risk of fraud and noncompliance to determine the appropriate level and type of monitoring; • consider factors such as the subrecipient’s o prior experience with similar awards; o results of previous audits, including whether the subrecipient undergoes a Single Audit; o changes in personnel or financial/management systems; and o results of other federal monitoring; • monitor subrecipient activities as necessary to ensure federal statutes, regulations, and award terms are met and that the goals and objectives of the subaward are achieved; • use appropriate monitoring tools based on assessed risk, including providing technical assistance, conducting site visits, or arranging for agreed-upon procedures engagements; and • verify that each subrecipient is audited as required under Subpart F of the Uniform Guidance. In addition, 2 CFR 200.501(a) requires any non-federal entity that meets the expenditure threshold established under Subpart F to obtain a Single Audit or program-specific audit for that fiscal year. Additionally, the U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book), Principle 3, states that management should assign and communicate responsibility for internal control activities. Collectively, these requirements obligate the department to ensure subrecipients obtain required audits, review and act on audit results, and perform the monitoring procedures identified through its risk assessments. EFFECT When management does not perform required subrecipient monitoring activities, it increases the risk of not timely detecting, documenting, or correcting subrecipient noncompliance, misuse of federal funds, or potential fraud. By failing to verify whether subrecipients obtained required Single Audits, management limits its ability to identify financial reporting deficiencies, internal control weaknesses, or questioned costs that could affect the PHEP program. RECOMMENDATION Management should ensure that responsibilities for subrecipient monitoring are clearly assigned, communicated, and carried out in accordance with federal requirements. These responsibilities include verifying required Single Audits, reviewing audit reports, issuing management decisions, and conducting risk-based monitoring activities. Management should also establish a process to ensure monitoring activities continue uninterrupted during staffing changes, including timely reassigning monitoring duties and documenting any modifications to the risk-based monitoring plan. Furthermore, management should periodically evaluate the effectiveness of its subrecipient monitoring system to confirm that staff are performing monitoring activities as planned and to promptly address any delays or impediments. MANAGEMENT’S COMMENT We concur. With regard to the monitoring of single audit findings within subrecipients, Emergency Preparedness will work with their column’s Business and Grant Management (BGM) Team to ensure grantees that require an annual single audit are identified and that single audits are reviewed within 60 days of the audit date. If relevant findings and corresponding corrective actions are identified, the BGM Team will confer with program management, and communicate with the subrecipient as to whether the corrective actions taken are believed to sufficiently mitigate the deficiencies noted in the finding. This communication will be filed for reference by program management and shared with the Compliance & Ethics Office, where a log will be kept to track this activity. This process will be put in place by January 31, 2026 and be the responsibility of the BGM Team Compliance Manager. With regard to staffing issues, the Compliance & Ethics Office was challenged with the untimely death of their monitoring manager, while at the same time losing an additional staff member due to attrition. The Compliance & Ethics Office will ensure that in the event of staffing shortages, a hierarchical management structure is in place to make needed changes in the subrecipient monitoring plan if needed. The Assistant Commissioner that leads the Compliance & Ethics Office will be responsible for this effort and has put this structure in place effective January 1, 2026. Finally, the evaluation of the effectiveness of the subrecipient monitoring system will be conducted as part of the annual Financial Integrity Act Risk Assessment, conducted by December 31 of each year, beginning December 31, 2026. Additionally, the Compliance & Ethics Office will conduct an enterprise-wide refresher course on single audit review and other subrecipient compliance responsibilities on or before June 30 each year, beginning June 30, 2026.

Finding Number 2025-008 Assistance Listing Number 93.568 Program Name Low-Income Home Energy Assistance Federal Agency Department of Health and Human Services State Agency Tennessee Housing Development Agency Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Significant Deficiency and Noncompliance Compliance Requirement Reporting Repeat Finding 2024-012 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the two prior audits, Tennessee Housing Development Agency (THDA) management did not have effective internal controls over reporting for the Low-Income Home Energy Assistance Program BACKGROUND The U.S. Department of Health and Human Services (HHS) provides grant funding through the Low-Income Home Energy Assistance Program (LIHEAP) to the Tennessee Housing Development Agency (the agency). The objective of LIHEAP is to help low-income households meet the costs of home energy, increase their energy self-sufficiency, and reduce their vulnerability resulting from energy needs. As a condition of the grant, HHS requires the agency to report on the use of federal funds through financial, performance, and special reports. In addition to federal requirements in the Code of Federal Regulations, the HHS Office of Administration for Children and Families, Office of Community Services (OCS), provides guidance to LIHEAP recipients by issuing Action Transmittals. In response to the prior-year finding noting ineffective controls over reporting, management stated that positions were filled, including the Community Services Division Director and LIHEAP Manager, who were working to strengthen internal processes to ensure reports are completed timely and accurately. CONDITION, CRITERIA, AND CAUSE As noted in the two prior years, the agency did not have adequate internal controls to ensure it provided the federal grantor (HHS) with timely or accurate reports. The primary cause for the special and performance reporting deficiencies was inadequate training of the new staff. Management assigned a secondary reviewer, but this reviewer did not always review the report data before submission, which led to inaccurate reported information. Special Reporting Annual Report on Households Assisted by LIHEAP According to Title 45, Code of Federal Regulations (CFR), Part 96, Section 82(a), the agency is required to submit to HHS an annual report on households assisted by LIHEAP “for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance.” We reviewed the 2024 annual report on households assisted by LIHEAP to determine that management submitted the report timely and reported line items accurately. Management originally submitted a timely estimated report on September 18, 2024. However, we noted that the agency did not submit the final corrected report until January 14, 2025, 14 days after the due date of December 31, 2024. The Director of Community Services stated the late submission was due to new staff onboarding and miscommunication, as the director was new to program administration and did not realize a subsequent report needed to be submitted after the estimated version. After the January 14, 2025, submission, APPRISE Inc., whose data consultants work with HHS, made THDA aware of two errors on the report: • The “Sum of Assistance Types” (reported as 117,537 households) did not reconcile with the figures reported in Line 14 (Any Type of LIHEAP Assistance) and Line 18 (Bill Payment Assistance), both listed as 109,045. • The weatherization program total of 264 households assisted was omitted from the report. After management submitted an updated report including the missing weatherization data, APPRISE Inc. followed up again, noting that the total households assisted (Line 14) still did not reflect the correct total of households served by the bill payment assistance and weatherization program, 117,801. Quarterly Performance and Management Reports LIHEAP Action Transmittal 2025-01 Quarterly Report Instructions Attachment 1 requires grant recipients to submit data and information about LIHEAP through quarterly performance and management reports. The quarterly report “collects valuable statistics on the number of assisted households, the impact of LIHEAP in ensuring access to home energy service, the amount of awarded funds that have been obligated, and successes and challenges that grant recipients are experiencing.” We reviewed the quarterly performance and management report for the first and second quarters of federal fiscal year 2025. During this review, we noted that management did not adequately review the second-quarter report prior to submission, causing inaccurate information to be reported until an amendment was made after the deadline. Management submitted the report timely; however, management reported the incorrect obligated amounts on the original report. The amount of funds obligated was reported at $24,303,853 instead of the correct amount of $58,379,528, an understatement of $34,075,675. The Director of Community Services stated that immediately after submission of the report, management discovered that the reported obligated amounts were not calculated in accordance with the LIHEAP model plan. The Director of Community Services stated that a new program staff member had been assigned to complete the reports but used the incorrect methodology. Management subsequently submitted an amended report on May 27, 2025. EFFECT When staff do not proactively perform procedures to ensure the reports are generated timely and without errors, management increases the risk of providing incorrect or untimely data to HHS, which could affect program oversight and funding decisions. Inaccurate reporting also increases the likelihood of noncompliance with federal grant requirements, including the risk of obligating more funds than are available. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Specific conditions may include the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • withholding further awards for the project or program, or • pursuing other available legal remedies. RECOMMENDATION THDA management should continue to strengthen the reporting process by ensuring new employees are adequately trained, reports are reviewed for accuracy prior to submission, and that management and staff have an adequate tracking system to ensure timeliness. Management should also continue to monitor reporting procedures and revise internal controls as necessary to ensure full compliance with federal reporting requirements. MANAGEMENT’S COMMENT We partially concur. THDA has continued to refine its process to ensure timely and accurate reporting. In 2025, steps were taken to review reports prior to submission. The manager additionally consulted with APPRISE, Inc., the data management firm contracted to support HHS and LIHEAP grantees, prior to report submission. APPRISE acknowledges that the report templates do not properly identify errors and encourages THDA to submit reports even when errors are noted. Any instances where errors were substantiated following report submission have been corrected in consultation with APPRISE. HHS has accepted all reports submitted by THDA, and we have received no communication from HHS that THDA is in jeopardy of their consideration of any of the effects noted in your finding. We do acknowledge that there was an instance where numbers were not reported correctly or timely due to lags in getting LIHEAP Weatherization data, as well as improper grantee reporting. We are working to resolve this issue through implementation of new software that will join the LIHEAP utility assistance and LIHEAP weatherization data together, on a single platform. THDA launched the software for the utility assistance segment of LIHEAP on November 1, 2025, and we expect the LIHEAP weatherization data to be online by October 1, 2026. THDA’s work in 2025 to improve its reporting accuracy has been impacted considerably by inconsistent guidance at the federal level. Since January 2025, due to periods of non-communication by HHS and subsequent reductions and changes in staffing at HHS, we have received various interpretations of HHS guidance. For instance, HHS has provided differing definitions of “obligation”, creating some confusion with reporting. To date, HHS has not provided a final definition. THDA will continue to report obligations as is stated in our Model Plan, when funds are awarded and a contract is fully executed with the sub-grantee. We appreciate the comments of the State Comptroller’s Office as we actively take steps to improve our reporting processes. AUDITOR’S COMMENT We reviewed and considered management’s comments. Although they provide additional context, the response does not alter the underlying condition or conclusion of the finding.

Finding Number 2025-009 Assistance Listing Number 20.106 Program Name Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs Federal Agency Department of Transportation State Agency Department of Transportation Federal Award Identification Number N/A Federal Award Year 2020 through 2024 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Department of Transportation did not establish internal controls related to federal reporting requirements for the Airport Improvement Program and did not comply with the requirements BACKGROUND The Federal Aviation Administration’s (FAA) Airport Improvement Program supports the development of a nationwide system of airports by funding projects that increase airport capacity and safety. To be eligible for the program, an airport must be open to the public and be included in the National Plan of Integrated Airport Systems.(14) Applications for grants must be submitted to the appropriate FAA Airports Office. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Transparency Act (FFATA) requires the Department of Transportation (the department) to report financial information on all subawards of $30,000 or more in federal funds(15) through the System for Award Management (SAM).(16) According to federal regulations, reports are due “no later than the end of the month following the month in which the subaward was issued.”(17) The subaward information in SAM is then available to the public through the USA Spending website for transparency. See Schedule of Findings and Questioned Costs for footnote. Based on our walkthrough and discussion with the department’s Aeronautics Division management, the division holds bi-monthly meetings to discuss funding, which comes from federal, state, and local funding streams, for potential Airport Improvement Program projects. In collaboration, the department’s division management and the state’s Tennessee Aeronautics Commission (18) document their decisions to approve or deny subawards in a Project Status Report (PSR) spreadsheet. Following the bi-monthly meeting, the Aeronautics Division Grants and Compliance Team Lead uses the PSR to update a shared spreadsheet known as the “All AERO” to maintain all approved Airport Improvement Program subaward projects. See Schedule of Findings and Questioned Costs for footnote. Each month, the department’s Transportation Program Supervisor, who is responsible for reporting Airport Improvement Program subawards that meet the $30,000 threshold, uses the All AERO spreadsheet to filter subawards issued in the prior month and identify the subawards by Federal Award Identification Number.(19) The Transportation Program Supervisor then enters the information from the spreadsheet into SAM.gov. See Schedule of Findings and Questioned Costs for footnote. CONDITION AND CAUSE We obtained a population of 82 subawards, totaling $7,479,559 in federal dollars obligated during the fiscal year ending June 30, 2025. After filtering out subawards below the $30,000 reporting threshold, this left 74 subawards, totaling $7,384,452, to be sampled from. We then selected a nonstatistical, random sample and a haphazard sample and reviewed 18 subawards totaling $1,725,163. Based on our review of the subaward documentation, we found that 4 of the 18 subawards did not meet the $30,000 federal funding threshold for FFATA reporting. For the remaining 14 subawards, we found the following: • Unreported and Late Subawards: We found that the department did not report 2 subawards, totaling $177,300, as required. Additionally, the department reported 10 subawards, totaling $1,471,679, after the required reporting deadline. Management stated that the transition from the Federal Funding Accountability and Transparency Act Subaward Reporting System to SAM.gov contributed to the late reporting for 6 of these 10 subawards. • Subaward Amendments Unreported: We found that for 1 subaward, management did not report a $13,904 amendment to the subaward. The department reported the original $150,000 subaward in the prior scope period; however, management did not report the $13,904 increase, as required by FFATA reporting requirements. • Subaward Amendments Reported Late: We found that for 1 subaward, management reported a $9,090 amendment after the required deadline. The department reported the original $43,200 subaward in the prior scope period but did not report the $9,090 amendment within the FFATA reporting timeframe. Based on our discussions with management regarding the noncompliance, we determined that the department has not designed and implemented a supervisory review process to ensure the Transportation Program Supervisor timely enters all required subaward reports in SAM. See Figure 1. See Schedule of Findings and Questioned Costs for figure. We also reviewed the department’s 2024 Financial Integrity Act Risk Assessment, which confirmed that the Aeronautics Division’s management did not assess the FFATA reporting process related to the Airport Improvement Program for the potential risk of errors and noncompliance with federal laws and regulations and did not establish controls to mitigate risks. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. 1. Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2. Reporting Requirements. i. The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. ii. For subaward information, report no later than the end of the month following the month in which the subaward was issued. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, Green Book Principle 10.02, “Response to Objectives and Risks,” Management designs control activities in response to risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives to achieve the entity’s objectives and address related risks. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding the department’s expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” additional federal award conditions may include items such as the following: • Requiring payments as reimbursements rather than advance payments; • Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; • Requiring additional, more detailed financial reports; • Requiring additional project monitoring; • Requiring the recipient or subrecipient to obtain technical or management assistance; or • Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Transportation should design and implement a supervisory review process to ensure all subawards and related amendments are reported as required. Management should include the risks associated with FFATA reporting in the annual risk assessment and develop compensating controls to address the risks. MANAGEMENT’S COMMENT We concur. The following processes have been created to correct the issues with FFATA reporting: • An internal submittal deadline has been created to ensure the timely submission of the FFATA report each month. This timeframe is 15 days from project approval. In the event something happens and the 15 days is missed, there is still time to correct the issue before becoming noncompliant with the FAA. • All the information is kept on a separate excel strictly for FFATA reporting and contains checks in the file stating if it has been entered into SAM.gov and to ensure it is also on the ALL Aero spreadsheet. • Ensure that the information that is entered, is transferred into the folder for that month. Via pdf or screenshot. • Created a folder dedicated to FY26 for all things FFATA. This will be the norm going forward per fiscal year. • Trained two senior staff members within the Grants and Compliance section on entering the information if the Statewide Technical Specialist is out or unable to get it in within the allotted timeframe. • Emailing the Team Lead after the FFATA report has been entered as well as storing it on the shared drive in the FY26 FFATA Reporting Folder (or future corresponding folder). • Created a section on our section’s OneNote (SOP) of how to enter the information and also put the information for the paths to the share drive FFATA files as well for anyone else in case something happened to any of the people who are trained it, continuity will be maintained. • A line item has been created on the weekly one-on-one agenda between the Team Lead and Statewide Tech Spec following up on FFATA reporting status and cross-referenced with project approval list.

Finding Number 2025-010 Assistance Listing Number 93.558 Program Name Temporary Assistance for Needy Families Federal Agency Department of Health and Human Services State Agency Department of Human Services Federal Award Identification Number N/A Federal Award Year 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Eligibility Reporting Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The department and STS did not jointly establish effective oversight and monitoring of IT systems managed by STS and third-party vendors, or provide adequate internal controls in three other areas related to the department’s information systems, increasing the risk of errors and disruptions in the Temporary Assistance for Needy Families financial assistance program BACKGROUND The Department of Human Services (the department) modernized its information systems by replacing legacy applications with cloud-based platforms designed to improve reliability, reduce maintenance needs, and expand access to services. The department now relies on both custom-developed and Software-as-a-Service systems, many of which are operated by third-party vendors. The department uses these systems to support the Temporary Assistance for Needy Families (TANF) program by providing a single, digital system that simplifies families’ experiences with applying for benefits, submitting necessary documents, and viewing case updates. Because these systems support key business processes, the department and the Department of Finance and Administration’s Strategic Technology Solutions (STS) share oversight responsibilities to ensure systems are secure, compliant, and functioning as intended. Under a 2017 memorandum of understanding, STS is responsible for certain operational and vendor‑management functions. At the time of the audit, statewide guidance specific to monitoring third-party vendor risk had not yet been fully developed. Since then, statewide guidance has been developed and is currently under review for approval and implementation. As of 2024, the U.S. Department of Health and Human Services awarded the Tennessee Department of Human Services $190,885,719 for the TANF program. CONDITION AND CAUSE Department management and STS management did not effectively design and monitor internal controls over the department’s information systems, including controls related to vendor-managed systems. We identified deficiencies in overseeing and monitoring the department’s third-party information technology vendors. Because STS and the department did not implement effective monitoring, they did not identify three other internal control weaknesses in the department’s systems, which are confidential and omitted from this report. The third-party information technology vendor lacked oversight and monitoring While the department relies on STS and external vendors, such as Deloitte, to manage and operate its systems, the department did not establish sufficient oversight and monitoring controls over its third-party information technology vendor, which manages one of its custom-developed systems. Specifically, the department and STS did not effectively monitor daily operations, verify that the vendor implemented appropriate technical safeguards, or ensure that the vendor complied with statewide security requirements and department policies. As a result, neither the department nor STS consistently monitored the vendor’s performance or the effectiveness of controls over department systems. One reason for this oversight gap is that the department did not clearly define its own responsibilities, or those of STS, in the memorandum of understanding. In addition, during the audit, the Information Systems Council had not developed statewide policies for monitoring third-party vendor risk. After we completed the audit, STS prepared draft statewide guidance on third-party management, which the council approved during its December 17, 2025, meeting. The department’s and STS’s annual risk assessment does not sufficiently mitigate risks The department and STS did not identify the risks noted in this audit finding during their annual risk assessment and, therefore, did not establish internal controls to mitigate those risks.(20) See Schedule of Findings and Questioned Costs for footnote. STS management did identify the risk that STS and the consolidated agencies(21) are responsible for ongoing monitoring of third-party IT vendors to safeguard an agency’s mission-critical information systems. However, STS management’s identified controls focused only on Software-as-a-Service providers and independent audit reports. They did not address internal controls pertaining to vendors maintaining and managing the department’s IT environment, such as those supporting custom-developed systems.(22) Even when STS or external vendors perform IT functions, the department remains responsible for ensuring risks are managed and controls are effective. See Schedule of Findings and Questioned Costs for footnote. The department’s systems contained confidential internal control weaknesses Due to the lack of monitoring, the department and STS were not aware of internal control weaknesses in three other areas related to the department’s information systems. Department and STS management acknowledged these confidential internal control weaknesses and have taken steps to correct them. These identified weaknesses increased the risk of unauthorized access or modification to critical systems and processes because the department and STS did not adhere to state policies and federal internal control standards. Under Standard 9.61 of the U.S. Government Accountability Office’s Government Auditing Standards, we omitted details from this finding because they are confidential under the provisions of Section 10-7-504(i), Tennessee Code Annotated. We provided department and STS management with detailed information regarding the specific conditions we identified, as well as the related criteria, causes, and our specific recommendations for improvement. CRITERIA According to Title 2, Code of Federal Regulations, Part 200, Section 303(a), the department must Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According” to Green Book Section OV4.03, “External Parties,” Management may engage external parties to perform certain business processes for the entity . . . [but] management retains responsibility for the effectiveness of controls over business processes assigned to service organizations. . . . [M]anagement needs to understand the controls that service organizations design, implement, and operate. Additionally, Green Book Principle 7.02, “Identify Risks,” states, Management identifies risks throughout the entity . . . to provide a basis for analyzing risks. Furthermore, Green Book Principle 7.14, “Respond to Risks,” states, When risk response actions do not enable the entity to operate within the defined risk tolerances, management may need to revise risk responses or reconsider defined risk tolerances. Management may need to conduct periodic risk assessments to evaluate the effectiveness of the risk response actions. EFFECT TANF eligibility determinations, benefit calculations, and case management activities rely on accurate, complete, and timely information in the department’s information systems. Ineffective implementation and operation of internal IT controls increase the likelihood of errors, data loss, and unauthorized access to departmental systems that support the TANF program. As a result of these control deficiencies, management lacks reasonable assurance that it can effectively identify, monitor, and respond to risks affecting the protection and dependability of its systems and data. Weak controls increase the risk of data breaches, service disruptions, and system failures that could affect the delivery of services to Tennesseans. Limited monitoring also reduces management’s ability to detect control breakdowns promptly and respond quickly when problems occur. Collectively, these control deficiencies elevate the risk of someone altering, exposing, or disrupting TANF data without detection. These deficiencies not only threaten service delivery to Tennesseans but may also lead to noncompliance with federal requirements, which could impact the department’s continued access to federal support or participation in programs. RECOMMENDATION The department and STS should strengthen oversight and monitoring of vendor maintenance and system management for the department’s programs, including the TANF program. This should include updating their memorandum of understanding to clearly define each party’s responsibilities for monitoring vendors and system controls. At the statewide level, STS should work with the Information Systems Council to continue developing and refining guidance for overseeing third-party vendor risk related to vendor-maintained and managed systems, including those supporting TANF. The department and STS should update their vendor-management practices as statewide guidance is finalized. The department and STS should continue to correct the confidential control weaknesses identified during our audit and assign staff to monitor these areas moving forward. Finally, department management and STS management should evaluate the risks noted in this finding and implement effective controls to address the risks noted in this finding, update the risk assessment as necessary, and take action if deficiencies occur. MANAGEMENT’S COMMENT Department Management and STS We concur. STS has taken steps to address the issues identified, implemented new processes to enhance oversight and risk management, and will continue to refine these efforts in alignment with evolving state policies and guidance. STS is working with DHS to establish a new Interagency Agreement that explicitly outlines each party’s responsibilities in monitoring vendor performance, validating security controls, and responding to risks associated with vendor-managed systems. In an effort to establish consistent standards for monitoring vendors, assessing technical safeguards, and ensuring alignment with applicable state and federal control frameworks, including the GAO Green Book and NIST 800-53, STS has also developed and presented a new Information Systems Council (ISC) policy regarding statewide guidance on third-party vendor oversight. Additionally, STS reviewed and updated departmental risk assessment documents to reflect third-party IT vendor oversight controls.

Finding Number 2025-011 Assistance Listing Number 64.053 Program Name Payments to States for Programs to Promote the Hiring and Retention of Nurses at State Veterans Homes Federal Agency Department of Veterans Affairs State Agency State Veterans’ Homes Board Federal Award Identification Number N/A Federal Award Year 2025 Finding Type Noncompliance Compliance Requirement Activities Allowed or Unallowed Allowable Costs/Cost Principles Repeat Finding N/A Pass-Through Entity N/A Questioned Costs $94,375 FINDING Tennessee State Veterans’ Homes Board management improperly claimed reimbursement from the federal nurse retention grant BACKGROUND In 2022, the U.S. Department of Veterans Affairs (VA) established a nurse retention grant program to help state veterans’ homes hire or retain nurses who provide direct clinical care to residents. For federal fiscal year 2025, the VA approved the Tennessee State Veterans’ Home Board’s (the board’s) application for grants for the Clarksville, Humboldt, Knoxville, and Murfreesboro veterans’ homes, as these homes had struggled with nursing turnover. The board used the grant funds to implement financial incentives to encourage nurses to join their staff, including bonuses for new-hire retention, referrals, and mentoring.(23) Figure 1 summarizes each financial incentive program. See Schedule of Findings and Questioned Costs for footnote. See Schedule of Findings and Questioned Costs for figure. Based on our discussions with management and a review of the incentive programs management described to us, management pays employees quarterly for the retention bonus and mentor incentive programs if the employee remains employed for that time. The referral bonus is paid after 90 and 180 days of successful employment. Each quarter, the executive office staff submits a reimbursement invoice to VA to recover 50% of the incentives/bonuses paid to the employees. CONDITION AND CRITERIA As part of the veterans’ homes’ grant application process, the VA approved the veterans’ homes’ referral and mentor bonuses, as well as the tuition/student loan reimbursement, as these programs aligned with the federal grant’s purpose to improve the nursing shortage each home faced. Based on our review of the grant application and agreement, however, we found that VA had not specifically approved the new-hire retention bonus as an allowable program for federal reimbursement. Furthermore, the VA approval letter for each nursing home states, The funds are to be used solely for the purpose of the specific employee incentive programs. In the original VA grant application, management did not include a description of new-hire retention bonuses in its description of the planned incentive programs. As such, the VA was not aware of the new-hire retention bonus program when it approved the other incentive programs. Based on our review of grant reimbursement records, we found that, even though the program was not specifically approved, management invoiced $94,375 in new-hire retention bonus payments under the approved mentor program category. In addition, we noted instances of employees participating simultaneously in both the mentor program and the new-hire retention bonus program, and management sought reimbursement for both programs through the mentor program category. CAUSE Based on our discussion with management, the new-hire retention bonus program was not explicitly described in the grant application, but management asserts that the program was included as part of the mentor program. EFFECT When management improperly invoices the federal grantor for unapproved programs, there may be fewer funds available for the approved incentive programs. For example, as of March 2025, management had exhausted all its federal nurse retention grant funds for its Clarksville home because they included the new-hire retention bonuses. Furthermore, management has submitted false claims to the federal grantor and may be required to pay back the improperly used funds. Federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 208(c), “Specific conditions,” these conditions may include (1) Requiring payments as reimbursement rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION Management should seek specific approval from VA to use the nurse retention grant funds to assist with the new-hire employee retention bonus program or use veterans’ homes funds to pay for the new-hire bonuses. Management should contact the federal grantor for guidance on how to remedy the improper billings. MANAGEMENT’S COMMENT We concur in part: While our grant application did not explicitly itemize retention bonuses, their use is consistent with the framework and intent of the grant, as defined in 38 CFR Part 53.11(b), which states the purpose is for an “employee incentive program to reduce the shortage of nurses at the TSVH.” We are also actively consulting with the VA to clarify the status of prior billings and determine the appropriate path forward if any are deemed improper. As of the date of this update, we have not received a response. AUDITOR’S COMMENT As of the date of this report, the Veterans’ Home Board's management has not received explicit approval from the VA to use the nurse retention grant funds to support the new-hire employee retention bonus program.

Finding Number 2025-004 Assistance Listing Number 10.553, 10.555, 10.556, and 10.582 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Education Federal Award Identification Number N/A Federal Award Year 2022 through 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Reporting Repeat Finding 2024-005 Pass-Through Entity N/A Questioned Costs N/A FINDING As noted in the prior audit, the Department of Education did not establish internal controls related to federal reporting requirements for the Child Nutrition Cluster and did not comply with the requirements BACKGROUND The Department of Education (the department) is the pass-through entity for the Child Nutrition Cluster (1), which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture. The Child Nutrition Cluster is a cluster of federal programs to provide healthful, nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. For the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children, the department enters into agreements with subrecipient organizations, known as school food authorities (SFAs), which operate the programs at the local level and deliver program services to eligible children. The department reimburses SFAs for each meal or snack served based on the rates established by the U.S. Department of Agriculture. Each month, the SFAs claim the number of meals or snacks served using the department’s Tennessee: Meals, Accounting, and Claiming (TMAC) system. For the Fresh Fruit and Vegetable Program, (2) the department enters into additional agreements with approved SFAs for eligible elementary schools within those SFAs to operate the program at the local level and deliver program services to eligible children. The department awards a grant amount for each elementary school based on a per-child rate set by the department. Each month, the SFAs claim procurement, operations, and administration costs using the department’s TMAC system. See Schedule of Findings and Questioned Costs for footnote. The Federal Funding and Accountability Transparency Act (FFATA) requires the department to report subrecipient subaward financial information for all subawards over $30,000. Before March 2025, FFATA information was reported in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). The last month the department reported in FSRS was February 2025. In March 2025, FSRS was retired and fully transitioned to the System for Award Management (SAM).(3) According to federal regulations, reports are due “no later than the end of the month following the month in which the subaward was issued.”(4) The subaward information in SAM is then available to the public on the USA Spending website for transparency. See Schedule of Findings and Questioned Costs for footnote. CONDITIONS AND CAUSES Fresh Fruit and Vegetable Program Based on our discussion with management, staff did not complete any FFATA reporting for the Fresh Fruit and Vegetable Program for the entire fiscal year. Based on our review of the claim information, staff did not report 29 program subawards, totaling $4,740,455, as required. We discussed the noncompliance with management and determined that the department has not designed and implemented a supervisory review process to ensure the Data Processing and Reporting Specialist identifies and reports all required subawards. School Breakfast Program, National School Lunch Program, and Special Milk Program for Children Reporting in FSRS (Before March 2025) Based on our walkthrough and discussion with the department’s School Nutrition staff, each month, the Data Processing and Reporting Specialist downloaded the current month’s reports from the TMAC system (which contained totals from the prior month) and manually combined and formatted the data for each individual SFA. This process included identifying and reporting the applicable amounts for the breakfast, lunch, snack, and milk programs. Once the information was compiled, the Data Processing and Reporting Specialist transferred the SFA data into the reporting template and uploaded the file to FSRS. For the period of July 2024 through February 2025, we obtained a population of 1,386 subawards, totaling $366,066,740. We selected a nonstatistical, random sample of 60 subawards, totaling $18,321,655, to determine if the department followed FFATA reporting guidance. Based on our review of the subaward documentation, we found that for 46 out of 60 (77%) items tested, the department either did not report the subaward amount or reported the subaward amount incorrectly. See Figure 1. See Schedule of Findings and Questioned Costs for figure. Based on our discussions with management and the results of our testwork, we determined that the incorrect or unreported amounts occurred because management has not designed and implemented a supervisory review process to ensure the Data Processing and Reporting Specialist identifies and accurately reports all required subawards. Reporting in SAM (After March 2025) Based on our discussion with management, after FFATA reporting transitioned from FSRS to SAM, staff did not complete any required FFATA reporting for the School Breakfast Program, the National School Lunch Program, and the Special Milk Program for Children.(5) Based on our review of the claim information for March through June 2025, staff did not report 190 SFA’s Child Nutrition subawards totaling $161,571,716. See Schedule of Findings and Questioned Costs for footnote. Management stated they did not report FFATA information after the transition from FSRS to SAM because the department did not have an Application Programming Interface(6) connection to automate the submission process, and entering each SFA individually into SAM would have required a significant amount of staff time. See Schedule of Findings and Questioned Costs for footnote. Our review of the department’s 2025 Financial Integrity Act Risk Assessment revealed that management identified a risk that federally required reports may not be accurate or completed on time. Management identified a second-level review of reports as a control activity to mitigate these risks; however, management noted in the risk assessment that the control was not effective and has yet to establish an effective control and update the risk assessment. Based on our review, the control was not effective for FFATA reporting because it was not placed in operation during our audit period. CRITERIA FFATA Reporting Appendix A to “Reporting Subaward and Executive Compensation Information,” Title 2, Code of Federal Regulations (CFR), Part 170, states: a. Reporting of first-tier subawards. 1. Applicability. Unless the recipient is exempt as provided in paragraph (d) of this award term, the recipient must report each subaward that equals or exceeds $30,000 in Federal funds for a subaward to an entity or Federal agency. The recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward. 2. Reporting Requirements. i. The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov [SAM.gov] ii. For subaward information, report no later than the end of the month following the month in which the subaward was issued. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, Green Book Principle 10.02, “Response to Objectives and Risks,” Management designs control activities in response to . . . risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives to achieve the entity’s objectives and address related risks. EFFECT Not meeting the FFATA requirements increases the likelihood that the public will not have access to transparent and accurate information regarding expenditures of federal awards. Additionally, federal regulations address actions that federal agencies may impose if a state entity does not comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” Specific conditions may include the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional federal funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner should implement the supervisory review process documented in the risk assessment to ensure all subawards are reported completely and accurately in SAM as required. MANAGEMENT’S COMMENT The department concurs with this finding. The department’s State Director of School Nutrition, Senior Compliance and Data Manager, and Data Processing and Reporting Specialist have been working with the Federal Funding and Accountability Transparency Act (FFATA) System for Award Management (SAM) administrators to submit the required reports. The department is pursuing both internal practice adjustments and external collaboration with the United States Department of Agriculture (USDA) to ensure proper reporting. Internally, the department is working to develop an application programming interface (API) between the department’s nutrition data system and the recently updated federal reporting system to promote seamless report submissions. Externally, the department is collaborating with the Office of the CFO for the United States Department of Agriculture (USDA), noting the lack of more robust bulk upload options in the federal reporting system compared to the prior system. The department, alongside other states, continues to work with USDA to determine more efficient bulk upload options to streamline federal data reporting. The department will continue to leverage both these efforts to ensure reporting requirements are met. The department has created and deployed a standard operating procedure (SOP) to inform staff of the responsibilities our office has in uploading the required reports. The department will also include a certification process in its standard operating procedures so that reports are reviewed prior to submission in the SAM platform.

Finding Number 2025-006 Assistance Listing Number 10.555 Program Name Child Nutrition Cluster Federal Agency Department of Agriculture State Agency Department of Agriculture Federal Award Identification Number N/A Federal Award Year 2024 and 2025 Finding Type Material Weakness and Noncompliance Compliance Requirement Special Tests and Provisions Repeat Finding N/A Pass-Through Entity N/A Questioned Costs N/A FINDING The Tennessee Department of Agriculture did not perform annual inventories at food storage locations resulting in noncompliance with federal inventory requirements for the Child Nutrition Cluster programs BACKGROUND The Department of Agriculture (the department) is a pass-through entity for the Child Nutrition Cluster,(10) which is administered by the Food and Nutrition Service of the U.S. Department of Agriculture (USDA). The Child Nutrition Cluster is a cluster of federal programs that provide nutritious meals and snacks to eligible children in public schools and nonprofit private schools, residential childcare institutions, and summer recreation programs. See Schedule of Findings and Questioned Costs for footnote. The department serves as a food distribution agency for one of the cluster’s five programs, the National School Lunch Program. Based on the food selections made by school food authorities (SFAs), who function as subrecipients, the department places orders with the USDA for donated foods.(11) USDA then ships the food directly to department-contracted warehouses for storage or sends it to processors for additional preparation.(12) As SFAs have the need and capacity, they coordinate the distribution of food from the warehouses to their participating schools. In fiscal year 2025, the department ordered $33,125,180 of USDA-donated foods on behalf of SFAs. Federal regulations(13) require the department to manage its food inventory in the warehouses by tracking receipts and distributions, performing at least one physical inventory count each year, and documenting adjustments to inventory records, such as losses due to spoilage. See Schedule of Findings and Questioned Costs for footnote. CONDITION AND CAUSE Based on our discussions with department management, we found that management did not conduct the required annual inventories at the food storage warehouses. Instead of performing physical inventories, management relied on reports from warehouses, processors, or SFAs of food inventory changes. When discussing inventory requirements with management, the Commodity Distribution Administrator stated that, since assuming the role in February 2024, he continued the processes established by prior program leadership and was not aware of the inventory and recordkeeping requirements applicable to the Child Nutrition Cluster. Although the department’s warehouse contracts require the contractor to provide inventory reports and specify “the State will require an annual physical inventory of USDA commodity foods and will reconcile physical and book inventories,” management acknowledged that they had not reconciled records with the actual inventory on hand. Management also stated that they do not have the staffing capacity to perform the annual physical inventories required for the food storage warehouses. Because the department did not perform and document physical inventories to reconcile to other records, the department could not determine the amount of USDA food losses for which USDA requires reporting and restitution. Management further noted that USDA conducted a federal program review of the department’s administration of the Child Nutrition Cluster in August 2025 and identified the lack of annual inventories for USDA foods stored in warehouse facilities as a compliance issue. Management explained they intended to wait for the final results of USDA’s review before initiating annual inventory procedures. In addition, our review of the department’s 2025 Financial Integrity Act Risk Assessment showed that, although the department identified certain controls related to USDA foods administered through other programs, management did not perform a similar risk assessment for food inventory associated with the Child Nutrition Cluster. CRITERIA Maintenance of Records and Inventory Management According to Title 2, Code of Federal Regulations (CFR), Part 200, Section 303(a), a non-federal agency must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, according to 7 CFR 250.12(b), The distributing agency must ensure that donated foods at all storage facilities used by the distributing agency (or by a subdistributing agency) are stored in a manner that permits them to be distinguished from other foods, and must ensure that a separate inventory record of donated foods is maintained. The distributing agency’s system of inventory management must ensure that donated foods are distributed in a timely manner and in optimal condition. On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subdistributing agency), and must reconcile physical and book inventories of donated foods. The distributing agency must report donated food losses to [the Food and Nutrition Service], and ensure that restitution is made for such losses. Risk Assessment The U.S. Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book) provides a comprehensive framework for internal control practices in federal agencies and serves as a best practice for other government agencies, including state agencies. According to Green Book Principle 7.02, “Identification of Risks,” Management identifies risks throughout the entity to provide a basis for analyzing risks. Risk assessment is the identification and analysis of risks related to achieving the defined objectives to form a basis for designing risk responses. Additionally, according to Green Book Principle 10.02, “Response to Objectives and Risks,” Management designs control activities in response to the entity’s objectives and risks to achieve an effective internal control system. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives to achieve the entity’s objectives and address related risks. EFFECT By failing to perform a sufficient inventory, management increases the risk of noncompliance with federal requirements and heightens the potential for fraud, waste, and abuse within this federal program. Without adequate internal controls over the receipt, distribution, and inventory of USDA-donated foods, management cannot reasonably ensure that subrecipients meet federal program requirements or achieve the intended program outcomes. Additionally, federal regulations outline actions that federal agencies may take if a state entity fails to comply with the U.S. Constitution, federal statutes, regulations, or the terms and conditions of a federal award. According to 2 CFR 200.208(c), “Specific conditions,” additional federal award conditions may include items such as the following: (1) Requiring payments as reimbursements rather than advance payments; (2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) Requiring additional or more detailed financial reports; (4) Requiring additional project monitoring; (5) Requiring the recipient or subrecipient to obtain technical or management assistance; or (6) Establishing additional prior approvals. If the federal agency determines the state agency cannot remedy its noncompliance through the above actions, 2 CFR 200.339, “Remedies for noncompliance,” outlines additional actions the federal agency may take. Depending on the circumstances, these actions may include • temporarily withholding payments until the noncompliance has been corrected, • denying the use of funds, • partly or fully suspending or terminating the federal award, • suspending or debarring the agency, • declining to award additional funds, or • pursuing other available legal remedies. RECOMMENDATION The Commissioner of the Department of Agriculture should ensure that management strengthens its oversight and internal controls over USDA-donated food inventory by establishing written procedures that comply with federal Child Nutrition Cluster requirements and clearly outline responsibilities for maintaining complete inventory records and performing required reconciliations. Management should ensure that staff perform and document annual physical inventories for each warehouse and reconcile the results to book inventories. To support these responsibilities, management should evaluate staffing levels and allocate sufficient resources or explore operational alternatives to ensure the department can meet federal requirements. In addition, management should provide training to program staff on federal inventory requirements and the department’s updated procedures. Finally, management should review and update the risk assessment for the deficiencies noted in the finding, design and implement controls to address these risks, continue to monitor these risks, and take appropriate action to address other deficiencies as they occur. MANAGEMENT’S COMMENT We concur. To ensure effective internal controls over inventory at storage locations for school food distribution, the department added the risk of not complying with inventory requirements for school food to our Financial Integrity Act risk assessment along with the following mitigating controls: • Monthly inventory reports are required to be sent by each of the three school food warehouses to the Commodities team. • Developed monitoring guides and have begun using those guides to assist with warehouse visits. The department has a plan to begin observing inventory annually. We completed our first warehouse visit in February 2026 and anticipate completing visits to the other two warehouses by September 30, 2026. In addition to the annual on-site inventory observation, internal monthly inventory monitoring has been added to the duties of the Commodities team. Warehouses are now required to submit monthly inventory reports by the 10th of each month which are then analyzed by the team. We have been looking at ways to add a permanent position to the Commodities team. We have tried getting an additional position approved in the budget and we are exploring the possibility of repurposing vacant positions within the department. Finally, the department’s special projects team has been looking at SOPs in place as well as the need for SOPs in areas without them. The Commodities team is next on the list for special projects to help with drafting and revising SOPs. We plan to use this opportunity to establish written procedures that outline responsibilities for the school food program to help us ensure compliance with federal requirements. The Commodity Distribution Administrator will be responsible for ensuring corrective actions are implemented by the anticipated completion date of December 31, 2026.