Audit 394693

2. CHILD NUTRITION CLUSTER – TRANSPARENCY ACT REPORTING Finding Number: 2025-009 State Agency Number: DEW-02 Assistance Listing Numbers and Titles: 10.553 School Breakfast Program 10.555 National School Lunch Program 10.556 Special Milk Program for Children 10.559 Summer Food Service Program for Children 10.582 Fresh Fruit and Vegetable Program Federal Award Identification Numbers / Years: 242OH062N1099 / 2024 242OH062N1199 / 2024 252OH062N1099 / 2025 252OH062N1199 / 2025 Federal Agency: Department of Agriculture Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-010 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS portal or SAM.gov) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS portal or SAM.gov website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During the audit period, the Ohio Department of Education and Workforce (the Department) disbursed approximately $692.6 million to 1,156 subrecipients for the Child Nutrition Cluster whose reimbursements were required to be reported on the FSRS portal or SAM.gov website in accordance with the Transparency Act. The Child Nutrition Cluster is an entitlement grant as opposed to a subaward, as a result, funds are not obligated in the same manner as subawards. The Department developed a new process for collecting the grant information to be reported; however, the new process was not implemented during the audit period. Consequently, the Department had no control procedures in place to ensure the Child Nutrition Cluster’s payments were accurately entered into the FSRS or SAM.gov website for the School Breakfast Program and National School Lunch Program. As a result, the following errors were noted: School Breakfast Program Transactions tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 1,057 1,057 0 0 0 Dollar amount of tested transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $180,668,373 $180,668,373 $0 $0 $0 National School Lunch Program Transactions tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 1,156 1,156 0 0 0 Dollar amount of tested transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $511,909,695 $511,909,695 $0 $0 $0 A lack of effective internal controls over the preparation and review of reports increases the risk of these reports being inaccurate and incomplete when submitted to the federal grantor agency. By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the payments are not reported within FSRS portal or SAM.gov website, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, this was caused by the necessity to review the information available and determine what data should be reported as part of the Transparency Act Reporting requirements. Also, there were delays in getting access to the FSRS portal and SAM.gov and missing several unique entity identifiers for many of the subrecipients. We recommend the Department design and implement internal controls over its Transparency Act reporting to ensure the accuracy and completeness of expenditures entered on the SAM.gov website [as of March 8, 2025] for every program within the Child Nutrition Cluster. These procedures should include a supervisory review of the report information collected before it is submitted within the SAM.gov website. Management should periodically review these control procedures to ensure they are operating as intended.

1. SUMMER EBT – INELIGIBLE STUDENTS Finding Number: 2025-008 State Agency Number: DEW-01 Assistance Listing Number and Title: 10.646 – Summer Electronic Benefits Transfer Program for Children (Summer EBT) Federal Award Identification Numbers / Years: 242OH102N1175 / 2024 252OH102N1175 / 2025 Federal Agency: Department of Agriculture Compliance Requirement: Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS 7 C.F.R. 292.5, General purpose and scope, states in part: (a) Summer EBT eligibility is based on the eligibility standards for the NSLP/SBP [National School Lunch Program/School Breakfast Program], which includes children who are income eligible for free or reduced-price school meals based on income . . . and in accordance with the household size and income standards for free and reduced price school meals, and children who are categorically eligible. . . . (b) The Income Eligibility Guidelines are published annually and change on July 1. The guidelines in effect on the date of application must be used to determine eligibility. 7 C.F.R. 292.6, Eligibility states, in part: Children eligible for Summer EBT include those who, at any time during the period of eligibility, are: (a) School-aged and categorically eligible. (b) Enrolled in an NSLP/SBP-participating school, except for special provision schools, and: (1) Categorically eligible; (2) Meet requirements to receive free or reduced price meals . . . (3) Otherwise are determined eligible to receive a free or reduced price meal; or (4) Determined eligible through a Summer EBT application, consistent with § 292.13. (c) Enrolled in a special provision school, and: (1) Categorically eligible; (2) Otherwise meet the requirements to receive free or reduced price meals at § 292.5(a), as determined through an NSLP/SBP application; or (3) Determined eligible through a Summer EBT application, consistent with § 292.13 The Summer EBT 2025 iPOM [Interim Plan for Operations Management] and POM Template states, in part: 6. Eligibility . . . 6.3. For the purposes of streamline certifying children without matching to NSLP enrollment lists, provide the State’s legal ages of compulsory school enrollment . . . Minimum age: 6 Maximum age: 18 Applications/systems must be properly designed to achieve the business and IT goals of the organization. External factors affecting eligibility must be appropriately considered and properly evaluated to ensure eligibility for benefits is properly determined, and appropriate updates to eligibility are made when applicable. Data integrity in transit provides assurance that data remains complete, accurate, consistent, and unaltered while moving between systems. Data Integrity in transit controls such as cryptographic hashes, control totals, and checksums provide assurance that data sent from one system arrives at the destination completely, unchanged, and uncorrupted. During the audit period, the Ohio Department of Job and Family Services (JFS), as the prime recipient of the Summer EBT program, disbursed approximately $265.7 million in program benefits on behalf of eligible students. The Summer EBT program provides benefits to children who lose access to free and reduced-price meals through NSLP and SBP during the summer when school is not in session. The application process for Summer EBT benefits includes the completion and filing of an application form, verification of student enrollment, and verification of household income upon request. In addition to using information supplied by the household, the Summer EBT program may use data from other state agencies to verify the household’s identity, income, and other eligibility criteria. The State of Ohio uses a multi-agency approach for identifying eligible students of the Summer EBT program by obtaining and consolidating eligibility data for the Supplemental Nutrition Assistance Program (SNAP), Temporary Assistance for Needy Families (TANF), and Medicaid programs to assist in determining a child’s eligibility for benefits based on participation in these other federal programs and an application is not required. SNAP and TANF eligibility data from the State’s eligibility determination system, Ohio Benefits, is provided to the Ohio Department of Education and Workforce’s (the Department or DEW) Management Council (MC) in one data file prepared by a JFS vendor and additional files are provided throughout the audit period containing newly eligible students. NSLP/SBP free and reduced-price list data is sent to the MC by the school districts, in which the School IT Consortiums and Education Management Information System assist these schools in compiling and maintaining the data. Then the Ohio Department of Medicaid (MCD) compiles the Medicaid eligibility data, consisting of income and parental data, and demographic data from the Medicaid Information Technology System, Ohio Benefits, and the Member Months data mart and provides the Summer EBT dataset to the MC. The MC is responsible for combining these data files for every student, sorting the information by student name and program and identifying the student’s eligibility for the 2025 Summer EBT program by the following order: (1) SNAP, (2) TANF, (3) NSLP/SBP, (4) Medicaid, and (5) new application. However, for the 2024 Summer EBT program, the NSLP/SBP and Medicaid programs were reversed. If a student is listed multiple times (e.g., first name, last name, gender, and date of birth all agree), duplicates listed in the lower-level source of data will be removed (i.e., if eligible for (1) SNAP, any eligibility record for TANF, NSLP/SBP, or Medicaid, etc. will be removed. Although JFS, DEW, and MCD had controls in place to review program eligibility, the following items were noted: • Data Integrity in transit controls were not in place to help ensure the accuracy, completeness, and integrity of eligibility data provided to the MC by JFS or MCD via the secure file transfer protocol. • DEW’s MC had controls in place to review and verify the student data submitted by the local school districts to ensure the total student count and the number of eligible students submitted were accurate and complete, however, as indicated by the issues noted below, these controls were not operating effectively. o A school district inadvertently certified every enrolled student as eligible to receive Summer EBT benefits during state fiscal year 2025. After notifying DEW of this issue, the Department identified two additional school districts had also certified every student as eligible for the program. In total 5,349 students from these three school districts, totaling $641,880, were issued a Summer EBT card. JFS was able to successfully recoup $367,423 in ineligible funding and the remaining $274,457 had already been spent and therefore unrecoverable. JFS took action to mitigate the impact of the over issuance of funding and made arrangements with Food and Nutrition Services to repay the amounts incorrectly issued. o For seven of 44 (15.9%) students selected for eligibility testing, the students were deemed eligible for Summer EBT benefits based on data provided by MCD; however, these students did not meet the school-age requirements of six to 18 years of age to qualify for benefits. All seven students were five years old and did not qualify for the NSLP/SBP free or reduced price lunch as of the end of the 2024 Summer EBT program. Upon further inquiry, it was determined this issue was isolated to payments made in September 2024 and for students deemed eligible based on the MCD data in which students younger than six years old were included in the data set. As such, there were 54,226 students who received 2024 Summer EBT benefits in September 2024 that did not meet the school-age requirement of six years of age resulting in questioned costs totaling $6,511,920. o For one of 44 (2.3%) students selected for eligibility testing, the student was not eligible for SNAP, TANF, NSLP/SBP, or Medicaid and should not have received any Summer EBT benefits. Upon further investigation, it was determined the student did not utilize the Summer EBT card and the funding expired. Students have 122 days to utilize the Summer EBT benefits and JFS removes the remaining funds from the card after 122 days. As such, we will not be questioning costs since the Summer EBT benefits were not used. By not providing data integrity in transit controls, there is an increased risk of unauthorized changes to data, loss or corruption of data, and the overall integrity of the data while moving between systems. Overpayments to or on behalf of ineligible students may subject the State to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with the various state agencies, these data integrity issues were caused by an oversight. The Department received data from the school districts which included current enrollment, students who withdrew or registered but never attended which impacted the count of students and increased the risk of not identifying errors before deeming students eligible for the Summer EBT program. The eligibility issues were caused by the school district not being aware of or understanding the end date for the summer operational period and the Medicaid data set not being restricted to individuals meeting the school-age requirements of six to 18 years old for the applicable Summer EBT program. We recommend the Departments responsible for transferring eligibility data to develop and implement data integrity in transit controls to ensure the validation and completeness of data and to identify any unauthorized changes, loss, or corruption of data. These data integrity in transit controls could be completed through an automated validation script or system functions to verify completeness of the data. We recommend the Department and MC reinforce the eligibility requirements of the Summer EBT program to the partner agencies to ensure only school-age students are included in the data provided to the MC. We also recommend the Departments re-evaluate internal controls over the Summer EBT program’s eligibility determinations to ensure only eligible students are receiving benefits. These procedures should include the MC verifying the accuracy and completeness of student data submitted by the local school districts prior to disbursing the Summer EBT benefits. Also, DEW/the MC should regularly communicate the eligibility requirements to the school districts and expand the data fields to include the date each student was determined eligible for NSLP/SBP to help ensure only eligible students are approved to receive Summer EBT benefits.

1. ABANDONED MINE LAND RECLAMATION – TRANSPARENCY ACT REPORTING Finding Number: 2025-018 State Agency Number: DNR-01 Assistance Listing Number and Title: 15.252 – Abandoned Mine Land Reclamation Federal Award Identification Numbers / Years: S18AF20022 / 2018 S19AF20016 / 2019 S20AF20010 / 2020 S21AF10044 / 2021 S22AF00025 / 2022 S22AF00035 / 2022 S23AF00006 / 2023 S23AF00045 / 2023 S23AF00103 / 2023 S24AF00033 / 2024 S24AF00045 / 2024 S24AF00086 / 2024 S24AR80002 / 2024 S25AF00119 / 2025 Federal Agency: Department of Interior Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-020 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS portal or SAM.gov) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS portal or SAM.gov website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2025, the Department obligated approximately $34.6 million for 20 subawards which exceeded $30,000 and were required to be reported on the FSRS portal or SAM.gov website in accordance with the Transparency Act for the Abandoned Mine Land Reclamation program. However, the Department did not have controls in place to ensure the timely submission of these subawards within the FSRS portal or SAM.gov website which resulted in the following errors: Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 0 4 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $7,150,000 $0 $7,150,000 $0 $0 By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported timely within the FSRS portal or SAM.gov website, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussion with management, this issue was caused by oversight and information not being compiled timely for submission. We recommend the Department evaluate its Transparency Act reporting procedures and update as necessary to ensure compliance with Federal regulations, including the collection and timeliness of information submitted regarding subawards made for the Abandoned Mine Land Reclamation program. These procedures should include a supervisory review of the report information before it is submitted on the SAM.gov website [as of March 8, 2025]. Management should periodically review these control procedures to ensure they are operating as intended.

UNEMPLOYMENT INSURANCE – IMPROPER PAYMENTS Finding Number: 2025-011 State Agency Number: JFS-01 Assistance Listing Number and Title: 17.225 – Unemployment Insurance Federal Award Identification Numbers / Years: UI-37243-22-55-A-39 / 2022 UI-39342-23-55-A-39 / 2023 24-A-55-UI000039 / 2024 25-A-55-UI000070 / 2025 Federal Agency: Department of Labor Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Costs Principles, Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS 2 C.F.R. § 2900.4 gives regulatory effect to the Department of Labor (DOL) for 2 C.F.R. § 200.1 which states, in part: Improper payment means a payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. The term improper payment includes: any payment to an ineligible recipient; any payment for an ineligible good or service; any duplicate payment; any payment for a good or service not received, except for those payments where authorized by law; any payment that is not authorized by law; and any payment that does not account for credit for applicable discounts. . . . Ohio Rev. Code (ORC) § 4141.28 states, in part: . . . (B) APPLICATION FOR DETERMINATION OF BENEFIT RIGHTS . . . An individual filing an application for determination of benefit rights shall furnish proof of identity at the time of filing in the manner prescribed by the director. . . . ORC § 4141.29 states, in part: . . . (A) No individual is entitled to a waiting period or benefits for any week unless the individual: . . . (4)(a)(i) Is able to work and available for suitable work and, except as provided in division (A)(4)(a)(ii) or (iii) of this section, is actively seeking suitable work either in a locality in which the individual has earned wages subject to this chapter during the individual's base period, or if the individual leaves that locality, then in a locality where suitable work normally is performed. . . . ORC § 4141.30 states, in part: . . . (B) With the exceptions in division (B)(4) of this section, benefits are payable to each eligible and qualified individual on account of each week of involuntary total unemployment after the specified waiting period at the weekly benefit amount determined by: (1) Computing the individual's average weekly wage as defined in division (O)(2) of section 4141.01 of the Revised Code; (2) Determining the individual's dependency class under division (E) of this section; (3) Computing the individual's weekly benefit amount to be fifty percent of the individual's average weekly wage except, that the individual's weekly benefit amount shall not exceed the maximum amount shown for the individual's dependency class... . . . The federal government established rules, regulations, and requirements related to eligibility, benefit amounts and timing, monitoring responsibilities, etc. regarding Unemployment benefits. It is management’s responsibility to implement controls, processes, and procedures to provide reasonable assurance over the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with these rules, regulations, and requirements. During state fiscal year 2025, the Department disbursed approximately $950.9 million in unemployment benefits through the Ohio Job Insurance (OJI) benefit system. Eligibility for unemployment benefits was determined within OJI based upon requirements outlined in state and/or federal laws. Weekly, claimants confirmed their unemployment status and completed the required work search activities. If the claimant’s benefit payment was flagged, an adjudicator performed an additional review and requested fact-finding information for either monetary or nonmonetary issues. The claimant continued to receive weekly benefit payments until the adjudicator investigated the issue and confirmed the claimant’s status. If an issue was suspected of fraud, the issue was routed to the Department’s Benefit Payment Control section to be investigated, adjudicated and, if applicable, an overpayment flag was created in OJI. The Department’s policy, which is based on U.S. Department of Labor guidance, is to adjudicate possible fraud cases within 21 days or 90 days, depending on the circumstances of the case. Although the Department had various controls in place over regular unemployment benefit payments, the OJI system requires the Adjudicators to manually enter a significant amount of data into the system. To pay an unemployment benefit claim, the Adjudicators may have to clear multiple issues identified in the system before the claim can be paid. Furthermore, there are no alerts indicating when a pending issue prevents a claim from being paid which can result in significant delays in the payments to the claimants. Additionally, these controls did not prevent or detect the following noncompliance errors, resulting in known questioned costs totaling $3,274. The likely questioned costs would be in excess of $25,000 and therefore required to be reported under 2 C.F.R. § 200.516: • For two of 25 (8%) regular unemployment benefit claims identified in an OJI system data match as potential unemployment claims processed more than 30 days after the claimant’s benefit year end, the claimant was not eligible to receive benefits for the weeks claimed, was overpaid, or was underpaid, as follows: • One claimant did not provide the necessary documents to prove their identity. The Claims Examiner cleared the identity verification issue in OJI; however, there is no documentation showing the claimant verified their identity. As a result, the claimant was overpaid benefits of $2,988 during the audit period. • Due to an OJI system issue at the time the claim was filed, the claimant’s dependency class designated did not agree with the information provided on the application. This resulted in an underpayment of $143. • For one of 25 (4%) regular unemployment benefit claims identified in an OJI system data match as potentially exceeding the maximum allowable amount, the claimant stated in the application a qualifying dependent. However, the Department denied the dependent without mailing an Eligibility notice to allow the claimant to prove the identity of the dependent. This resulted in the claimant potentially being underpaid $124 for the week reviewed. • For one of 60 (1.77%) regular unemployment benefit claims selected for testing, the claimant was not eligible to receive benefits for the week claimed per ORC 4141.29(A)(4)(a)(i). The claimant did not provide the necessary documents evidencing clearance to work, therefore, the claimant was ineligible for unemployment benefits. This resulted in an overpayment of $286 to the claimant. Without effective internal controls for the eligibility determination and benefit payment processes, including manual data entry or the lack of alerts indicating when a pending issue prevents a claim from being paid, there is an increased risk benefit payments will be inaccurate, unallowable, or eligibility determinations not being made in a timely manner. Overpayments to ineligible claimants may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, these errors were due to oversight and system design flaws within OJI. We recommend Department management: • Evaluate and strengthen current internal control procedures over the Unemployment Insurance program to ensure claimants are eligible, receive the correct weekly benefits and system design flaws such as limiting manual data entry and developing alerts for pending issues that impact claims being paid timely. This should include evaluating the cause of the errors identified above and updating controls as necessary. • Periodically monitor the established controls to determine if they are working effectively and as intended. • Perform periodic reviews of the claimant files to reasonably ensure the information is properly maintained and accurately entered into the related systems. • Evaluate underpayments, overpayments and/or payments to ineligible claimants and offset future benefits or seek reimbursement, where necessary.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – SUBRECIPIENT MONITORING Finding Number: 2025-004 State Agency Number: DEV-02 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Numbers / Years: SLFRP2610 / 2021 SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-005 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2. C.F.R. § 200.332, which establishes requirements over subawards for pass-through entities and states: All pass-through entities must: . . . (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. . . . It is management’s responsibility to design and implement internal control procedures over subrecipient monitoring to ensure federal funds are being spent for allowable purposes and in accordance with program requirements. It is also management’s responsibility to monitor these control procedures to ensure they are operating effectively and as intended. During state fiscal year 2025, the Department expended approximately $389.5 million in subawards to SLFRF subrecipients. The Department created several subprograms for various development and community-related activities as part of the SLFRF program. The subrecipients of these subprograms were required to submit a quarterly program report which includes data on projects funded, expenditures, contracts, and subawards equal to or greater than $50,000, to the Department through the Salesforce System. The Department’s Community Services Division oversees the Water Sewer Quality program and did not obtain the required quarterly program reports 13 out of 23 (56.5%) subrecipients selected for testing. Further, the Community Services Division did not have a process in place to follow-up with its subrecipients to obtain the missing program reports for a majority of the audit period [until April 2025]. Without adequate procedures in place to collect program reports from subrecipients to monitor compliance with federal statutes, laws, and regulations, there is an increased risk subrecipients may misuse federal funds for unauthorized purposes. This could lead to fines, penalties, or repayment of program funds being imposed by the federal grantor agency. Based on discussions with management, the lapse in monitoring was caused by employee turnover, slowing the monitoring of subrecipient’s report submissions. We recommend the Department develop and re-evaluate its internal control procedures to ensure all subprograms and subrecipients are adequately monitored for program compliance. We also recommend the Department evaluate existing control procedures to reasonably ensure the quarterly program reports submitted through the Salesforce System are timely, accurate, and complete. These procedures should be adequately documented and maintained to ensure the internal controls are in place and operating as management intended. Management should periodically monitor these procedures to ensure they are working as intended.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – REPORTING Finding Number: 2025-005 State Agency Number: DEV-03 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Numbers / Years: SLFRP2610 / 2021 SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-006 NONCOMPLIANCE AND MATERIAL WEAKNESS 31 C.F.R. § 35.4(c) related to reporting for pandemic relief funds states, in part, Reporting and requests for other information. During the period of performance, recipients shall provide to the Secretary periodic reports providing detailed accounting of the uses of funds, modifications to a State or Territory’s tax revenue sources, and such other information as the Secretary may require for administration of this section. In addition to regular reporting requirements, the Secretary may request other additional information as may be necessary or appropriate, including as may be necessary to prevent evasions of the requirements of this subpart. . . . It is management’s responsibility to design and implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. Management is also responsible for ensuring internal controls over reporting are operating effectively and as intended. During state fiscal year 2025, the Department expended approximately $510.2 million in SLFRF program expenditures. To facilitate this spending, the Department created several subprograms for various development and community-related activities which are administered by various divisions/officed within the Department. During the audit period, the Department was responsible for compiling SLFRF program activity for these subprograms and submitting it to the Ohio Office of Budget and Management (OBM) which compiled and submitted the quarterly Performance and Expenditure Reports to the Department of Treasury on behalf of the State of Ohio for all SLFRF activities. The Department’s Community Services Division was responsible for compiling and submitting the Water Sewer Quality subprogram’s quarterly Performance and Expenditure Reports. The Department’s Governor’s Office of Appalachia contracted with a vendor to compile the reports for the ARPA Appalachian Community Grants subprogram and the Department’s Finance Division submitted it to OBM. All other SLFRF subprogram reports were compiled and submitted by the Department’s Finance Division. Prior to submission, each report goes through a multilevel review and certification process at the Department to ensure program descriptions, narratives, and amounts are accurate and align with federal expenditure categories. However, four of 11 (36.4%) quarterly Project and Expenditure Reports selected for testing were not mathematically accurate and did not agree to support used in the reports submitted to OBM. Failure to accurately report financial and programmatic information submitted to the federal grantor agency could result in federal funds being reduced, taken away, or other sanctions imposed by the federal grantor agency. Based on discussions with management, the reporting issues identified were caused by employee turnover experienced during the audit period. We recommend the Department evaluate and strengthen internal controls over its reporting process to reasonably ensure the information presented in the quarterly Performance and Expenditure Reports is current, accurate, and complete and agrees to support prior to submission to OBM. Management should periodically monitor these procedures to ensure they are working as intended. Lastly, we recommend the Department cross train employees so in the event of turnover or extended leave, the reporting process can continue without disruption or delays.

1. CWSRF & DWSRF – LOAN PAYMENT MONITORING Finding Number: 2025-010 State Agency Number: EPA-01 Assistance Listing Numbers and Titles: 66.458 Clean Water State Revolving Fund (CWSRF) 66.468 Drinking Water State Revolving Fund (DWSRF) Federal Award Identification Numbers / Years: DWSRF 98595421 / 2021 DWSRF 00E03243 / 2022 DWSRF 00E03332 / 2022 DWSRF 01E03243 / 2023 DWSRF 01E03332 / 2023 DWSRF 02E03246 / 2024 DWSRF 98595424 / 2024 CWSRF 00E03331 / 2022 CWSRF 01E03331 / 2023 CWSRF 02E03345 / 2024 CWSRF 00E03345 / 2024 Federal Agency: Environmental Protection Agency Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs / Cost Principles, Cash Management, Matching, Level of Effort, Earmarking and Period of Performance Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-011 MATERIAL WEAKNESS It is management’s responsibility to design and implement an internal control structure capable of providing reasonable assurance that objectives are being achieved. As the prime recipient of federal funds awarded through the CWSRF and DWSRF programs, the Agency must implement internal controls that reasonably ensure amounts paid to borrowers (usually local government agencies), through the Ohio Water Development Authority (OWDA), are processed accurately, completely, and in compliance with the applicable federal laws and regulations. During the audit period, the Agency expended approximately $156.9 million in federal funds for the CWSRF program and approximately $125.1 million in federal funds for the DWSRF program to borrowers, providing low interest financing for costs associated with the planning, design, and construction of eligible clean and drinking water projects and activities to protect human health. Ohio Rev. Code (ORC) § 6111.036 requires the Agency and OWDA to share responsibility for the management of the program. An interagency agreement between the Agency and OWDA establishes the responsibilities to be performed by each agency, including assigning OWDA the authority to make payments to program recipients in accordance with the approved loan agreement and the disbursement protocol. Prior to providing funding for a project, the Agency enters into a loan agreement with the borrower and prepares a disbursement protocol agreement, which establishes the eligible costs and source of funds for the project. After receiving invoices for construction projects, the borrower completes the electronic Fund Payment Request form (FPR) via OWDA’s website. OWDA reviews the FPR for reasonableness and compliance with the loan agreement, approves the FPR, disburses the funds to the borrower, and forwards the documentation to the Agency. Agency coordinators review the documentation to ensure the disbursement was allowable under the grant requirements and saves a copy of the FPR and supporting documentation in the Assistance Information Management System (AIMS). Although the Agency maintains a written procedure stating this review should be performed within 45 days of the disbursement made by OWDA and should be performed for 70% of the disbursement vouchers it appears the written procedure was inconsistently applied and the following items were noted: • For three of four (75%) quarters selected for testing, the Agency did not maintain evidence that management was monitoring procedures to ensure 70% of disbursement voucher reviews were completed. • For 11 of 60 (18.3%) CWSRF disbursements selected for testing, the disbursements were not reviewed within 45 days in AIMS; the disbursements were reviewed three to 192 days after payment, averaging 35 days late. • For ten of 60 (16.7%) DWSRF disbursement selected for testing, the disbursements were not reviewed within 45 days in AIMS; the disbursements were reviewed 12 to 146 days after payment, averaging 64 days late. Additionally, the Agency completes quarterly reconciliations over CWSRF and DWSRF program revenues and expenditure activity, by examining internal records maintained for disbursements, transfers, and grant balances, OWDA records, and bank statements. The completed reconciliation spreadsheet is reviewed and approved by the Agency’s Chief Financial Officer. Although the Agency completed the quarterly reconciliations during the audit period, four of eight (50%) reconciliations tested for both programs were not completed and reviewed timely, ranging from three days to 135 days after the end of the quarter, for an average of 70 days. Without performing timely reviews of invoices and FPRs submitted for reimbursement by the borrower or performing other monitoring activities, the Agency cannot be reasonably assured OWDA’s review process ensured payments made to borrowers were accurate and for allowable activities. If the Agency does not perform timely reviews, there is an increased risk that noncompliance will not be identified in a timely manner. As a result, there is a risk federal funding will be reduced or withdrawn, or other sanctions will be imposed by the federal grantor agency. Additionally, without performing timely reconciliations between the Agency’s internal records and bank statements and subsequently investigating and resolving any significant differences noted, there is an increased risk that decisions are based off miscoded or inaccurate account balances. Through discussions with management, the Agency did not implement any monitoring tools until after the prior year comment was communicated. The Agency also updated its policies and procedures, but these policies did not reflect the process followed by Agency personnel. We recommend management evaluate existing policies regarding disbursement reviews and reconciliations and update them as necessary, to ensure the monitoring procedures performed match up to what is documented in their policy manual. Management should evaluate the transactions processed to identify areas of risk and other relevant criteria when designing the procedures regarding the Agency’s review of invoices received from OWDA. We also recommend management implement periodic monitoring procedures to ensure the disbursement review and reconciliation procedures are performed timely, consistently, and accurately. Auditor of State Conclusion: The response to this finding included within the State of Ohio Corrective Action Plan indicated the Agency disagreed as internal policies were followed as intended and appropriate controls were in place as of May 2025 which required an Auditor of State Conclusion. The Agency’s internal policy states, in part: “DEFA-OFA [Division of Environmental and Financial Assistance (DEFA) – Office of Financial Administration (OFA)] staff monitors these disbursements by performing a review of 70% of the disbursement vouchers for compliance with program requirements.” Furthermore, the internal policy states, in part: “Timely review is to be performed within 45 days of receipt [60 days of receipt beginning June 2025]…”. The Agency did not maintain documentation for three of four quarters, evidencing over 70% of all disbursement vouchers received in 2025 were reviewed within 45 days. Therefore, this finding remains as stated above.

SNAP CLUSTER AND TANF – IEVS ALERTS Finding Number: 2025-012 State Agency Number: JFS-02 Assistance Listing Numbers and Titles: 10.551/10.561 – SNAP Cluster 93.558 – Temporary Assistance for Needy Families (TANF) Federal Award Identification Numbers / Years: 232OH102S2514 / 2023 (SNAP Cluster) 232OH102S6018 / 2023 (SNAP Cluster) 242OH102S2514 / 2024 (SNAP Cluster) 242OH102S6018 / 2024 (SNAP Cluster) 252OH102S2514 / 2025 (SNAP Cluster) 252OH102S6018 / 2025 (SNAP Cluster) 2301OHTANF / 2023 (TANF) 2401OHTANF / 2024 (TANF) 2501OHTANF / 2025 (TANF) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Special Tests and Provisions – Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Numbers: 2024-012 NONCOMPLIANCE AND MATERIAL WEAKNESS 7 C.F.R. § 272.8(c), states the following regarding the Supplemental Nutrition Assistance Program (SNAP) Cluster: (1) State agency action on information items about recipient households shall include: (i) Review of the information and comparison of it to case record information; (ii) For all new or previously unverified information received, contact with the households and/or collateral contacts to resolve discrepancies as specified in §§ 273.2(f)(4)(iv) and 273.2 (f)(9)(iii) and (f)(9)(iv); and (iii) If discrepancies warrant reducing benefits or terminating eligibility, notices of adverse action. (2) State agencies must initiate and pursue the actions on recipient households specified in paragraph (c)(1) of this section so that the actions are completed within 45 days of receipt of the information items. Actions may be completed later than 45 days from the receipt of information if: (A) The only reason that the actions cannot be completed is the nonreceipt of verification requested from collateral contacts; and (B) The actions are completed as specified in § 273.12 of this chapter when verification from a collateral contact is received or in conjunction with the next case action when such verification is not received, whichever is earlier. (3) When the actions specified in paragraph (c)(1) of this section substantiate an over issuance, State agencies must establish and take actions on claims as specified in §273.18 of this chapter. (4) State agencies must use appropriate procedures to monitor the timeliness requirements in paragraph (c)(2) of this section. 45 C.F.R. § 205.56(a)(1)(iv) states the following regarding the Temporary Assistance for Needy Families (TANF) program: For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary, except that: Completion of action may be delayed beyond forty-five (45) days on no more than twenty (20) percent of the information items targeted for follow-up, if: (A) The reason that the action cannot be completed within forty-five (45) days is the nonreceipt of requested third-party verification; and (B) Action is completed promptly, when third party verification is received or at the next time eligibility is redetermined, whichever is earlier. If action is completed when eligibility is redetermined and third party verification has not been received, the State agency shall make its decision based on information provided by the recipient and any other information in its possession. As the lead agency responsible for administering the SNAP Cluster and TANF federal programs for the State of Ohio, the Department is responsible for providing reasonable assurance that only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. When automated systems are utilized to perform certain functions related to this compliance requirement, management must ensure the system is properly designed and operating effectively. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. As part of monitoring, the Department’s Fraud Control Section conduct Fraud Triad Reviews, which in part include a review of 1) Income Eligibility Verification System (IEVS) processing timeliness, 2) proper verifications, 3) proper disposition coding and 4) random supervisory reviews. The Fraud Control Section also conducts random reviews of cases with an IEVS alert to ensure they were cleared properly and timely, as well as monitor the JFSR 4005, IEVS Monthly Summary Report to track completion of IEVS alerts and to identify counties that need technical assistance. The SNAP Cluster and TANF federal programs are administered using a multi-agency approach: overall compliance and administration of the programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Department also utilizes the 88 Ohio County Departments of Job and Family Services (counties) in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. The Ohio Benefits system was utilized for processing eligibility for the SNAP Cluster and TANF programs with total expenditures to recipients of approximately $3.2 billion and $210 million, respectively, during state fiscal year (SFY) 2025. The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the IEVS functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration, Internal Revenue Service (IRS), etc.). Information that does not agree is communicated in the form of an Ohio Benefits system alert. The Ohio Benefits system then determines if the alert is a ‘match’ that requires action. The IEVS match, indicated by ‘Yes’ in the Ohio Benefits system, is forwarded to the appropriate county agency for investigation and resolution. Each match has a defined due date, which is unique based on the priority level and other policy and process related factors. However, we noted the following weaknesses: • Volume of Alerts – During SFY 2025, more than 16.9 million alerts (3.0 million IEVS alerts and 13.9 million non-IEVS alerts) were issued for all public assistance programs that utilize Ohio Benefits, including the SNAP Cluster and TANF programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs or other triggers within the system. However, the volume of incoming alerts being sent to the county caseworkers results in an increased workload and ineffective application of the alert process. • Caseworker Reliance/Training – The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process, including reviewing IEVS matches. The Department utilizes its monitoring of the JFSR 4005, IEVS Monthly Summary Report to better identify those county agencies which require additional training and technical assistance. The Department also continues to conduct statewide trainings and individual trainings for county agencies to assist them in working IEVS alerts/matches; however, these trainings are typically optional and/or attended by a representative of the county agency who is expected to relay the information to others. Additionally, we noted the following noncompliance with federal regulations where IEVS alerts were not cleared timely. • Clearing Alerts – While the Department has controls and procedures in place to review and monitor IEVS alerts and matches generated and processed by the Ohio Benefits system, there were instances when matches were not being completed by the county agencies in accordance with the required timeframes established in 7 C.F.R. § 272.8, and 45 C.F.R. § 205.56. Furthermore, an Ohio Benefits data file containing IEVS matches showed 202,334 of the 376,492 (53.7%) IEVS alerts sent to the county agencies during the audit period were not cleared within 45 days as required. The matches were cleared between one and 433 days beyond the 45-day requirement, for an average of 131 days late. Failure to implement system enhancements timely, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframes increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department’s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, this was caused by the Department’s county administered approach creating challenges to making training mandatory. Training is continued to be offered and made available to county personnel. Further, management indicated they continue to work with DAS to monitor the system and enhancements to ensure they meet the desired impact of clearing alerts in a timely manner, as well as reach out to county and state personnel to offer technical assistance. However, the high volume of alerts presents difficulties to the caseworkers. We recommend Department management continue to work collectively with DAS to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: • Including a more centralized evaluation of alert/match activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. • Continuing to perform periodic and timely reviews of the JFSR 4005, IEVS Monthly Summary Report at the Department level to monitor the status and completion of IEVS matches, as well as identify areas of training for the counties. Such procedures should also include required monitoring by each County IEVS Coordinator or other supervisory personnel (through the eligibility system). The Department should clearly communicate the expectations for these monitoring procedures to the counties and implement procedures to ensure the counties are properly completing them, possibly as part of the Fraud Triad Reviews. • Requiring mandatory IEVS training for all county agency employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual’s eligibility determination being made. The Department should continue to provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. We also recommend the Department continue to monitor the IEVS alert processing procedures guide for the matches issued by the Ohio Benefits system to ensure matches are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the county agencies for resolved matches.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM – PERIOD OF PERFORMANCE Finding Number: 2025-003 State Agency Number: DEV-01 Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Numbers / Years: 2201OHLIEA / 2022 2301OHLIEA / 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Period of Performance Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-002 QUESTIONED COSTS 45 C.F.R. § 96.30 (a) states, in part: . . . Except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures applicable to the obligation and expenditure of its own funds... The Financial Management and Reporting section of the US Department of Health and Human Services' LIHEAP Supplemental Terms and Conditions states, in part: 8. Obligation Deadline: The two-year funding (project) period for this award is concurrent with the obligation period: from the first day of the FFY for which these funds were awarded through the last day of the following FFY. (i.e., October 1, FFY 1 through September 30, FFY 2.) . . . Any federal funds not obligated by the end of the two-year obligation period will be recouped by the Department. 9. Liquidation Deadline: According to 45 CFR §96.30(a), all properly obligated federal funds issued under this award must be liquidated in accordance with the recipient’s own fiscal control and funds control procedures. If the recipient requires more than 1 year from the project period end date to liquidate allowable costs, it shall notify the Grants Management Officer identified on its latest Notice of Award. The notification shall include the reason for the delay and the anticipated timeframe for liquidation. Any federal funds from this award not liquidated by the date required under the recipient’s own fiscal control procedures, which may not exceed five years following the fiscal year of award, will be recouped by this Department. During the audit period, the Department disbursed approximately $167.2 million in LIHEAP funds to eligible entities on behalf of eligible low-income households to help reduce costs associated with home energy bills, weatherization, and minor energy-related home repairs. The Department had various controls in place over the LIHEAP expenditure process; however, these controls did not prevent or detect the Department’s non-compliance with the program’s period of performance requirements. As a result, the Department did not obligate 12 administrative expenditures, totaling $26,107, by the close of the period of performance dates of September 30, 2023 and 2024. Funds were obligated outside the period of performance’s end date, ranging from 45 to 593 days past the required end date, averaging 425 days. Additionally, the Department did not liquidate $8,470 in LIHEAP funds within one year from the project period end date and did not properly notify the U.S. Department of Health and Human Services. Of the $8,470 improperly liquated expenditures, $780 was properly obligated and an allowable program expenditure; therefore, $7,690 will be questioned costs and is included in the obligation amount previously noted. As such, we will question these costs totaling $26,107. Failure to obligate funds and properly disclose necessary expenditures to the federal grantor agency in the required time frames could result in repayment, reduction of future federal funding, or sanctions imposed by the federal grantor agency. Based on discussion with management, the late obligation of these expenditures and failure to properly notify the federal grantor agency was a result of management oversight. We recommend the Department evaluate its current policies and procedures relating to the processing of LIHEAP expenditure transactions and update them, as necessary, to reasonably ensure compliance with period of performance requirements. The Department should consider performing interim and periodic reviews of LIHEAP subaward and expenditure activity in advance of the obligation end dates to ensure the federal awards are obligated within the required time frames. The Department should also evaluate liquidation timelines for notifications to the appropriate Federal contact, as needed. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

4. LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM – REPORTING Finding Number: 2025-006 State Agency Number: DEV-04 Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Numbers / Years: 2401OHLIEI / 2024 2401OHLIEA / 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. § 96.30 (b) states, in part: . . . After the close of each statutory period for the obligation of block grant funds and after the close of each statutory period for the expenditure of block grant funds, each grantee shall report to the Department: (i) Total funds obligated and total funds expended by the grantee during the applicable statutory periods; and (ii) The date of the last obligation and the date of the last expenditure. State recipients are required to submit the LIHEAP Performance Data Form, an annual report in response to Section 2610(b) of the LIHEAP statute (42 U.S.C. § 8629(b)). The LIHEAP Performance Data Form consists of the following modules: • Module 1 (Grant Recipient Survey) collects LIHEAP data on sources and uses of funds, average benefits, and maximum income cutoffs for four-person households for each type of LIHEAP assistance provided . . . • Module 2 (Performance Measures) collects LIHEAP data on energy burden targeting, the restoration of home energy service, and the prevention of loss of home energy . . . • Module 3 (Optional Performance Measures) allows state LIHEAP grant recipients . . . to voluntarily report additional LIHEAP data on energy burden targeting, the restoration of home energy service, and the prevention of loss of home energy service . . . It is management’s responsibility to implement control policies and procedures to reasonably ensure federal reports submitted are accurate, complete, and in compliance with program requirements. It is imperative management maintain the underlying data and related program documentation used to prepare and support these reports. The Department's Finance Division is responsible for preparing and submitting the SF-425, Federal Financial Reports for the LIHEAP program. Although the Finance Division has controls in place over the compilation and approval of the SF-425 Financial Reports, two of three (67.7%) SF-425 reports erroneously included three additional months of financial transactions past the reporting period end date. The inclusion of the additional data resulted in mathematical inaccuracies throughout both reports. Additionally, the Department’s Office of Community Assistance is responsible for preparing and submitting the LIHEAP Performance Data Form to HHS. Although the Office of Community Assistance has controls in place over the preparation and approval of the LIHEAP Performance Data Form, the form was not mathematically accurate and did not trace to supporting documentation. The Office of Community Assistance understated the All Funds Carried Over from Previous Federal Fiscal Years amount by $5,994,888. The amount was reported as $4,380,858, but should have been reported as $10,375,746. Reporting inaccurate and/or incomplete information could subject the Department to federal sanctions, limiting the amount of funding for program activities. This also increases the risk that those using these reports could be relying on inaccurate information. Based on discussion with management, the inaccurate reporting was caused by management oversight when compiling these reports. We recommend the Department re-evaluate and strengthen existing internal control procedures or implement additional procedures, as necessary, to provide management reasonable assurance that the financial information and/or performance data being reported to the federal government is accurate and traces to supporting documentation. Management should periodically review these procedures to ensure they are operating as intended.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM – TRANSPARENCY ACT REPORTING Finding Number: 2025-007 State Agency Number: DEV-05 Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Numbers / Years: 2301OHLIEE / 2023 2401OHLIEE / 2024 2401OHLIEA / 2024 2501OHLIEA / 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-003 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS portal or SAM.gov) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS portal or SAM.gov website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During the audit period, the Department obligated approximately $120.5 million for 293 LIHEAP first-tier subawards that exceeded $30,000 and were required to be reported on the FSRS portal or SAM.gov website in accordance with the Transparency Act. The Department’s Finance Division manages the Transparency Act reporting for all applicable programs. Monthly, the Finance Division obtains information about the subgrants required to be reported or updated on the FSRS portal or SAM.gov website from an automated monthly encumbrance report. Once prepared, the identified subawards are entered into the FSRS portal or SAM.gov website, the month following the obligation date of the subaward. Each month the Finance Division reconciles the subawards reported to the Department’s internal reports to ensure accuracy, completeness, and timeliness of subawards reported. Although the Department had various controls in place over the Transparency Act reporting, the following errors were noted: Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 45 15 45 0 16 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $16,858,197 $4,152,190 $16,858,197 $0 $4,383,851 By not complying with Federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS portal or SAM.gov website, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, this was caused by difficulties experienced when transitioning the transparency act reporting to SAM.gov and staffing shortages within the Department. We recommend the Department continues to evaluate its internal controls over the SAM.gov reporting process [as of March 8, 2025] by collecting and reporting complete, accurate, and timely information regarding the subawards subject to the Transparency Act. We also recommend the Department cross-train employees over the LIHEAP Transparency Act reporting process to ensure the SAM.gov reporting can be performed by various personnel during vacations or with employee turnover. Management should periodically review these procedures to ensure they promote compliance with federal regulations and are operating as intended.

1. MEDICAID CLUSTER/CHIP – INELIGIBLE RECIPIENTS Finding Number: 2025-013 State Agency Number: MCD-01 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2505OH5025 / 2025 (CHIP) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) 2505OH5MAP / 2025 (Medicaid Cluster Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-014 QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS NOTE: Finding number 2025-014 details deficiencies and weaknesses in internal control related to the Medicaid Cluster and CHIP programs regarding the Department’s eligibility processes. That finding is integral to and should be read in conjunction with this finding. 42 C.F.R. § 435.10, State Plan requirements, pertaining to the Medicaid Cluster states, in part A. State plan must--- (a) Provide that the requirements of this part are met; and (b) Specify the groups to whom Medicaid is provided, as specified in subparts B, C, and D of this part, and the conditions of eligibility for individuals in those groups. 42 C.F.R. § 431.17, Maintenance of records, pertaining to the Medicaid Cluster states, in part: (b) Content of records. A State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include all of the following: (1) Individual records on each applicant and beneficiary that contain the following: (i) All information provided on the initial application submitted . . . on behalf of, the applicant or beneficiary, including the signature on the date of application. . . . (iii) The date of, basis for, and all documents or other evidence to support any determination, denial, or other adverse action, including decisions made at application, renewal, and as a result of a change in circumstance, taken with respect to the applicant or beneficiary, including all information provided by, or on behalf of, the applicant or beneficiary, and all information obtained electronically or otherwise by the agency from third-party sources. . . . (v) Any changes in circumstances reported by the individual and any actions taken by the agency in response to such reports. (vi) All renewal forms and documentation returned by, or on behalf of, a beneficiary, to the Medicaid agency in accordance with § 435.916 of this chapter, . . . . including the signature on the form and date received. . . . 42 C.F.R. § 435.916, Regularly scheduled renewals of Medicaid eligibility, states in part: (a) Frequency of renewals. . . (1) The eligibility of Medicaid beneficiaries not described in paragraph (a)(2) of this section must be renewed once every 12 months, and no more frequently than once every 12 months. (2) The eligibility of qualified Medicare beneficiaries described in section 1905(p)(1) of the Act must be renewed at last once every 12 months, and no more frequently than once every 6 months. (b) Renewals of eligibility – (1) Renewal on basis of information available to agency. The agency must make a redetermination of eligibility for all Medicaid beneficiaries without requiring information from the individuals if able to do so based on reliable information contained in the individual’s account or other more current information available to the agency, including but not limited to information through any data bases accessed by the agency . . . 42 C.F.R. § 435.912(c), Timely determination and redetermination of eligibility, states in part: (3) . . . the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed— (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 U.S.C. § 1397bb(b), pertaining to the Children’s Health Insurance Program (CHIP) states, in part: (1) Eligibility Standards (A) The plan shall include a description of the standards used to determine the eligibility of targeted low-income children for child health assistance under the plan. . . 42 C.F.R. § 457.380(d), Eligibility verification pertaining to CHIP states: Income. If the State does not accept self-attestation of income, the State must verify the income of an individual by using the data sources and following standards and procedures for verification of financial eligibility consistent with § 435.945(a), § 435.948, and § 435.952 of this chapter. 42 C.F.R. § 457.344, Changes in circumstances pertaining to CHIP, states in part: (a) Procedures for reporting changes. The agency must: (1) Have procedures designed to ensure that enrollees understand the importance of making timely and accurate reports of changes in circumstances that may affect their eligibility . . . (b) State action on information about changes . . . the State must promptly redetermine eligibility between regularly scheduled renewals of eligibility required under § 457.343, whenever it has reliable information about a change in an enrollee’s circumstances that may impact the enrollee’s eligibility for CHIP, the amount of child or pregnancy-related health assistance for which the enrollee is eligible, or the enrollee’s premiums or cost sharing charges. . . . (1) The State must redetermine eligibility based on available information, if possible. When needed information is not available, the State must request such information from the enrollee in accordance with § 435.952(b) and (c) of this chapter . . . Ohio Rev. Code § 5164.57(A)(1), Recovery of Medicaid Overpayments states, in part: . . . the department of medicaid may recover a medicaid payment or portion of a payment made to a medicaid provider to which the provider is not entitled if the department notifies the provider of the overpayment during the five-year period immediately following the end of the state fiscal year in which the overpayment was made. Ohio Admin. Code § 5160-26-02.1, Managed care: termination of enrollment states, in part: . . . (B) The Ohio department of medicaid (ODM) will terminate a member from enrollment in a managed care organization (MCO) for any of the following reasons: . . . (3) The member dies, in which case MCO enrollment ends on the date of death (D) All of the following apply when enrollment in an MCO or the SPBM [Single Pharmacy Benefit Manager] is terminated for any of the reasons set forth in paragraph (B) or (C) of this rule: . . . (5) ODM shall recover from the MCO or the SPBM any capitation paid for retroactive enrollment termination occurring . . . The Medicaid and CHIP State Plan outlines the specific eligibility conditions and standards within Sections 2.2 – Coverage and Conditions of Eligibility and 2.6 A – Financial Eligibility, Eligibility Conditions and Requirements for Medicaid, and Section 4 – Eligibility Standards and Methodology for CHIP. It is management’s responsibility to implement policies and procedures to provide reasonable assurance they have complied with these requirements. As the lead agency for administering the Medicaid Cluster and CHIP federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and the documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is also the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. During state fiscal year (SFY) 2025, the Department disbursed a combined total of $29.6 billion in public assistance benefits to recipients processed through the Ohio Benefits system related to the following programs: Assistance Listing Number & Title Benefits Paid # of Recipients* 93.767 - CHIP $916,720,909 242,000 93.775/93.777/93.778 – Medicaid Cluster $28,653,789,593 2,646,003 Combined Total $29,570,510,502 2,888,003 * We did not separately identify recipients who could be covered under both programs. These programs are administered using a multi-agency approach, as follows: overall compliance and administration of the Medicaid Cluster and CHIP programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs. The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (JFS), utilizes the 88 County Departments of Job & Family Services (CDJFS) in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through various methods. The CDJFS collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS and utilized by the Department. After collecting documentation, the county caseworker enters the individual’s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department’s new Ohio Medicaid Enterprise System’s (OMES) Fiscal Intermediary (FI) to process the provider payments. The following noncompliance was noted related to eligibility for the Medicaid Cluster and CHIP programs, which included questioned costs for Medicaid totaling $2,384 and CHIP totaling $204,076: • One of 81 (1.2%) Medicaid recipients and six of 80 (7.5%) CHIP recipients selected for testing were not eligible to receive benefits on the date services were performed as they were not validly enrolled beneficiaries based on information in Ohio Benefits, the State’s official eligibility determination system. Therefore, these items will result in questioned costs for all claims paid for services provided for these individuals during the time they were ineligible, totaling $1,238 for Medicaid and $204,076 for CHIP. The items noted included issues such as: o The recipient failed to timely report an increase in income. o The wrong household size was utilized when determining eligibility; as a result, the recipient was over the income limit. • Three of 81 (3.7%) Medicaid recipients and seven of 80 (8.8%) CHIP recipients selected for testing were not placed in the correct benefit aid category. One of the three Medicaid recipients and six of the seven CHIP recipients were included in the first bullet and deemed ineligible for both programs. • One of 81 (1.2%) Medicaid recipients and seven of 80 (8.8%) CHIP recipients selected for testing did not have adequate documentation to support the Department's decision on the recipient’s eligibility, or incorrect information was entered into Ohio Benefits. The Medicaid recipient and six of the seven CHIP recipients were included in the first bullet and deemed ineligible for both programs. • One of 81 (1.2%) Medicaid recipients selected for testing was eligible during the date of service initially tested; however, during testing we identified questioned costs for Medicaid after the recipient’s date of death resulting in questioned costs totaling $1,146. • One of 13 (7.7%) CHIP recipients selected for testing with applications during the audit period did not have the initial eligibility determination completed within 45 days. ADDITIONAL QUESTIONED COSTS: The Ohio Benefits system is designed to generate alerts to notify the CDJFS caseworkers of a deceased match. The Department has 10 calendar days to process a re-determination when a change has been reported affecting a recipient’s ongoing eligibility. When the Department has been notified of a potential death of a recipient, the recipient is to be removed from managed care and placed in fee for service until confirmation of the death is received. An analysis of the Medicaid Cluster’s managed care capitation payments and the fee for service medical claims paid during SFY 2025 were compared to the death master file received from the Ohio Department of Health to identify any payments with a capitation month or date of service after the recipient’s date of death. The Department made 13,159 payments, totaling $2.5 million, on behalf of 2,165 deceased individuals receiving Medicaid benefits were included in the population to determine if the payments were allowed. We selected 60 of the 2,165 deceased individuals for further testing to determine if the Department took the appropriate action to identify and/or recover the payments. Twenty-one of 60 (35%) Medicaid recipients tested had an unallowable fee for service payment made on behalf of these deceased individuals which was not recovered by the Department, resulting in questioned costs, totaling $41,599. Furthermore, during testing we determined the Department recouped overpayments or reversed unallowable claims on behalf of 25 recipients, totaling $59,295. The questioned costs noted above only includes the outstanding amounts. The items noted above under Noncompliance and Additional Questioned Costs resulted in questioned costs for both the Medicaid Cluster and CHIP, as summarized in the table below: Summary of Questioned Costs by Category Medicaid Cluster CHIP Ineligible Recipients $2,384 $204,076 Deceased Individuals $41,599 N/A* Total Questioned Costs: $43,983 $204,076 *We completed testing over CHIP Deceased Individuals; however, we did not identify any claims paid past the recipient’s date. Without proper controls for entering, processing, and maintaining recipient information, including working system alerts in a timely manner, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, the issues identified were caused by oversight and systemic issues. We recommend the Department evaluate and seek reimbursement for all claims that were incorrectly paid. We also recommend management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. We also recommend the Department regularly evaluate selected benefit payments to verify the recipient’s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate and the information is being maintained to support the Department’s eligibility decision, and ensure initial eligibility determinations and redeterminations are completed timely. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made on behalf of ineligible individuals and additional training provided to the State and/or county employees affected. Lastly, we recommend the Department evaluate current processes for identifying deceased individuals to ensure Ohio Benefits and OMES FI are updated in a timely manner. Controls should be implemented to ensure CDJFS caseworkers are following up with the Social Security Administration, Ohio Department of Health, or other death indicators in a timely manner. This should include developing a process for confirming an individual’s death if the family member, caretaker, or facility is not responding to the CDJFS caseworkers and ensuring the recipient is disenrolled from the managed care plan and converted to fee for services until date of death is confirmed. We further recommend the Department develop procedures to identify the improper payments to providers on behalf of deceased individuals and seek recovery, reimbursement, or offset future payments, when necessary. Auditor of State Conclusion: The response to this finding included within the State of Ohio Corrective Action Plan indicated the Department disagreed with a portion of the Medicaid Cluster and CHIP eligibility errors which required an Auditor of State Conclusion. For both the Medicaid and CHIP recipients, eligibility was determined based on older income and the county caseworker did not obtain current income information and/or the recipient failed to report an increase in income (e.g., new employment) in a timely manner. Additionally for the CHIP recipient, SWICA alerts were identified prior to determining eligibility and not worked properly resulting in the recipient being ineligible for the designated benefit aid category. Based on this information, the Medicaid and CHIP recipients would have been over the income limit for the benefit aid categories, and the Medicaid recipient would have been deemed ineligible to receive Medicaid benefits. Therefore, this finding will remain as stated above.

2. MEDICAID CLUSTER/CHIP – IEVS ALERTS Finding Number: 2025-014 State Agency Number: MCD-02 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2505OH5025 / 2025 (CHIP) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) 2505OH5MAP / 2025 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-015 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding number 2025-013 details deficiencies and weaknesses in internal control related to the Medicaid Cluster and CHIP programs regarding the Department’s eligibility processes. That finding is integral to and should be read in conjunction with this finding. 42 C.F.R. § 435.945 states, in part, the following regarding the Medicaid Cluster program: (a) Except where the law requires other procedures . . . the agency may accept attestation of information needed to determine the eligibility of an individual for Medicaid . . . without requiring further information (including documentation) from the individual. (b) The agency must request and use information relevant to verifying an individual's eligibility for Medicaid in accordance with § 435.948 through § 435.956 . . . 42 C.F.R. § 457.380, states, in part, the following regarding the Children’s Health Insurance Program (CHIP): (a) General requirements. Except where law requires other procedures . . . the State may accept attestation of information needed to determine the eligibility of an individual for CHIP. . . without requiring further information (including documentation) from the individual. (b) Status as a citizen, national or a non-citizen. (1) Except for newborns identified in § 435.406(a)(1)(iii)(E) of this chapter, who are exempt from any requirement to verify citizenship, the agency must— . . . (ii) Provide a reasonable opportunity period to verify such status in accordance with § 435.956(a) (5) and (b) of this chapter and provide benefits during such reasonable opportunity period to individuals determined to be otherwise eligible for CHIP. Furthermore, 42 U.S.C. § 1320b–7(a) Requirements of State eligibility systems states, in part: In order to meet the requirements of this section, a State must have in effect an income and eligibility verification system which meets the requirements of subsection (d) and under which— (1) the State shall require, as a condition of eligibility for benefits under any program listed in subsection (b), that each applicant for or recipient of benefits under that program furnish to the State his social security account number (or numbers, if he has more than one such number), and the State shall utilize such account numbers in the administration of that program so as to enable the association of the records pertaining to the applicant or recipient with his account number; (2) wage information from agencies administering State unemployment compensation laws available pursuant to section 3304(a)(16) of the Internal Revenue Code of 1986, wage information reported pursuant to paragraph (3) of this subsection, and wage, income, and other information from the Social Security Administration and the Internal Revenue Service available pursuant to section 6103(l)(7) of such Code, shall be requested and utilized to the extent that such information may be useful in verifying eligibility for, and the amount of, benefits available under any program listed in subsection (b), as determined by the Secretary of Health and Human Services . . . . (4) the State agencies administering the programs . . . adhere to standardized formats and procedures . . . under which — (A) the agencies will exchange with each other information in their possession which may be of use in establishing or verifying eligibility or benefit amounts under any other such program . . . (C) the use of such information shall be targeted to those uses which are most likely to be productive in identifying and preventing ineligibility and incorrect payments. . . . In order to comply with 42 C.F.R. § 435.945 and 42 U.S.C. § 1320b-7, the State of Ohio codified specific rules related to its Income Eligibility Verification System (IEVS) in the Ohio Administrative Code. Ohio Admin. Code 5160:1-1-04 states, in part: (A) This rule describes the requirements in section 1137 of the Social Security Act and in section 42 C.F.R. 435.945, requiring state agencies administering certain federally funded public assistance programs to establish procedures for obtaining, using and verifying information relevant to determinations of eligibility. The Ohio department of medicaid (ODM) shall obtain and share income and benefit information with the following sources: (1) The social security administration (SSA). (2) The internal revenue service (IRS). (3) The state wage information collection agency (SWICA). (4) Agencies administering the unemployment compensation (UC) benefits. . . . (C) Administrative agency responsibilities. Within forty-five days of receipt of the information, the administrative agency shall initiate, pursue, and complete the actions specified . . . (3) Review and compare against the case record all information received from the IEVS data matches to determine whether the information affects the individual's eligibility, in accordance with 42 C.F.R. 435.948. (4) Obtain additional information or documentation from the individual, if needed, to determine eligibility and initiate appropriate action in accordance with 42 C.F.R. 435.952(c). (5) . . . The administrative agency shall verify information. . . . (6) Update case information and redetermine eligibility when the verification received is discrepant from information currently listed in the electronic eligibility system. . . . As the lead agency responsible for administering the Medicaid Cluster and CHIP federal programs for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. When automated systems are utilized to perform certain functions related to this compliance requirement, management must ensure the system is properly designed and operating effectively. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. The Medicaid Cluster and CHIP federal programs are administered using a multi-agency approach: overall compliance and administration of the programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (JFS), utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. The Ohio Benefits system was utilized for processing eligibility for the Medicaid Cluster and CHIP programs’ recipients with total expenditures of approximately $28.7 billion and $916.7 million, respectively during state fiscal year (SFY) 2025. The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration, Internal Revenue Service (IRS), etc.). Information that does not agree is communicated in the form of an Ohio Benefits system alert. The Ohio Benefits system then determines if the alert is a ‘match’ that requires action. The IEVS match, indicated by ‘Yes’ in the Ohio Benefits system, is forwarded to the appropriate county agency for investigation and resolution. Each match has a defined due date, which is unique based on the priority level and other policy and process related factors. However, we noted the following weaknesses: • Volume of Alerts – During SFY 2025, more than 16.9 million alerts (3.0 million IEVS alerts and 13.9 million non-IEVS alerts) were issued for all public assistance programs that utilize Ohio Benefits, including the Medicaid Cluster and CHIP programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs, or other triggers within the system. The volume of incoming alerts/matches being sent to the county caseworkers results in an increased workload and ineffective application of the alert process. • Caseworker Reliance/Training – The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process, including reviewing IEVS matches. The Department relies heavily on JFS to coordinate with and provide statewide and individual trainings for county agencies to assist them in working IEVS alerts/matches; however, these trainings are typically optional and/or attended by a representative of the county agency who is expected to relay the information to others. Additionally, we noted the following noncompliance with federal regulations where IEVS alerts were not cleared timely. • Clearing Alerts – While the Department has controls and procedures in place to review and monitor IEVS alerts and matches generated and processed by the Ohio Benefits system, there were instances when matches were not being completed by the county agencies in accordance with the required timeframes. Furthermore, an Ohio Benefits data file containing IEVS matches showed 833,232 of the 1,721,772 (48.4%) IEVS alerts sent to the county agencies during the audit period were not cleared within 45 days as required. The matches were cleared between one and 433 days beyond the 45-day requirement, for an average of 217 days late. Failure to implement system enhancements timely, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframe increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department’s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, the high volume of alerts generated likely caused the timeliness issues. Management indicated they will continue to work with JFS and DAS to enhance the statewide eligibility system to reduce the high volume of alerts. We recommend the Department continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: • Including a more centralized evaluation of alert/match activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. • Requiring mandatory IEVS training for all county agency employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual’s eligibility determination being made. The Department should continue to provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. We also recommend the Department continue to monitor the IEVS alert processing procedures guide for the matches issued by the Ohio Benefits system to ensure matches are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the county agencies for resolved matches.

3. MEDICAID CLUSTER/CHIP – TRANSPARENCY ACT REPORTING Finding Number: 2025-015 State Agency Number: MCD-03 Assistance Listing Numbers and Titles: 93.767– Children’s Health Insurance Program (CHIP) 93.767 COVID 19 - CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2505OH5021 / 2025 (CHIP) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) 2505OH5MAP / 2025 (Medicaid Cluster Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS portal or SAM.gov) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS portal or SAM.gov website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2025, the Department obligated approximately $213.3 million for 554 subawards which exceeded $30,000 and were required to be reported on the FSRS portal or SAM.gov website in accordance with the Transparency Act for the Medicaid Cluster and CHIP programs. Assistance Listing Number Assistance Listing Title Number of Subawards Amount Obligated 93.767 CHIP 55 * $4,093,420 93.7775/93.777/93.778 Medicaid Cluster 499 ** $209,213,770 * Includes county advance subawards administered by the Ohio Department of Job and Family Services (JFS). ** Includes 482 county advance subawards administered by JFS. For the county advance subawards, JFS’ Office of Fiscal and Monitoring Services (OFMS) is responsible for compiling and providing the subaward information to the Department for the Medicaid Cluster and CHIP programs for entry on the FSRS portal or SAM.gov website. Once the Department enters the county advance subaward information for these programs, it provides JFS’ OFMS a summary of the subaward information that was entered on the FSRS portal or SAM.gov website. Additionally, for subawards administered by the Department, designated personnel are responsible for compiling and entering the subaward information for the Medicaid Cluster and CHIP programs on the FSRS portal or SAM.gov website. Although the Department had controls in place over the compilation and submission of the subawards, the following errors were noted: CHIP Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 7 0 1 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $625,072 $0 $51,000 $0 $0 Medicaid Cluster Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 44 1 11 1 1 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $38,407,442 $326,528 $6,370,016 $326,528 $326,528 By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported timely within the FSRS portal or SAM.gov website, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussion with management, this issue was caused by oversight, manual errors, and subaward data obtained in an untimely manner. We recommend the Department re-evaluate its Transparency Act reporting procedures to ensure information is entered on the SAM.gov website [as of March 8, 2025], including from its partner agencies, regarding subawards subject to the Transparency Act. We recommend the Department ensure these procedures identify the responsibilities between it and the partner agencies, promote compliance with Federal regulations, and the timely collection and submission of information for the Medicaid Cluster and CHIP programs. These procedures should be adequately documented and communicated to staff as well as the partner agencies to help ensure the subawards are properly reported in compliance with the Transparency Act for the respective programs. We also recommend timely communication with subrecipients to ensure subaward information is received and submitted by the deadline. Management should periodically review these control procedures to ensure they are operating as intended.

4. MEDICAID CLUSTER/CHIP – THIRD PARTY LIABILITY Finding Number: 2025-016 State Agency Number: MCD-04 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2505OH5025 / 2025 (CHIP) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) 2505OH5MAP / 2025 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirements: Allowable Costs / Cost Principles – Third Party Liability Repeat Finding from Prior Audit? No NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY 42 C.F.R. § 433.136, Definitions states, in part: Third Party means any individual, entity or program that is or may be liable to pay all or part of the expenditures for medical assistance furnished under a State plan. 42 C.F.R. § 433.138(b)(1), Identifying liable third parties states, in part: If the Medicaid agency determines eligibility for Medicaid, it must, during the initial application and each redetermination process, obtain from the applicant or beneficiary such health insurance information as would be useful in identifying legally liable third party resources so that the agency may process claims under the third party liability payment procedures specified in § 433.139(b) through (f). Health insurance information may include, but not limited to, the name of the policy holder, his or her relationship to the applicant or beneficiary, the social security number of the policy holder, and the name and address of insurance company and policy number. 42 C.F.R. § 433.139(b), Payment of claims states, in part: (1) If the agency has established the probable existence of third party liability at the time the claim is filed, the agency must reject the claim and return it to the provider for a determination of the amount of liability. The establishment of third party liability takes place when the agency receives confirmation from the provider or a third party resource indicating the extent of third party liability. When the amount of liability is determined, the agency must then pay the claim to the extent that payment allowed under the agency’s payment schedule exceeds the amount of the third party’s payment. (3) The agency must pay the full amount allowed under the agency's payment schedule for the claim and seek reimbursement from any liable third party to the limit of legal liability [in certain circumstances] . . . 2 C.F.R. § 200.334, Record retention requirements states, in part: The recipient . . . must retain all Federal award records for three years from the date of submission of their final financial report. . . . Records to be retained include but are not limited to financial records, supporting documentation and statistical records. . . The Department is the lead agency responsible for administering the Medicaid Cluster and CHIP federal grant programs for the State of Ohio. It is the Department’s responsibility to design and implement a system of internal controls to ensure legally liable third parties are identified, maintain verification documentation, and the claim is paid correctly. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure its third party liability process is operating effectively and as intended. During state fiscal year (SFY) 2025, the Department verified 10,600 third party insurance records within the Medicaid Information Technology System (MITS) which generated a document control number (DCN) record and stored the associated verification documentation received as a response to the verification letters sent to the third party providers within the DCN Panel. Additionally, monthly the Department reviewed a sample of verifications to ensure the third party liability insurance information was properly verified and information within MITS was accurate. As of July 7, 2025, MITS was decommissioned and the third party liability process was moved to the Ohio Medicaid Enterprise System (OMES) Fiscal Intermediary (FI) module. However, no historical evidence such as the DCN or supporting third party insurance documentation was available for review within FI. As such, the Department was unable to provide any of the third party verifications and compliance with federal requirements could not be verified during the audit period. By not maintaining historical third party insurance verifications within FI, the Department cannot be reasonably assured the third party insurance information was verified to ensure accurate payment of the fee-for-service claims and compliance with federal regulations during the audit period. Based on discussions with the Department, the issue was caused by the system change from MITS to FI, as a result, access to MITS was revoked and therefore no record of verifications could be provided for audit. We recommend the Department re-evaluate its policies and procedures over third party insurance verifications to ensure the liability insurance verification information is documented and maintained to be compliant with federal requirements and be available upon request. We recommend the Department continues to review the third party liability DCNs (or equivalent parameter within FI) monthly to ensure the information was properly verified, coverage types were properly identified, and all information in FI and other systems is correct. We further recommend the Department take necessary steps to ensure the proper conversion of all relevant data elements and related documentation is completed by ensuring historical data is maintained and available when a major system upgrade and/or replacement is performed.

5. MEDICAID CLUSTER/CHIP – SURVEILLANCE UTILIZATION REVIEWS Finding Number: 2025-017 State Agency Number: MCD-05 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2505OH5025 / 2025 (CHIP) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) 2505OH5MAP / 2025 (Medicaid Cluster Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions – Utilization Control Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-018 SIGNIFICANT DEFICIENCY The Department is the lead agency responsible for administering the Medicaid Cluster and CHIP federal grant programs for the State of Ohio. It is the Department’s responsibility to design and implement a system of internal controls to safeguard against unnecessary utilization of care and services associated with the Medicaid Cluster and CHIP programs. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure its statewide surveillance and utilization program safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, assesses the quality of those services, and provides for the control of the utilization of all services provided under the state plan. During state fiscal year (SFY) 2025, the Department disbursed approximately $28.7 billion and $916.7 million in Medicaid Cluster and CHIP benefits, respectively, to providers for the managed care program and the fee for service medical claims through the Ohio Medicaid Enterprise System (OMES) Fiscal Intermediary (FI) module. The Department’s Surveillance and Utilization Review section utilized a vendor to identify the over-utilization of inpatient and outpatient hospital Medicaid services, including the State’s psychiatric hospitals. The vendor supports the Department by reviewing medical claims to determine if they were for an allowable use according to program requirements. If the vendor identifies an improper claim (i.e., billing errors, lack of pre-admission review, lack of medical necessity, etc.), the take back claim (an adjustment request for the provider overpayment) information is recorded on an inpatient/outpatient report and provided to the Department. However, in September 2023 the Department suspended the processing of these inpatient and outpatient hospital take back claims through OMES FI which resulted in the Department postponing the recoupment of provider overpayments during the audit period. Furthermore, the Department anticipates a backlog of take back claims that will need to be reviewed and processed once the system is fixed. A lack of effective internal controls related to the over utilization of inpatient and outpatient hospital claims, increases the risk of improper and/or unnecessary medical claims going undetected. By not safeguarding against unnecessary or inappropriate use of Medicaid and CHIP services, there is an increased risk of provider payments being noncompliant with federal program requirements. Based on discussions with the Department, this issue was caused by the inability to override certain edits in OMES FI resulting in ineffective processing of take back claims. We recommend the Department develop and implement internal controls over its utilization reviews to reasonably ensure the inpatient and outpatient hospital take back claims are processed through the OMES FI module accurately and in a timely manner. The Department should take the necessary steps to correct the edits attributing to the untimely and ineffective processing of these take back claims. The Department should also develop and implement a process for reviewing the backlog of these take back claims to reasonably ensure improper payments to providers are recouped in a timely manner.

1. SUPTRS BG – CASH MANAGEMENT Finding Number: 2025-001 State Agency Number: DBH-01 Assistance Listing Number and Title: 93.959 – Block Grants for Prevention and Treatment of Substance Abuse (SUPTRS BG) Federal Award Identification Numbers / Years: B08TI087059 / 2024 (SUPTRS BG) Federal Agency: Department of Health and Human Services Compliance Requirement: Cash Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-019 NONCOMPLIANCE AND MATERIAL WEAKNESS 31 C.F.R. § 205.33(a) sets guidelines relating to timely disbursement of federal funds which states, in part: A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs… It is management’s responsibility to implement control policies and procedures to reasonably ensure draws of federal funds are for immediate cash needs, processed accurately, and disbursed timely in accordance with applicable laws and regulations. During state fiscal year 2025, the Department drew down approximately $80.8 million in federal funding for the SUPTRS BG program. Once voucher payments are approved in the Ohio Administrative Knowledge System (OAKS) and the Payment Management System (PMS), the Department draws the SUPTRS BG funds electronically from PMS to cover the amount of the vouchers, as the account is to maintain a zero cash balance. Before drawing down funds, the Senior Financial Analyst prepares a Cash Request noting the amount to be drawn and OAKS coding. The Cash Request is then forwarded to a different Senior Financial Analyst who draws the funds down in PMS and sends the support documentation back to the original analyst for creation of the revenue receipt in OAKS. The revenue receipt is then submitted to the Community Funding Operations Manager and Ohio Treasurer of State’s Office for approval. Once approved, the Department makes a payment in the form of an electronic funds transfer or check. The Department has a cash management policy in place which establishes a 20-day requirement for disbursing federal funds once deposited or as close as is administratively feasible for timely payment. However, the Department’s 20-day requirement is not a reasonable timeframe based on administrative processes and timeliness. As such, for this compliance test, eight business days were designated as close as administratively feasible. Although the Department had policies and controls in place over the deposit and disbursement of federal funds, these controls did not prevent noncompliance with the 31 C.F.R. § 205.33(a). As a result, of 16 disbursements tested from 16 SUPTRS BG draws, the Department did not disburse one payment (6.3%) within eight business days of the receipt of federal funds. The Department disbursed the funds six days after the required disbursement date. Not having effective controls over the timely disbursement of federal funds could lead to the Department not limiting draws to immediate cash needs and not expending funds timely. This could result in noncompliance with 31 C.F.R. § 205.33(a) and could subject the Department to sanctions, other penalties, or a repayment of part of the grant award amounts. In addition, noncompliance could subject the Department to paying interest charges on these draws. Based on discussions with management and review of supporting documents, this was caused by voucher processing and approval delays. We recommend the Department evaluate its existing cash management control procedures and update them as necessary to reasonably ensure all federal draw requests are disbursed timely and are drawn only for immediate cash needs, based on the funding technique established in accordance with 31 C.F.R. § 205.33(a). We also recommend the Department establish procedures to periodically monitor its compliance with the cash management requirements and initiate necessary actions to resolve any noncompliance that results. Lastly, we recommend the Department revise its cash management policy to ensure federal draws are disbursed in compliance with applicable laws and regulations. Auditor of State Conclusion: The response to this finding included within the State of Ohio Corrective Action Plan indicated the Department disagreed with the timeframe designated “as close as is administratively feasible” to disburse federal funds once drawn down and required an Auditor of State Conclusion. 31 C.F.R. § 205.33(a) requires the Department to minimize the time between the federal drawdown and disbursement of federal funds. The State of Ohio's accounting system requires funding to be available prior to initiating a disbursement and once available takes two business days to produce a payment. Given this information, the Auditor of State has designated eight business days as “as close as is administratively feasible” when testing federal compliance for cash management for federal programs not included in the Cash Management Improvement Act Agreement. Therefore, this finding remains as stated above.

SUPTRS BG – TRANSPARENCY ACT REPORTING Finding Number: 2025-002 State Agency Number: DBH-02 Assistance Listing Number and Title: 93.959 – Substance Use Prevention, Treatment, and Recovery Block Grant (SUPTRS BG) Federal Award Identification Number / Year: B08TI087059 / 2024 (SUPTRS BG) Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS portal or SAM.gov) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS portal or SAM.gov website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During the audit period, the Department obligated approximately $30.4 million for 135 SUPTRS BG first-tier subawards which exceeded $30,000 and were required to be reported on the FSRS portal or SAM.gov website in accordance with the Transparency Act for the SUPTRS BG program. Monthly, the Department’s Fiscal Office generates the Transparency Act report from the Grants Funding Management System (GFMS) and reviews it for completeness and accuracy, then approves it in the GFMS system. The Transparency Act report is then manually entered or uploaded into the FSRS portal or SAM.gov website. Although the Department had various controls in place over the Transparency Act reporting, the following errors were noted: Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 14 0 1 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $3,059,922 $0 $518,252 $0 $0 By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported timely within the FSRS portal or SAM.gov website, the risk exists that those using the Transparency Act reports could be relying on inaccurate information. Based on discussions with management, these errors were caused by management oversight and not maintaining submission records. We recommend the Department evaluate its Transparency Act reporting procedures and update them as necessary to promote compliance with the Federal regulations, which include timeliness of information submitted. In addition, the Department should maintain sufficient records of the subaward submission, including the submission date to ensure management’s objectives are achieved. Management should periodically review these control procedures to ensure they are operating as intended.