Audit 394838

(2025-010) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Active Plan: See F-11 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-0900-01)

(2025-011) Title: Internal control over SNAP eligibility determinations and benefit calculations needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.551 $47,493 Likely Questioned Costs: Undeterminable; incorrectly calculated Supplemental Nutrition Assistance Program (SNAP) benefits may result in overpayments or underpayments to clients. Due to the unique circumstances of each case, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.10; 7 CFR 273.2 and .12 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. All State agencies must sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing and transmitting information concerning SNAP. State agencies shall verify information such as residency, identity, disability, and household composition. Changes reported during the certification period are subject to the same verification procedures as applied at initial certification, except that the State agency shall not verify changes in income less than $50 or actual medical or utility expenses less than $25, unless the information is incomplete, inaccurate, inconsistent, or outdated. The State agency shall take prompt action on all changes to determine if the change affects the household’s eligibility or allotment. Condition: SNAP is administered by the Office for Family Independence (OFI) and provides monthly benefits to eligible households to purchase nutritious foods. OFI is required by Federal program regulations to utilize an automated information system for SNAP. The information system must maintain all case file information necessary to properly process eligibility determinations and benefit calculations. The Automated Client Eligibility System (ACES) is the information system used by OFI to automate SNAP operations. ACES relies on the maintenance of a complex framework of system results to make eligibility determinations and related benefit calculations. The Office of the State Auditor (OSA) tested 40 household monthly benefit payments to verify the accuracy of SNAP operations utilizing ACES, and identified: • that OFI does not require verification or investigation of information that is unclear, incomplete, inaccurate, or outdated as required by Federal requirements. A total of 32 overpayments of monthly SNAP benefits were identified, including: o 29 benefit overpayments totaling $25,800 due to manual processing errors, including: • 9 benefit overpayments totaling $5,095 to clients whose household income or expenses were not verified. • 8 benefit overpayments totaling $6,084 to clients whose household income was incorrectly calculated. • 6 benefit overpayments totaling $6,209 to clients whose information was outdated but was not further investigated for verification. 1 of the 6 clients disclosed new living arrangements; however, documentation from 2014 was not updated. • 5 benefit overpayments totaling $6,656 to clients whose household composition was not verified. • 1 benefit overpayment of $1,756 to a client whose disability status, exempting the client from work requirements, was not verified. o 3 benefit overpayments due to automated processes errors in ACES, including: • 1 benefit overpayment of $442; income information was available in ACES, however, it was not utilized when the benefit amount was calculated. • 1 benefit overpayment of $292, resulting from an incorrect benefit suspension. OSA identified a material weakness/material noncompliance with questioned costs as issued in finding 25-1108-02, Internal control over automated SNAP eligibility certification periods needs improvement, for incorrect benefit suspensions. • 1 benefit overpayment of $266; the full standard utility allowance was utilized in the calculation of the monthly benefit, however, the only reported utility was a phone. ACES applied the full standard utility allowance based on a phone expense manually entered into ACES by an eligibility specialist. • 15 of the 40 clients tested whose ACES case file information did not include proper verification of identity or residency documentation, including: o 8 clients whose case file information did not include any verification of identity documentation. o 5 clients whose identification card was expired at the time it was presented and was accepted for verification by OFI. o 2 clients whose only identification was an out-of-state license or school identification card, which is not acceptable documentation to support residency. OSA utilized a risk-based approach to select 20 cases with the highest monthly benefits and selected a non-statistical random sample for the remaining 20 cases. OSA reviewed self-employment income information reported by SNAP clients in fiscal year 2025, identified 10 clients with reported losses greater than $10,000 for further review, and found the following: • 4 benefit overpayments totaling $19,462; self-employment income was incorrectly entered into ACES and did not match underlying documentation. Of the 4 clients, 1 client’s income information was from a 2021 tax return. • 1 benefit overpayment totaling $1,231; income information was calculated utilizing tax documentation that did not include all income sources. The Department does not have adequate policies and procedures in place to ensure that ACES case file modifications, whether manual or system interfaced, that result in adjustments to previously issued monthly SNAP benefits are appropriately processed. This includes a recalculation of previously issued benefits when case file modifications are processed, the establishment of corresponding overpayments or underpayments, and related follow-up actions by OFI. Context: In fiscal year 2025, the State provided approximately 169,000 SNAP clients with $355.9 million in Federal benefits. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Benefits may be incorrectly calculated, resulting in households being underpaid or overpaid. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement additional policies and procedures to ensure that: • case information entered into ACES is accurate; • automated eligibility determinations and benefit calculations are processed in accordance with Federal regulations; • information that is unclear, incomplete, inaccurate, or outdated is investigated and verified with supporting documentation as required; and • recalculations of previously issued benefits and related follow-up actions occur when case file modifications are retroactive. Corrective Action Plan: See F-11 Management’s Response: The Department partially agrees with the finding. There are many instances of exceptions cited by the Office of State Auditor (OSA) in which there isn’t a specific requirement that exists or the requirement has been waived in unusual cases such as the 2 clients who could not provide proof of residency. The residency requirements state that they shall be verified “except in unusual cases like households newly arrived in a project area.” There is merit in each of the larger categories identified by OSA however, the extent of the issues is far less than those cited and many of the verification standards applied by OSA far exceed the requirements of Food and Nutrition Services (FNS). The Department agrees with the exception based on an expired certification period. Contact: Ian Yaffe, Director, OFI, DHHS, 207-592-1481 Auditor’s Concluding Remarks: The Department must comply with the following Federal requirements: • At initial certification and recertification, the State agency shall verify information that is incomplete, inaccurate, inconsistent, or outdated (7 CFR 273.2(e)(1), and 273.2(f)(8)(i)(A) and (D)), including: o residency (7 CFR 273.2(f)(1)(vi)); o identity (7 CFR 273.2(f)(1)(vii)); o disability (7 CFR 273.2(f)(1)(viii)); and o household composition (7 CFR 273.2(f)(1)(x)). • When a household reports a change in residence, the State agency must investigate and take action on potential changes in shelter costs arising from this reported change (7 CFR 273.12(c)(4)(i)). For the cases cited in the Condition, OFI could not provide documentation to support that information used to determine eligibility and benefits was verified or investigated. Therefore, OFI is not in compliance with Federal regulations. The finding remains as stated. (State Number: 25-1108-05)

(2025-012) Title: Internal control over automated SNAP eligibility certification periods needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.551 $7,658 Likely Questioned Costs: Undeterminable; incorrectly suspending Supplemental Nutrition Assistance Program (SNAP) benefits may result in overpayments and underpayments to households. Since there are known overpayments and underpayments in our sample, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.10; 7 CFR 273.10 and .12 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. All State agencies must sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing and transmitting information concerning SNAP, which includes automatic cutoff of participation for households which have not been recertified at the end of their certification period. SNAP households must be assigned eligibility certification periods of at least 6 months, unless the household is classified as exempt based on program regulations. The State agency must have at least 1 contact with each SNAP household every 12 months. Submission of periodic eligibility reports is required by non-exempt households. Non-exempt households that are certified for longer than 6 months must file a periodic report between 4 months and 6 months, as required by the State agency. In addition, the State agency must not require the submission of periodic reports by households certified for 12 months or less in which all adult members are elderly or have a disability and no earned income. Condition: SNAP is administered by the Office for Family Independence (OFI) and provides monthly benefits to eligible households to purchase nutritious foods. OFI is required by Federal program regulations to utilize an automated information system for SNAP. The information system must maintain all case file information necessary to properly process eligibility determinations and benefit computations. The Automated Client Eligibility System (ACES) is the information system used by OFI to automate SNAP operations. ACES relies on the maintenance of a complex framework of system rules to make eligibility determinations, including notification letters to clients when 6-month reports and 12-month redeterminations of eligibility are required. All SNAP households, except for elderly and disabled cases with no earned income, are required to submit 6-month reports. In addition, all SNAP households must undergo an annual redetermination of eligibility. Each household’s recertification requirements are indicated by date fields in the ACES case file. If a required report or redetermination is not completed by the date indicated in the applicable field, the case’s monthly SNAP benefit is automatically suspended by the system. The Office of the State Auditor (OSA) tested a sample of 40 cases automatically suspended for failure to complete a required review in fiscal year 2025 to verify the accuracy of automated SNAP operations utilizing ACES. In 11 of the 40 cases tested, OSA identified that ACES incorrectly suspended benefits, as follows: • 8 cases were overpaid SNAP benefits totaling $7,543 because benefit suspensions occurred 1 to 4 months after the 6-month reporting requirement. • 2 cases were underpaid SNAP benefits totaling $873 because benefit suspensions occurred 1 to 2 months prior to the annual redetermination requirement. • 1 case was overpaid SNAP benefits totaling $115 because benefit suspension occurred 5 months after the annual redetermination requirement. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the State provided approximately 169,000 SNAP clients with $355.9 million in Federal benefits. 279 clients were automatically suspended by ACES during fiscal year 2025 due to recertification or redetermination requirements. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight • Automated SNAP eligibility system recertification and suspension criteria were not configured in accordance with Federal regulations. Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations • Benefits may be incorrectly suspended, resulting in households being underpaid or overpaid. Recommendation: We recommend that the Department enhance policies and procedures to ensure that automated SNAP eligibility certification periods and related ACES case file fields are properly configured to process benefits in accordance with Federal regulations. In addition, we recommend that the Department identify underpayments and/or overpayments resulting from recertification period errors and take action as warranted. Corrective Action Plan: See F-11 Management’s Response: The Department agrees with this finding. OFI has had a number of technological challenges with the automatic setting of renewal and six-month report dates related to the suspension of Medicaid renewals during the pandemic, the extension of certification periods during the unwinding period, and the application of the new passive Medicaid renewal technology. Contact: Michael E. Downs, Public Service Coordinator II – SNAP, OFI, DHHS, 207-592-4850 (State Number: 25-1108-02)

(2025-013) Title: Internal control over EBT card security needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Assistance Listing Title: SNAP Cluster Summer Electronic Benefits Transfer Program for Children Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 10.551, 10.561; 10.646; 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 274.5; 7 CFR 292.16(h)(3); National Institute of Standards and Technology (NIST) Special Publication 800 Series The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The State is required to provide the following minimum security and control procedures for electronic benefits transfer (EBT) cards: secure storage; access limited to authorized personnel; inventory control records; and a periodic review and validation of inventory controls and records by parties not otherwise involved in maintaining control records. Issuance, inventory, reconciliation, and other accountability records must be maintained for a period of 3 years. NIST Special Publication 800 Series states that organizations: • consider the inherited risk from the use of common controls. If common controls are provided to organizations by external entities, arrangements must be made with the external/shared service providers to obtain information on the effectiveness of the deployed controls. • are responsible and accountable for information security risk incurred through the use of system services provided by external vendors. The responsibility for mitigating risks arising from the use of external information system services remains with authorizing officials. Condition: The Temporary Assistance for Needy Families (TANF) program provides cash assistance to families while they work towards becoming self-sufficient. The Supplemental Nutrition Assistance Program (SNAP) and Summer Electronic Benefits Transfer Program for Children (Summer EBT) provide benefits to eligible households to purchase nutritious foods. The programs distribute benefits through EBT cards utilizing the Electronic Payment Processing and Information Control (EPPIC) system. Review of vendor, subservice provider, and subcontractor controls The Office for Family Independence (OFI) contracts with a vendor that engages a subservice provider and a subcontractor to support EBT card services. The contract with the vendor requires annual System and Organization Controls (SOC) 1 type 2 and SOC 2 type 2 assurance testing and reporting of results of the vendor and its subservice providers. Also, since the vendor relies on a subcontractor for printing and distributing the EBT cards, OFI relies on SOC-type testing results of the subcontractor’s controls for assurance over the security of the EBT cards. The Department’s policy is to perform an annual review and document a plan to remediate deviations identified in these reports. SOC-type testing results can measure the degree to which the Department is able to rely on the suitability of the design and operating effectiveness of specific controls provided by the vendor, subservice provider, and subcontractor. OFI did not receive the required 2025 SOC 1 type 2 or SOC 2 type 2 reports from the vendor, subservice provider, or subcontractor, as follows: • Vendor – The Department did not receive SOC 1 type 2 or SOC 2 type 2 reports for the period of October 1, 2024, through June 30, 2025. • Subservice provider – The Department did not receive SOC 1 type 2 or SOC 2 type 2 reports for fiscal year 2025. • Subcontractor – The Department did not receive SOC 1 type 2 or SOC 2 type 2 reports for the period of October 1, 2024, through June 30, 2025. Additionally, documentation could not be provided to support that OFI followed up on the deviations identified in the 2024 SOC report. As a result, OFI did not have assurance over the suitability of the design and operating effectiveness over EBT card security controls with the vendor, subservice provider, or subcontractor. Department controls EBT cards are processed and distributed through the EPPIC system and then mailed to the client. EBT cards that are undeliverable are returned to the regional Department of Health and Human Services (DHHS) office, where they are then sent to the central DHHS office for processing. Upon receipt of a returned EBT card, OFI staff use the Automated Client Eligibility System (ACES) to verify a client’s personal information, determine what action to take based on case file information, and to document the action through electronic case notes. The Department has assigned responsibility for processing returned EBT cards to 3 employees. This process includes receipt of returned cards, maintenance of inventory control records including supporting documentation in ACES and EPPIC, and destruction or retransmission of the card. The Office of the State Auditor (OSA) identified that once delivered to the central office, the returned cards are placed in an open mailbox. While the mailbox is in a secure area of the facility, any employee working within this area has access to this mailbox. Furthermore, while the returned cards are being processed, they are placed in a locked closet that was previously used for storage. OSA identified that the personal identification number lock was never changed after the closet was repurposed for EBT returned card storage. Therefore, access to the returned card mailbox and storage area is not limited to the 3 employees assigned responsibility for processing returned EBT cards. In addition, the State is required to maintain accurate and complete inventory records for returned EBT cards. Returned cards must be destroyed or retransmitted, and OFI documents actions taken on tracking spreadsheets and in ACES and the EPPIC system. Quarterly, management monitors the inventory tracking spreadsheets by selecting a sample of returned EBT cards for review; however, this oversight procedure does not include a reconciliation between the number of cards returned and the number of cards entered on the tracking spreadsheets. To further evaluate this oversight procedure, OSA obtained documentation of the total number of EBT cards returned in June 2025 and compared it to the number of cards entered on the tracking spreadsheets and found that only 113 of the 1,184 returned cards had been entered on the tracking spreadsheets. OSA also identified instances where information recorded on the tracking spreadsheets was incorrect or incomplete, including invalid client identification numbers, client names that did not match the correct client identification numbers, and the name of the person who processed the returned card was not entered as required. A total of 2,383 returned SNAP and Summer EBT cards were recorded on the fiscal year 2025 inventory tracking spreadsheets. OSA tested a sample of 60 returned SNAP cards and 7 returned Summer EBT cards to verify the accuracy and completeness of the activity recorded, and identified: • 10 returned SNAP EBT cards and 1 returned Summer EBT card were recorded on the tracking spreadsheet as retransmitted to an updated address, but no documentation was maintained in ACES to support that a new address was obtained. o 1 of the 10 EBT cards returned had online purchase activity during the period that the card was in the mail, and there was no documentation in ACES to support that the Department investigated the purchase activity. • 3 returned SNAP EBT cards where processing activity was not documented in a case note. • 2 returned SNAP EBT cards were retransmitted to another DHHS office for pickup, but no documentation was maintained in ACES to support the reason. • 1 returned Summer EBT card was retransmitted to an out-of-state address, but no documentation was maintained in ACES to support that client contact was made, or that the case was referred to an eligibility specialist in accordance with DHHS’ returned mail procedures. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the State provided approximately 169,000 SNAP clients and 100,000 Summer EBT clients with $355.9 million and $14.5 million in Federal benefits, respectively. According to the inventory tracking spreadsheets, the Department processed 2,383 returned SNAP and Summer EBT cards; 802 were recorded as retransmitted and 1,581 were recorded as destroyed. The total number of EBT cards returned in the mail is unknown. Cause: • The Department did not enforce contractual obligations with the vendor as they anticipate utilizing a new EBT card vendor in fiscal year 2026. • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Potential unauthorized use of EBT cards, which may lead to unallowable costs • Potential breach of confidential or sensitive information • Potential corrupted, lost, or inaccurate information • Potential downtime and/or extended shutdowns Recommendation: We recommend that the Department enhance and subsequently monitor policies and procedures to: • ensure the contractually required SOC-type assurance testing and reported results is obtained and reviewed timely, and document and implement effective corrective action plans, if necessary. This will provide assurance that any deviations identified in the annual SOC reports are being tracked and remediated in a timely manner. • require adequate security and oversight of returned EBT cards, including maintenance of accurate and complete inventory control records and increased physical security controls. Corrective Action Plan: See F-12 Management’s Response: The Department agrees with this finding. There were separate processes mentioned in the finding. Therefore, there will be two separate Corrective Action Plans (CAP), which will be tracked independently. The first CAP is to correct deficiencies associated to SOC reporting. The second CAP is to strengthen our internal processes regarding returned EBT cards. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1108-01)

(2025-014) Title: Internal control over EBT reconciliation needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 274.4; National Institute of Standards and Technology (NIST) Special Publication 800 Series The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. State agencies shall account for the full cycle of electronic benefit transfer (EBT) issuance through a reconciliation process. The EBT system shall provide reports and documentation pertaining to, but not limited to: • reconciliation of individual household account balances against account activities on a daily basis; • reconciliation of each individual retail store’s Supplemental Nutrition Assistance Program (SNAP) transactions per point of sale (POS) terminal and in total to deposits on a daily basis; • verification of retailer’s credits against deposit information entered into the automated clearinghouse (ACH) network; and • maintenance of audit trails that document the full cycle of issuance from benefit allotment posting to the State issuance authorization file through posting to POS transactions at retailers through settlement of retailer credits. NIST Special Publication 800 Series states that organizations: • consider the inherited risk from the use of common controls. If common controls are provided to organizations by external entities, arrangements must be made with the external/shared service providers to obtain information on the effectiveness of the deployed controls. • are responsible and accountable for information security risk incurred through the use of system services provided by external vendors. The responsibility for mitigating risks arising from the use of external information system services remains with authorizing officials. Condition: SNAP provides monthly benefits to eligible households to purchase nutritious foods by distributing benefits through EBT cards utilizing the Electronic Payment Processing and Information Control (EPPIC) system. The Department must account for all issuances through a reconciliation process. The Office for Family Independence (OFI) contracts with the EBT card vendor to perform the following: • Reconciliation of individual household account balances against account activities on a daily basis • Reconciliation of each individual retail store’s SNAP transactions per POS terminal and in total to deposits on a daily basis • Verification of retailer’s credits against deposit information entered into the ACH network • Maintenance of audit trails that document the full cycle of issuance from benefit allotment posting to the State issuance authorization file through posting to POS transactions at retailers through settlement of retailer credits EBT card vendor reconciliations and maintenance of audit trails are reviewed by OFI through annual System and Organization Controls (SOC)-type assurance testing and reporting of results. However, the Office of the State Auditor identified a material weakness/material noncompliance as issued in finding 2025-013 for OFI’s lack of receipt and review of the required SOC 2 type 2 report from the vendor for the period of October 1, 2024, through June 30, 2025. OFI did not perform alternative procedures to ensure these reconciliations were performed by the vendor. As a result, OFI did not have assurance over the suitability of the design and operating effectiveness over EBT reconciliation controls with the vendor for the last nine months of fiscal year 2025. Context: In fiscal year 2025, the State provided approximately 169,000 SNAP clients with $355.9 million in Federal benefits. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight • The Department did not enforce contractual obligations with the vendor as they anticipate utilizing a new EBT card vendor in fiscal year 2026. Effect: • Noncompliance with Federal regulations • Potential inaccurate reconciliations performed by the EBT card vendor Recommendation: We recommend that the Department enhance and subsequently monitor policies and procedures to ensure adequate oversight of vendor-provided EBT reconciliations. Corrective Action Plan: See F-12 Management’s Response: The Department agrees with this finding. The Office for Family Independence has developed and will implement a corrective action plan to address the issue identified. Contact: Ian Yaffe, Director, OFI, DHHS, 207-592-1481 (State Number: 25-1108-07)

(2025-016) Title: Internal control over SNAP procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 7 CFR 277.14; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. 7 CFR 277.14 requires the Department to submit proposed contracts and related procurement documents to the U.S. Department of Agriculture’s Food and Nutrition Service (FNS) for preaward review and approval when the procurement is expected to exceed $10,000 and is to be awarded without competition, or only one bid or offer is received in response to solicitation. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. Condition: The Supplemental Nutrition Assistance Program (SNAP) provides monthly benefits to eligible households to purchase nutritious foods, along with funds for administration, nutrition education, and obesity prevention. SNAP is administered by the Office for Family Independence (OFI). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJF) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSA tested 2 noncompetitive contracts that accounted for approximately $4.4 million of the $5.8 million in SNAP procurement-related transactions in fiscal year 2025 and found: • OFI could not provide documentation that FNS approved applicable procurement documents prior to contract award as required by 7 CFR 277.14. • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OFI were accurate. • For 1 contract, DCM provided the PJF to OSPS for their review and OSPS approved the PJF after the contract had commenced, 42 days and 66 days, respectively, after the contract start date. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department expended $5.8 million in procurement-related transactions from SNAP administration funds of $19.5 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OFI develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • Federal pre-procurement approvals are obtained before contracts are awarded, if required; • DCM obtaining and reviewing documentation to support the assertions made by OFI for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-13 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1108-06)

(2025-015) Title: Internal control over SNAP deceased client cases needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.8 and .14 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. State agency action on information items about recipient households shall include review of information and comparison of it to case record information. State agencies must initiate and pursue actions on recipient households within 45 days of the receipt of the information items. States shall establish a system to verify and ensure that benefits are not issued to individuals who are deceased. Condition: The Office for Family Independence (OFI) manages the Automated Client Eligibility System (ACES) used to determine eligibility for Federal assistance programs, including the Supplemental Nutrition Assistance Program (SNAP). Information maintained in ACES is relied upon by OFI for determining monthly SNAP benefits issued to client Electronic Benefit Transaction (EBT) cards. OFI relies on numerous data sources for identifying and providing client date of death (DOD) information for input into ACES, including monthly data exchanges with the Maine Center for Disease Control & Prevention’s (MeCDC) Vital Records, which includes Social Security Administration data. Federal program regulations require OFI to act on client cases within 45 days of receipt of DOD information. This includes review and comparison of DOD information to ACES case file information, and suspension of program participation and related benefits as warranted. OFI policies for SNAP require deactivation of the client’s EBT card as well as expungement of authorized benefits from the EBT card. If activity occurs on the client’s EBT card subsequent to the DOD, the case must be reported as potential fraud and referred for investigation. The Office of the State Auditor (OSA) obtained DOD information from MeCDC Vital Records and compared it to clients who received SNAP benefits during fiscal year 2025. OSA identified 29 cases where SNAP benefits were issued more than 75 days following the client’s DOD; this benchmark was applied to denote the 45-day Federal program regulation related to monthly receipt of DOD information. OSA tested all 29 cases and identified the following: • Single-member household clients should not have EBT card purchase activity after DOD; however, 7 single-member household clients had $4,335 in total EBT card purchase activity after DOD that occurred in fiscal year 2025: o 6 clients were identified as potential fraud in the ACES case file between 3 and 6 months after the DOD information was received by MeCDC Vital Records. o 1 client’s DOD was not properly recorded in ACES until 11 months after the DOD information was received by MeCDC Vital Records. OFI recorded an incorrect DOD in ACES and did not identify EBT purchase activity after the DOD as potential fraud until OSA notified OFI. • 1 client’s DOD was not recorded in ACES until the client’s family informed OFI of the client’s death 268 days after the DOD information was received by MeCDC Vital Records. As a result, SNAP benefits were calculated based on incorrect income and household composition information, resulting in an overpayment of $2,359. • 14 single-member household clients had benefits loaded to their cards more than 75 days after DOD information was received by MeCDC Vital Records. Of those 14 clients: o 11 clients’ cases remained open 77 to 305 days after DOD information was received by MeCDC Vital Records, resulting in 2 to 11 months of unauthorized SNAP benefit issuances. Of these 11 clients, 5 clients’ benefits were not expunged upon receipt of DOD information as required by OFI policies; benefits remained open and available for spending up to 274 days after the last issuance when they were expunged by the system-automated process based on inactivity. o 2 clients were not identified as deceased by OFI until OSA notified OFI. As of June 30, 2025, MeCDC Vital Records received DOD information 644 days and 587 days prior, respectively; benefits were expunged by the system-automated process based on inactivity after 274 days. o 1 client was not identified as deceased by OFI until July 2025. As of June 30, 2025, DOD information was on file for 196 days. Context: In fiscal year 2025, the State provided approximately 169,000 SNAP clients with $355.9 million in Federal benefits. Of the 169,000 SNAP clients, 1,970 had a DOD in fiscal year 2025. Cause: • Monthly data exchanges with MeCDC Vital Records did not alert OFI of DOD information in 27 of the 29 cases tested. • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Benefits issued to deceased clients may result in unauthorized EBT card purchase activity. • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures to ensure that DOD information is received, reviewed, and updated in ACES on a more frequent basis to prevent unauthorized SNAP benefit issuances and EBT card purchase activity. In addition, we recommend that the Department review all client cases noted in the Condition of this finding to ensure that: • ACES case file DOD information is accurate, including verifying that all DOD information is received timely from MeCDC Vital Records; • SNAP benefits are expunged and EBT cards are deactivated in accordance with existing policies; • cases are identified as potential fraud and referred for investigation as warranted; and • unallowable costs are identified and reported to Federal oversight agencies and required recoupment activities are pursued. Corrective Action Plan: See F-12 Management’s Response: The Department agrees with this finding. The data matching failed because there were inconsistencies in the data between the two systems, specifically in the spelling of names. The Department acted timely on all deaths that were reported correctly. Contact: Michael E. Downs, Public Service Coordinator II – SNAP, DHHS, 207-592-4850 (State Number: 25-1108-03)

(2025-017) Title: Internal control over SNAP subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information. • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. Condition: The Supplemental Nutrition Assistance Program (SNAP) is administered by the Office for Family Independence (OFI). In addition to providing monthly benefits to eligible households to purchase nutritious foods, SNAP has administrative funding that may be used to educate the public on nutrition and to assist SNAP clients in gaining the skills, training, and work experience needed to build a career and achieve long-term stability. The Office of the State Auditor (OSA) tested all 7 contracts with 4 SNAP subrecipients for compliance with: • award identification requirements, and found: o 6 contracts did not include Federal award identification numbers; and o 1 contract did not include the Assistance Listing title and number. • subrecipient risk evaluation procedures. OFI provided evidence to support that subrecipient monitoring procedures were performed; however, documentation that risk evaluation procedures performed corresponded to the appropriate level of monitoring activities could not be provided. Context: In fiscal year 2025, OFI provided $5.1 million from a total of $19.7 million in SNAP administrative funds to SNAP subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures to: • ensure that all required information is included in contracts and contract amendments. This will ensure compliance with Federal requirements. • require evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-13 Management’s Response: The Department partially agrees with the finding. We acknowledge six of the contracts did not include the Federal award identification number, and that one contract did not include the assistance listing title and number. The Department disagrees that we do not have adequate subrecipient risk evaluation procedures. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: Patricia Dushuttle, Special Projects Manager- SNAP, DHHS, 207-215-0995 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, 6 of the 7 subawards tested were not competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit (DOA) performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that subrecipient monitoring procedures are performed by program personnel as a result of a risk evaluation conducted by DOA. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 25-1108-04)

(2025-018) Title: Internal control over CNC eligibility needs improvement Prior Year Findings: See Schedule of findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.555 $73,683 ALN 10.559 $226,773 Likely Questioned Costs: Undeterminable; erroneous eligibility determinations do not always result in overpayments of Federal program funds; therefore, an error rate cannot be applied to the population and a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 7 CFR 210.7 and .9; 7 CFR 225.6, .14, and .16; 7 CFR 245.12 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. 7 CFR 210 outlines the application requirements for participation in the National School Lunch Program (NSLP) and specifies that applications shall provide the State agency with sufficient information to determine eligibility. 7 CFR 225 requirements for the Summer Food Service Program (SFSP) include: • the type of information that must be required in sponsor applications for participation; • sites that serve an area in which poor economic conditions exist or are approved for reimbursement only for free meals served to enrolled children who meet the program’s income standards; • the proposed site is not or will not be served in whole or in part by another site; • State agency requirements related to the approval of applications and determinations of eligibility; • the process and requirements for claims for reimbursement (CFRs); and • performance standards for financial viability, administrative capability, and program accountability. 7 CFR 245 describes the action taken by State agencies related to the eligibility determination of individuals and special eligibility determinations of schools including Provision II and Community Eligible Provision schools. These regulations outline how the School Food Authority (SFA) and State agency should collect and report eligibility information in the schools, and how that information should be used in establishing rates and percentages in CFRs. Condition: The Child Nutrition Cluster (CNC) includes the School Breakfast Program, NSLP, Special Milk Program for Children, SFSP, and the Fresh Fruit and Vegetable Program. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of CNC programs for the State. DOE provides benefits to each SFA or sponsor on a reimbursement basis. SFAs and sponsors must submit electronic applications for participation in CNC programs and DOE is required to review every application and site information sheet to ensure that only eligible SFAs or sponsors participate in the programs. The Office of the State Auditor (OSA) tested 47 SFA and sponsor applications and found instances that did not align with program regulations, as follows: • 9 applications were approved with sites that did not meet the eligibility criteria, as follows: o 5 sponsors with sites classified as camps and also designated as open sites. This allowed the camp to use area eligibility determination, rather than individual child eligibility as required for camps, resulting in questioned costs totaling $180,788. o 1 sponsor of a camp used projected enrollment numbers on their application and did not provide the actual number of eligible children for each session at the site prior to submitting claims, resulting in questioned costs totaling $26,381. o 1 sponsor was erroneously approved as a non-congregate site without required supporting documentation. In addition, incorrect census data was used to demonstrate eligibility, resulting in questioned costs totaling $73,683. o 1 sponsor site was erroneously classified as a school; however, supporting documentation within the application indicated that the correct site classification was a non-residential day camp. o 1 sponsor without a designated site classification used special eligibility certification rather than area eligibility determination; OSA determined that the site was eligible based on other information in the application. • 1 application’s financial viability calculation did not meet program requirements, as reported expenses exceeded reported revenue and budget revisions were not made prior to approval of the program by DOE, resulting in questioned costs totaling $1,350. • 1 application was missing a required policy statement, resulting in questioned costs totaling $18,254. OSA selected a non-statistical random sample. Context: In fiscal year 2025, CNC program expenditures totaled $71.3 million, including $58.5 million for NLSP and $2.8 million for SFSP in SFA and sponsor reimbursements. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • CNC program participation by ineligible SFAs or sponsors • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that: • all required documentation for applications is complete and in compliance with program requirements prior to participation in CNC programs; • eligibility determinations and resulting site classifications are properly supported; and • appropriate eligibility information is collected and reviewed prior to SFA and sponsor claim payments. Corrective Action Plan: See F-14 Management’s Response: The Department partially agrees with this finding. The exceptions referenced in this finding are from the program FY23 audit. All identified exceptions have been addressed in the 2025 program year and the upcoming 2026 program year. The SUN Meals (SFSP) application packet is updated continually to reflect evolving federal program requirements. In recent years, significant federal changes have required substantial updates to application processes, data collection, and training for program operators. Requests for system updates are submitted to the Child Nutrition software developer to ensure continued alignment with federal guidelines. Child Nutrition with the supporting documents provided by the Northeast Regional Office of the USDA, disagrees with the exception addressing the “camp” definition in this finding. The application review process is administered by 1.5 FTE State Agency staff, who review over 1,000 documents within a 6–8 week timeframe, while also providing training and technical assistance to sponsors. Despite these constraints and ongoing federal program changes, staff manage the application process with only limited and isolated incidents. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: Management’s Response stating “the exceptions referenced in this finding are from the program FY23 audit” is incorrect. All exceptions identified relate to SFA and sponsor applications active during fiscal year 2025. OSA is not defining site classification nor taking exception to DOE’s “camp” definition. The exceptions identified are approved camp site sponsors that do not conform to the required eligibility criteria for camps. The exceptions noted were not limited or isolated, as 11 out of 47 SFA and sponsor applications tested did not align with Federal program requirements for eligibility. This results in an error rate of 23.4 percent. The finding remains as stated. (State Number: 25-1203-01)

(2025-019) Title: Internal control over CNC claim reimbursements needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Reporting Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.559 $61,336 ALN 10.582 $12,215 Likely Questioned Costs: Undeterminable; due to the variety of exceptions in the test population, an error rate cannot be applied to the population, and a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 210.7 and .8; 7 CFR 225.6, .9, and .16; Richard B. Russell National School Lunch Act (NSLA), Section 19 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. 7 CFR 210.7 and .8 for the National School Lunch Program (NSLP) require: • claims for reimbursement (CFRs) to be based on lunch counts taken daily at the point of service, which correctly identify the number of free, reduced price, and paid lunches served to eligible children. • the Department to compare, on a monthly basis, the number of free and reduced price lunches claimed to the number of children approved for free and reduced price lunches enrolled in the School Food Authority (SFA) for the month of October and multiply that number by the days of operation and the attendance factor employed by the SFA. At its discretion, the Department may conduct this comparison against data which reflects the number of children approved for free and reduced price lunches for a more current month(s). 7 CFR 225 for the Summer Food Service Program (SFSP) requires: • information that must be on a site information sheet provided by the sponsor for approval by the Department prior to participation in SFSP, including estimated meal counts, types of meals, meal service times, and procedures to ensure duplicate meals are not distributed at non-congregate sites. In order to approve a site, the area where the site proposes to serve is not or will not be served in whole or in part by another site. • payments to a sponsor must equal the amount derived by multiplying the number of eligible meals, by type, actually served under the sponsor’s program to eligible children by the current applicable reimbursement rate for each meal type. Sponsors must be eligible to receive additional reimbursement for each meal served to participating children at rural or self-preparation sites. Section 19 of the Richard B. Russell NSLA states that the per-pupil grant provided to a school under the Fresh Fruit and Vegetable Program (FFVP) shall be not less than $50, nor more than $75. Condition: The Child Nutrition Cluster (CNC) includes the School Breakfast Program, NSLP, Special Milk Program for Children, SFSP, and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of CNC programs for the State. DOE provides benefits to each SFA or sponsor on a reimbursement basis. SFAs and sponsors must submit CFRs based on actual meals served for the month utilizing the Child Nutrition Program (CNPWeb) system. Claims pass through a system of edit checks built into the CNPWeb system, are automatically approved after those edit checks, and are processed based on rates programmed in the system. DOE does not verify the allowability or accuracy of monthly CFRs prior to payment, and edit checks built into the CNPWeb system are not routinely monitored. There are no monthly procedures in place that operate as controls over the allowability of claims. As a result, DOE has no assurance that SFA and sponsor monthly claim submissions are accurate or complete, or that the resulting CFR is allowable prior to payment. For SFSP, DOE requires applications from sponsors that include individual site sheets. The information on the sheet must include the estimated number of meals, types of meals to be served, and meal service times. Non-congregate sites must provide enough detail to ensure the area where the site proposes to serve meets certain criteria, including verification that the site is rural; is not or will not be served in whole or in part by another site; serves an area in which poor economic conditions exist or is approved for reimbursement only for free meals served to enrolled children who meet income standards; and has procedures to ensure that duplicate meals are not served to any child. Residential and non-residential camps must include in their site sheets the number of children enrolled in each session who meet income standards prior to filing the camp’s CFR for each session. The Office of the State Auditor (OSA) tested 44 SFSP CFRs and found: • 4 residential or non-residential camp CFRs that did not include the number of children enrolled in each session who met income standards prior to filing their CFR, resulting in questioned costs totaling $31,647. Additionally, of these 4 CFRs: o 2 were missing non-congregate site plan attestations; and o 1 did not include a site classification type on its site sheet, which determines the appropriate reimbursement rate. • 1 CFR to a non-congregate site that did not have documented procedures to prevent duplicate meal service on the site sheet and had census data contained within the non-congregate plan that did not match U.S. Census Bureau data, resulting in questioned costs totaling $29,689. OSA selected a non-statistical random sample. Furthermore, for each month of operation, DOE must report the number of meals served by meal type and sponsor type to the United States Department of Agriculture’s Food Nutrition Services (FNS) on the FNS-418 report. DOE does not have assurance that the CNPWeb system’s default classification of urban sites as self-prep when the field is left blank results in accurate FNS-418 reporting. DOE initiated a request to the CNPWeb system vendor to correct this system error in April 2025; however, the issue persisted for the entirety of fiscal year 2025. For FFVP, allocations made by DOE must result in a per-pupil grant not less than $50 nor more than $75 to participating SFAs and sponsors. OSA tested 18 SFAs and sponsors that participated in FFVP in fiscal year 2025 and found that 11 SFAs and sponsors had per-pupil allocations that were not between $50 and $75 per pupil, ranging from $15 per pupil to $104 per pupil. The allocation of funds over $75 per pupil resulted in questioned costs of $12,215. OSA selected a non-statistical random sample. Context: In fiscal year 2025, DOE processed SFA and sponsor CFRs totaling: • $58.5 million under NSLP; • $2.8 million under SFSP; and • $2.7 million under FFVP. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Known questioned costs • Potential future questioned costs and disallowances • Potential incorrect rates of reimbursement paid to SFAs and sponsors • Inaccurate FNS-418 reports submitted to FNS Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to: • review CFRs on a monthly basis to provide assurance that SFA and sponsor payments are accurate and complete; • ensure all required information is included in SFA and sponsor applications and CFR submissions prior to payment, including site classification types and non-congregate plan information on site information sheets; and • ensure FFVP per pupil allocation amounts comply with Federal regulations. Corrective Action Plan: See F-14 Management’s Response: The Department agrees with this finding. The exceptions referenced in this finding are from the program FY23 audit. All identified exceptions have been addressed in the 2025 program year and the upcoming 2026 program year with the strengthening of program software and provided training to the program sponsors. During program years 2020–2023, the Summer Food Service Program (SFSP) operated under emergency authorities in response to COVID-19, during which the USDA implemented numerous program flexibilities and temporarily waived certain regulatory requirements. In subsequent years, many of these flexibilities continued but were reintroduced with additional regulatory requirements, expanded data collection, and ongoing updates to program guidance. As a result, program regulations and administrative requirements have evolved rapidly, with federal guidance frequently being released throughout the program year. The Child Nutrition team has worked to remain current with these evolving requirements and implement updates as changes occur. In some instances, updated regulations or federal guidance are issued after the program year has begun, which can result in necessary system changes or corrections to the Child Nutrition software system being implemented after the operating period has already started. At the request of School Administrative Units, Child Nutrition re-allocated funds for the FFVP from schools with unexpended balances, to schools requesting additional funds. A procedure has been implemented for SFY 2026 to ensure school allocations remain within the $50-75/student allocation range. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: Management’s Response stating “the exceptions referenced in this finding are from the program FY23 audit” is incorrect. All exceptions identified relate to payments made to SFAs and sponsors and Federal reporting submissions during fiscal year 2025. The finding remains as stated. (State Number: 25-1203-02)

(2025-020) Title: Internal control over CNC subrecipient monitoring procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 7 CFR 210.18; 7 CFR 225.7; U.S. Department of Agriculture Policy Memo SP 46-2015 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. The Department must conduct administrative reviews of School Food Authorities (SFAs) participating in the National School Lunch Program (NSLP) and the School Breakfast Program (SBP). These procedures must also be followed, as applicable, to conduct administrative reviews of the Special Milk Program (SMP) and the Fresh Fruit and Vegetable Program (FFVP). Documented corrective action is required for any degree of violation of general or critical areas identified in an administrative review. Corrective action may be provided at the time of the review; however, it must be postmarked or submitted electronically to the State agency no later than 30 days from the deadline for completion of each required corrective action. The State agency must maintain any documented corrective action on file for review by the Food and Nutrition Service (FNS). The Department must withhold all program payments to an SFA if: • documented corrective action for critical area violations is not provided with deadlines specified; or • corrective action for critical area violations was not completed. FNS may suspend or withhold program payments, in whole or in part, to those states failing to withhold payments in accordance with regulations and may withhold administrative funds. The Department must review sponsors to ensure compliance with Summer Food Service Program (SFSP) regulations. The Department is required to conduct a review of base year certification and benefit issuance documentation for any SFA requesting approval to participate in NSLP or SBP using U.S. Department of Agriculture (USDA) Special Provision 2, which is a provision established to reduce application burdens and simplify claim procedures. The review must occur at some point during the base year. If errors are identified as a result of the review, the Department must adjust all of the SFA’s closed claims that occurred in the current school year. Condition: The Child Nutrition Cluster (CNC) includes the NSLP, SBP, SMP, SFSP, and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of CNC programs for the State. DOE partners with local SFAs and sponsors to provide benefits to school-aged children. DOE has assigned subrecipient monitoring responsibilities, which include administrative reviews and other reviews as needed, to the Child Nutrition Services (CNS) division. Administrative reviews of all SFAs and sponsors are required at least once every 5 years; however, regulations also specify that high-risk SFAs and sponsors must receive targeted follow-up within 2 years. CNS utilizes a spreadsheet to track and facilitate the reviews, and a USDA questionnaire and information within the Child Nutrition Program (CNPWeb) system to document the completion of the review and related corrective action. CNS does not have a mechanism to centrally track the high-risk SFAs and sponsors to ensure follow-up occurs. CNS is required to retain documentation to support all elements of the administrative reviews and to demonstrate SFA and sponsor compliance with the program, even if corrective action occurs onsite during the review. The Office of the State Auditor (OSA) tested 16 administrative reviews completed by CNS and found: • Performance Standard 1 findings, deemed critical findings by USDA, were identified in 1 NSLP review, but required follow up fiscal action was not properly tracked. • Performance Standard 2 findings, also deemed critical by USDA, were identified in 3 reviews, but follow up corrective actions were not properly tracked, received, and/or approved. In addition, corrective action was not provided within 30 days for 2 of the 3 reviews. • corrective action for 3 reviews required fiscal action; 2 reviews indicated a reduction of a future claim would be processed, and 1 review indicated a check for repayment to the State would be received. Documentation in the CNPWeb system: o was not available to support that 2 required fiscal actions were taken, and o conflicted with the tracking spreadsheet for 1 fiscal action. • corrective action responses were missing for 4 reviews, 1 of which was marked as approved by CNS. • corrective action responses submitted by 2 SFAs were missing CNS approval information, but the reviews were marked as closed. • corrective action responses submitted by 3 SFAs were missing SFA contact information and submission dates. • the date for required corrective action to be provided was omitted for 4 reviews. • corrective action for 1 review was received late. • USDA questionnaire sections related to SFSP procurement were erroneously excluded for 4 reviews. • USDA questionnaires were not fully completed for 2 reviews. • the review tracking spreadsheet was not fully completed or conflicted with information obtained from the administrative review for 10 reviews. • the SFSP administrative review tracking spreadsheet was not designed to properly track corrective action, related due dates, and CNS review and approval dates; this was noted in all 8 SFSP administrative reviews tested. CNS updated the design of the tracking spreadsheet in fiscal year 2025 to ensure this information is properly tracked. OSA selected a non-statistical random sample. In addition to administrative reviews, CNS must perform base year reviews for all SFAs and sponsors that have applied to participate in USDA Special Provision 2. These base year reviews provide the required information necessary to determine the level of claims the SFA or sponsor may submit in the subsequent 3 years. In fiscal year 2025, CNS identified 4 SFAs that required a base year review, 2 of which were completed alongside the SFA’s administrative review. OSA tested the remaining 2 base year reviews and identified that neither review was completed by CNS as required. OSA cannot determine if unallowable costs exist through the audit of subrecipient monitoring activities, as required information was not collected through OSA’s subrecipient monitoring testing procedures; however, OSA reported questioned costs in the audit of allowable costs/cost principles and eligibility. See findings 2025-019 Internal control over CNC claim reimbursements needs improvement and 2025-020 Internal control over CNC eligibility needs improvement, respectively. Context: In fiscal year 2025, the Department provided 241 subrecipients with $70.7 million in CNC program funds, which represents 99 percent of CNC programs’ $71.3 million total expenditures. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. • Base year reviews provide authorization for the level of allowable claims an SFA or sponsor can claim in subsequent periods; if a base year review is not completed and participation in USDA Special Provision 2 continues, SFAs and sponsors could be underclaiming or overclaiming costs. • Potential questioned costs and disallowances Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that: • reviews are completed as required and supporting documentation is retained; • required corrective and fiscal actions are implemented, reviewed, and completed; and • high-risk SFAs and sponsors are tracked and considered in planning follow-up reviews. Corrective Action Plan: See F-15 Management’s Response: The Department partially agrees with this finding. Regulatory requirements for the administrative review process including corrective and fiscal action were met. Staff will receive training on tracking sheet completion and additional internal control measures that document requirements were met. The 2026 SFSP tracker has been updated to clarify the date of corrective action and now reads “Corrective Action Received Date”. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: The exceptions noted in the finding outline instances where documentation in support of the administrative review process, including required corrective action by subrecipients, could not be provided or was incomplete. The Department’s existing policies and procedures do not provide assurance that administrative reviews are monitored, completed, documented, and considered in subsequent reviews as required by Federal program regulations. The finding remains as stated.

(2025-021) Title: Internal control over CNC special reporting needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner’s Office Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) System for Award Management (SAM). Condition: The Child Nutrition Cluster (CNC) includes the School Breakfast Program, National School Lunch Program, Special Milk Program for Children, Summer Food Service Program, and the Fresh Fruit and Vegetable Program. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of CNC programs for the State and provides subawards to eligible School Food Authorities and sponsors. When an amount exceeding the first-tier subaward threshold is awarded to a CNC subrecipient, DOE must collect and enter data into SAM. Documentation could not be provided to demonstrate that subaward information or amounts were reviewed or approved prior to being reported to the Federal government. Additionally, the Office of the State Auditor (OSA) tested 23 CNC program subawards totaling $6,124,073 that exceeded the first-tier subaward threshold. Federal regulations require the following information for identified noncompliance to be included in FFATA findings: • 11 subawards totaling $1,039,361 were not reported; • 6 subawards totaling $1,147,396 were not reported timely; • 6 subaward amounts were reported incorrectly; and • 4 subawards reported incorrect key data elements. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department was required to report 185 first-tier subawards totaling $60.9 million under CNC programs. First-tier subawards account for 85 percent of CNC programs’ fiscal year 2025 expenditures totaling $71.3 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Accurate first-tier subaward information for CNC programs was not reported to the Federal government timely and included inaccurate or incomplete information. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that first-tier subawards are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-15 Management’s Response: The Department agrees with this finding. Regular monthly reporting was disrupted mid-year on March 8, 2025, due to a change in federal reporting systems. Due to the volume of monthly reportable items, the department was unable to manually input this data until a batch upload option was available. Reporting was brought up to date by August 2025. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 25-1203-05)

(2025-022) Title: Internal control over CNC donated food inventory needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 250.12 and .19 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency and must reconcile physical and book inventories of donated foods. The distributing agency must ensure that a separate inventory record of donated foods is maintained. The distributing agency’s system of inventory management must ensure that donated foods are distributed in a timely manner and in optimal condition. Condition: The Child Nutrition Cluster includes the School Breakfast Program, National School Lunch Program (NSLP), Special Milk Program for Children, Summer Food Service Program (SFSP), and the Fresh Fruits and Vegetable Program. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department receives donated foods from the U.S. Department of Agriculture (USDA) for distribution to School Food Authorities (SFAs) and sponsors participating in the NSLP or the SFSP. The donated food inventory is managed by a vendor and tracked by the Department using the Child Nutrition Program (CNPWeb) system. In March 2024, the Department identified that the CNPWeb system was not functioning correctly and SFA and sponsor order quantities were duplicated, resulting in inaccurate inventory tracking. The Department remediated the system error in October 2024. The Office of the State Auditor (OSA) tested 9 donated food products to ensure proper tracking by the Department. OSA reviewed the USDA food requests, inventory receipts, and distributions made to SFAs and sponsors to verify that the documentation corresponded to information in the inventory system and physical inventory counts. OSA found 5 instances where records did not agree, including: • 4 food products where the physical inventory count indicated 2 cases fewer than OSA calculated and system inventory records, as follows: o The physical inventory totaled 887 cases; OSA calculated and system inventory records totaled 889 cases. o The physical inventory totaled 326 cases; OSA calculated and system inventory records totaled 328 cases. o The physical inventory totaled 489 cases; OSA calculated and system inventory records totaled 491 cases. o The physical inventory totaled 1380 cases; OSA calculated and system inventory records totaled 1382 cases. • 1 food product where the physical inventory totaled 232 cases; OSA calculated and system inventory records totaled 233 cases. Upon further review, the Department documented the discrepancies on monthly tracking sheets as damaged cases; however, a reconciliation of system records was not completed throughout the year to account for such activity. The Department does not have controls in place to ensure that CNPWeb system inventory tracking is accurate and complete. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department distributed 45 USDA donated food products valued at $9.2 million to SFAs and sponsors. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential inaccurate reporting of noncash Federal awards on the Schedule of Expenditures of Federal Awards • Theft, loss, or damage of inventory may go undetected. Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that: • system inventory records are regularly reconciled to physical inventory counts; • justification of inventory discrepancies is documented in the CNPWeb system timely; and • CNPWeb system inventory tracking is accurate and complete. Corrective Action Plan: See F-15 Management’s Response: The Department partially agrees with this finding. The Child Nutrition acknowledges the identified miscounts and has implemented an additional tracking system to monitor and reconcile inventory. However, the Department maintains that its existing internal control procedures provide reasonable assurance that CNPWeb inventory counts are not materially misstated. The errors found in case counts attribute to less than 1% of the total cases in the test group and may be due to pick errors from the vendor or warehouse, or the delivery of out-of-condition food. The vendor is responsible for the accuracy of counts, all loss or damage caused by the vendor including delivery of out-of-condition food. Monthly inventory tests have been established between the department and the distributor. A ticket has been placed for fixes to the computerized inventory system. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: OSA acknowledges planned corrective action outlined in Management’s Response; however, these additional measures, including monthly inventory tests and CNPWeb system enhancements, were not in place during the audit period. As a result, the Department did not have controls in place to ensure that CNPWeb system inventory tracking was accurate and complete for fiscal year 2025. The finding remains as stated. (State Number: 25-1203-03)

(2025-025) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Active Plan: See F-16 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-1203-08)

(2025-024) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Active Plan: See F-16 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-1203-06)

(2025-023) Title: Internal control over CNC subrecipient audit monitoring needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner’s Office Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must verify that subrecipients are audited as required. Condition: The Department of Education (DOE) is responsible for the administration of Child Nutrition Cluster (CNC) programs for the State. DOE partners with subrecipient School Food Authorities and sponsors to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. DOE is required to verify that all subrecipients are audited as required when Federal award expenditures exceed the Single Audit threshold. DOE utilizes a spreadsheet to track and facilitate subrecipient audit monitoring. The spreadsheet tracks each DOE subrecipient, the subrecipient’s auditor, the date of receipt of the Single Audit report, the date the report was reviewed by DOE, any requests for an extension, any exceptions noted within the Single Audit report, and a corrective action plan due date, as applicable. The Office of the State Auditor (OSA) tested 22 CNC subrecipients required to receive a Single Audit and found: • 2 subrecipients were granted submission extensions; however, both audit reports were received after the approved extension date and documentation for an additional extension or late receipt could not be provided. • 1 subrecipient was documented on the tracking spreadsheet; however, the only information included was the subrecipient’s name. In addition, email communications indicated multiple expired extensions, but this information was not included or tracked by DOE. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department provided 241 subrecipients with $70.7 million in CNC program funds, which represents 99 percent of CNC programs’ $71.3 million total expenditures. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients may not be undergoing audits as required by Federal regulations. Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that all CNC subrecipients are properly tracked and submit Single Audit reports as required. Corrective Action Plan: See F-16 Management’s Response: The Department agrees with this finding. Audit tracking was previously performed through a manual process. As the result of a RFP, an upgrade to the Maine Education Financial System will include an automated tracking system and dashboard to more effectively manage receipt of school administrative unit audits. In the interim, the Policy and Procedure Manual will be updated to include supervisory review of the tracking spreadsheet on a monthly basis. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 25-1203-07)

(2025-026) Title: Internal control over Summer EBT eligibility needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Assistance Listing Title: Summer Electronic Benefits Transfer Program for Children Assistance Listing Number: 10.646 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.646 $1,680 Likely Questioned Costs: Undeterminable; incorrect eligibility determinations for the Summer Electronic Benefits Transfer Program for Children (Summer EBT) are the result of conditions that do not uniformly apply to the entire population. Due to the unique circumstances of each case, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 7 CFR 292.6, .8, .12, .15 and .16 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Children eligible for the Summer EBT program include those who, at any time during the period of eligibility, are: • school-aged and categorically eligible through their status as a foster child, migrant child, or through their participation in the Supplemental Nutrition Assistance Program (SNAP) or the Temporary Assistance to Needy Families (TANF) program; or • enrolled in a National School Lunch Program (NSLP)-participating school and meet the requirements to receive free or reduced price meals; or • enrolled in a special provision school, and otherwise meet the requirements to receive free or reduced price meals. Summer EBT agencies must submit a Plan for Operations and Management to the Federal government to ensure that Summer EBT benefits are issued to children based on their enrollment at the end of the instructional year immediately preceding each summer. In enrolling eligible children, Summer EBT agencies must establish procedures to allow households to provide updated contact information for the purpose of receiving Summer EBT benefits, and enable anyone who has been determined to be eligible for Summer EBT benefits to confirm their eligibility status and unenroll, or opt out, of the program, if they do not want to receive benefits. Summer EBT agencies must develop procedures to detect and prevent dual participation across multiple states. State Summer EBT agencies must establish issuance and accountability systems which ensure that only certified eligible households receive benefits; that program benefits are distributed timely in the correct amounts; and that benefit issuance and reconciliation activities are properly conducted and accurately reported to the Federal government. Condition: The Summer EBT program is administered by the Office for Family Independence (OFI) and provides a $120 annual benefit to eligible children to purchase nutritious foods during the summer; benefits are distributed through EBT cards. To establish a population of children eligible for the Summer EBT program, OFI utilized information in the Automated Client Eligibility System (ACES) and automatically deemed children who were SNAP or TANF clients as categorically eligible. Children who are Medicaid clients are not categorically eligible and must be filtered to only those clients whose income does not exceed the NSLP income limit of 185 percent of the Federal Poverty Level (FPL) during the eligibility period. To capture Summer EBT-eligible children who are not in ACES, OFI has data sharing agreements in place with the Department of Education (DOE) and the Office of Child and Family Services. OFI relied on automated batch processes to extract data from ACES and DOE information systems; the majority of eligible children were identified in both datasets. OFI removed duplicate children to ensure only 1 benefit was issued per child; however, no additional verification procedures were performed by OFI to ensure the resulting population of children deemed eligible met the required program eligibility criteria. The Office of the State Auditor (OSA) tested 55 benefit payments and found: • 10 benefit payments to children who were not eligible, as follows: o 8 benefit payments to children whose household income was not verified and may exceed the NSLP income limit of 185 percent of the FPL allowed. Therefore, OSA is questioning all 8 payments totaling $960. o 2 benefit payments to children whose household income exceeded the NSLP income limit of 185 percent of the FPL. Therefore, OSA is questioning both payments totaling $240. • 10 benefit payments to children that had an out-of-state address in ACES, as follows: o 6 children had not lived in Maine at any point during the eligibility period. According to ACES, 1 child had last lived in Maine in 2017. All 6 children are ineligible as OFI had confirmation they had unenrolled and left the state. o 3 children were verified as unenrolled from a Maine school in ACES but were eligible at a point in the eligibility period; however, OFI could not provide documentation to support dual participation in both Maine and the state the client moved to. o 1 child whose ACES case should have closed in June 2023; however, due to an incorrect suspension, the child was erroneously deemed eligible. OSA identified a material weakness/material noncompliance with questioned costs as issued in finding 2025-012, Internal control over automated SNAP eligibility certification periods needs improvement, for incorrect benefit suspensions. OSA is questioning costs totaling $240, as 8 of the 10 cards above were never used and benefits were expunged after 122 days. • one 20-year-old client was only recorded in the DOE information system to document that they were dropping out of school; therefore, OSA is questioning the $120 benefit payment. • one 2-year-old client was included in the DOE information; however, the child was too young for public school and was not enrolled. Therefore, OSA is questioning the $120 benefit payment. OSA utilized a risk-based approach to select 25 cases based on age and 10 cases based on address, and selected a non-statistical random sample for the remaining 20 cases. OSA also identified the following exceptions: • For all children issued Summer EBT benefits from July 2024 to November 2024, OFI did not retain documentation to support that families were provided the required notices to advise against duplicate participation, opt out of participation, verify household eligibility, and confirm their address. • In the 2025 Plan for Operations and Management submitted to the Federal government, OFI did not include procedures to ensure that Summer EBT benefits are only issued to children based on their enrollment at the end of the instructional year immediately preceding each summer. The Department does not have adequate policies and procedures in place to ensure that ACES case file modifications, whether manual or system-interfaced, that result in changes to eligibility determinations are appropriately considered at the time of issuance. OFI does not track changes to eligibility information in ACES that are applied retroactively. Context: In fiscal year 2025, the State issued benefits to approximately 121,000 Summer EBT clients; Summer EBT expenditures totaled $14.5 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Eligibility determinations may be incorrect, resulting in households being underpaid or overpaid. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement additional policies and procedures and enhance oversight to ensure that benefits are only issued to eligible Summer EBT clients in accordance with Federal regulations. Corrective Action Plan: See F-16 Management’s Response: The Department partially agrees with this finding. The Department partially agrees with exceptions regarding the children with an out-of-state address. Six of these individuals, including one who used the benefits, were incorrectly identified as eligible based on ACES data. The other four, including one who used the benefits, were identified through National School Lunch Program (NSLP) Participation. SUN Bucks certifications for these four children were established correctly and cannot be retroactively altered. 7 C.F.R. § 292.5 states SUN Bucks eligibility is based on the eligibility standards for NSLP. 7 C.F.R. § 245.6(c)(1) requires that children found eligible for NSLP benefits by their Local Educational Agency (LEA) continue to receive those benefits regardless of subsequent changes. 7 C.F.R. §§292.6 and 292.12 require state agencies to enroll children in SUN Bucks if they meet certification standards at any point during the eligibility period. Household circumstances after the eligibility determination are made, including changes in enrollment, are irrelevant. The Department partially agrees with the exceptions related to documentation and records retention. However, the templates were provided demonstrating that required language concerning dual enrollment and opt out procedures was included. The Department disagrees with the exception related to potential income over 185% FPL. These individuals were found eligible based on Medicaid-based eligibility and income verification rules. 7 C.F.R. § 292.14(a)(iii) only requires income verification for a three percent sample of SUN Bucks manual applications. The SUN Bucks team is not authorized to conduct additional eligibility investigations or require additional documentation for individuals meeting eligibility through participation in another means tested program. All SUN Bucks certifications in the sample reviewed for children enrolled in Medicaid with income within 185% of the Federal Poverty Limit were correctly established using income values determined through Medicaid Passive Renewal and Reasonable Compatibility policies that are consistent with applicable federal rules governing Medicaid. The Department disagrees with exceptions regarding the 2 children with brief enrollment. These children were identified as SUN bucks eligible through NSLP Participation. As detailed above once that determination is made, the Department is not able to over-ride the determination of the LEA. Contact: Evan Denno, Program Manager – SNAP, OFI, DHHS, 207-446-3201 Auditor’s Concluding Remarks: OFI states that “household circumstances after the eligibility determination (is) made, including changes in enrollment, are irrelevant.” However, correspondence regarding the Plan for Operations and Management dated May 2, 2024 between OFI and the U.S. Department of Agriculture specifies “unless the State has specific information that the child has actively unenrolled and moved to another state, the Summer EBT agency should not remove children from the issuance list.” For the cases cited in the Condition, OFI had verification of unenrollment and relocation to another state as early as 2017 and as recent as March 2024, 3 months prior to benefit issuance, which indicates that the children should have been removed from the benefit issuance list. Regarding the Summer EBT children who are also enrolled in Medicaid with household income that exceeded the NSLP income limit of 185 percent of the FPL, OFI asserts that they do not “require additional documentation for individuals meeting eligibility through participation in another means tested program.” However, Medicaid was not approved as a means tested program until October 2024. As a result, OFI’s assertion does not apply to summer 2024 benefit issuances. For the “2 children with brief enrollment,” neither child was deemed eligible for free or reduced price lunch in DOE documentation, nor did they meet other Summer EBT eligibility requirements in 2 CFR 292.6. The finding remains as stated. (State Number: 25-1121-02)

(2025-027) Title: Internal control over Summer EBT procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Summer Electronic Benefits Transfer Program for Children Assistance Listing Number: 10.646 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 7 CFR 277.14; 7 CFR 292.11; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. 7 CFR 277.14 requires the Department to submit proposed contracts and related procurement documents to the U.S. Department of Agriculture’s Food and Nutrition Service (FNS) for preaward review and approval when the procurement is expected to exceed $10,000 and is to be awarded without competition, or only one bid or offer is received in response to solicitation. 7 CFR 292.11 states that the standards prescribed in 7 CFR 277.14, as well as the requirement for prior approval, apply to information system services and equipment acquired primarily to support Summer Electronic Benefits Transfer (Summer EBT). Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. Condition: The Summer EBT program provides a $120 annual benefit to eligible children to purchase nutritious foods during the summer and is administered by the Office for Family Independence (OFI). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJF) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSA tested 2 contracts, 1 procured competitively and 1 procured noncompetitively, that accounted for $408,351 of the $424,272 in Summer EBT program procurement-related transactions in fiscal year 2025 and found: • OFI could not provide documentation that FNS approved applicable procurement documents prior to contract award as required by 7 CFR 292.11. • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OFI were accurate. OSA utilized a risk-based approach to select 1 contract issued by OFI and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $424,272 in procurement-related transactions from Summer EBT funds of $14.5 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances. • Noncompliance with Federal and State procurement requirements could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OFI develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • Federal pre-procurement approvals are obtained before contracts are awarded, if required; • DCM obtaining and reviewing documentation to support the assertions made by OFI for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-17 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS will amend and formalize our draft policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This will include the expansion of an agency-focused section to further emphasize contract submission and processing expectations, as well as the risks and implications associated with contracting delays. The amended and additional content will be integrated into the draft OSPS Policy Manual for release later this year. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1121-03)

(2025-028) Title: Internal control over National Guard cash management and the related financial reporting needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Military Federal Agency: U.S. Department of Defense Assistance Listing Title: National Guard Military Operations and Maintenance (O&M) Projects Assistance Listing Number: 12.401 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 32 CFR 33.20 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and assets related to the Federally-funded activities. Fiscal control and accounting procedures of the State must be sufficient to permit the tracing of funds to a level of expenditures adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of applicable statutes and must permit preparation of required reports. Condition: The National Guard Military Operations and Maintenance Projects (National Guard O&M Projects) program supports the Army and Air National Guard in minor construction, maintenance, repair, or operation of facilities, and provides mission operational support to be performed by the State. The Department submits a Request for Advance or Reimbursement Form (SF-270) to the Federal government to process the National Guard O&M Projects program’s reimbursement request. The program is funded utilizing estimated revenue; estimated revenue represents the estimated amount of funds needed to process expenditures, where the Department utilizes State funds prior to receiving Federal reimbursement, and is limited to the amount requested and approved by the Office of the State Controller. As a result, the program carries a negative cash balance while waiting for the reimbursement requests to be approved by the Federal National Guard Bureau. Delays in receiving Federal approval have led to larger negative cash balances for the program. The negative cash balances should be comprised of all submitted but unapproved SF-270 requests and total expenditures that have not been submitted for reimbursement. The Department tracks outstanding SF-270 requests utilizing a spreadsheet; however, the spreadsheet is not periodically reconciled to the State’s accounting system to ensure all expenditures are included. Additionally, the Department does not have documented policies and procedures to follow up on outstanding reimbursement requests to facilitate more timely reimbursements from the Federal government. Context: In fiscal year 2025, the National Guard O&M Projects program expenditures totaled approximately $30.1 million. The June 30th negative cash balances for the previous 4 fiscal years were as follows: • $(6.7) million for fiscal year 2022 • $(12.4) million for fiscal year 2023 • $(13.3) million for fiscal year 2024 • $(12.4) million for fiscal year 2025 Cause: • Lack of adequate policies and procedures, including reconciling reimbursement activity to the State’s accounting system • Lack of supervisory oversight Effect: • Due to a lack of monitoring cash balances, the Department cannot readily determine if specific Federal expenditures are reimbursed timely. • Sustained negative cash balances limit the program’s ability to continue operations without additional State funding. Recommendation: We recommend that the Department develop and implement policies and procedures and enhance oversight to adequately monitor the National Guard O&M Projects program’s cash balances, including requesting the status of delayed reimbursement requests with the Federal National Guard Bureau to ensure that Federal funds are received as timely as possible. Corrective Action Plan: See F-117 Management’s Response: The Department partially agrees with this finding and will implement the “Corrective Action Plan.” The Auditor states the cause of the findings is a ‘lack’ of adequate policies and procedures and a ‘lack’ of supervisory oversight. We agree that the procedures are not adequate but there are established procedures and oversight. Contact: Diane Dunn, Commissioner, DVEM, 207- 430-5158 Auditor’s Concluding Remarks: The Office of the State Auditor acknowledges that the Department has established procedures and oversight; however, they were not adequate to prevent, or detect and correct, on a timely basis the exception noted in the Condition. The finding remains as stated. (State Number: 25-1503-01)

(2025-029) Title: Internal control over National Guard payroll costs needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management Administrative and Financial Services State Bureau: Military Security and Employment Service Center Federal Agency: U.S. Department of Defense Assistance Listing Title: National Guard Military Operations and Maintenance (O&M) Projects Assistance Listing Number: 12.401 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403, .430 and .431; 5 MRSA 7065 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Compensation for personal services includes all renumeration, paid or accrued, for services of employees rendered during the period of performance under the Federal award, including but not necessarily limited to wages and salaries. Compensation for personal services may also include fringe benefits. Costs of compensation are allowable to the extent that they are reasonable for the services rendered and conform to the established written policy of the recipient. Salary increases are based on merit. Salary advancements within an established range shall not be automatic, but shall be dependent upon specific recommendation of the appointing officer and approval of the commissioner. The recommendation shall be based upon standards of performance as indicated by merit ratings or other pertinent data. No advancements in salary may be made until the employee has completed the probationary period. Condition: The National Guard Military Operations and Maintenance Projects (National Guard O&M Projects) program supports the Army and Air National Guard in minor construction, maintenance, repair, or operation of facilities, and provides mission operational support to be performed by the State. Performance Management Forms (PMFs) document an employee’s overall performance rating; identify the pay grade and step for the employee, including whether a merit increase should be applied based on performance; and document management approval, which includes the supervisor and the agency head. The Department of Defense, Veterans and Emergency Management is responsible for completing PMFs and submitting them to the Security and Employment Service Center for processing. The Office of the State Auditor (OSA) tested payroll costs for 24 employees charged to the National Guard O&M Projects program during fiscal year 2025 and found that 8 PMFs did not have evidence of the agency head approval; 7 of the 8 PMFs resulted in merit increases in fiscal year 2025. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the National Guard O&M Projects program expenditures totaled $30.1 million, of which $11.1 million was expended for payroll. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential unauthorized salary adjustments could result in future questioned costs • Noncompliance with State regulations Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that PMFs properly support the National Guard O&M Projects program’s payroll costs in accordance with Federal and State regulations. Corrective Action Plan: See F-18 Management’s Response: DVEM Response: The Department partially agrees with this finding. The Department agrees that eight positions lacked an agency head signature. As a result, we have taken steps to ensure appropriate agency heads are identified for each of those positions and the agency heads are aware of the need to sign off on the relevant forms. However, we disagree that there is lack of adequate policies and procedures that could result in future questioned costs. All of the PMFs were completed and signed by a supervisor and employee indicating that performance was properly assessed to support the employee’s pay grade, step and merit increase. DVEM Contact: Michelle Lenihan, Deputy Commissioner, DVEM, 207- 430-5997 DAFS Response: The Bureau of Human Resources partially agrees with this finding. The Bureau of Human Resources agrees that the positions identified lacked agency head signatures. BHR disagrees with OSA as to the effect of those missing signatures. As OSA indicates “Performance Management Forms (PMFs) document an employee’s overall performance rating, identify the pay grade and step for the employee, including whether a merit increase should be applied based on performance.” The performance management forms are developed and updated centrally by BHR and all Departments are required to use the same forms. The Agency Head will often not have any direct knowledge of a specific employee’s actual performance. The purpose of the Agency Head signature is not as a control to whether an employee is meeting performance expectations, rather it is because the Agency Head is responsible for the budget of their respective agency, including personnel services. Due to other controls at the Finance Service Center and Controller’s Office, all positions were appropriately budgeted for, and employees received their appropriate pay. DAFS Contact: Michael J. Dunn, Esq., Acting State Human Resources Officer, BHR, 207-215-2951 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. State internal control procedures require review and approval of the PMF by both the supervisor and agency head, as evidenced by their signatures, to ensure an employee’s pay grade and step are appropriate based on performance. Both signatures on the PMF support that payroll costs of the National Guard O&M Projects program have been adequately reviewed for allowability purposes in accordance with Federal and State regulations. The finding remains as stated. Contact: (State Number: 25-1503-02)

(2025-035) Title: Internal control over Health Disparities program procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or non-competitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a noncompetitively bid contract. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. OSA tested 30 contracts, 21 procured competitively and 9 procured noncompetitively, that accounted for approximately $4.5 million of the $6.2 million in Health Disparities program procurement-related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by MeCDC were accurate. • For 27 contracts, DCM provided the PJF to OSPS for their review after the contract had commenced, between 1 and 131 days after the contract start date. For all 30 contracts, OSPS approved the PJF after the contract commenced, between 5 and 169 days after the contract start date. • For all 9 noncompetitive contracts, OSPS posted the NOI after contract performance had commenced, between 24 and 171 days after the contract start date. For 7 of these contracts, services had been initiated and financial obligations incurred prior to the NOI. OSA utilized a risk-based approach to select 21 contracts issued by MeCDC and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $6.2 million in procurement-related transactions from Health Disparities program funds of $6.7 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and MeCDC develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by MeCDC for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-20 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1123-06)

(2025-030) Title: Internal control over Health Disparities program SEFA reporting needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number and include the total amount provided to subrecipients from each Federal program. Condition: The Department of Health and Human Services’ Service Center must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State’s SEFA. OSC is responsible for compiling this information on behalf of the State. The Office of the State Auditor reviewed amounts reported on the SEFA for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program and identified a $1.2 million revenue transfer incorrectly reported as a reduction to expenditures. As a result, the initial amount reported on the SEFA was understated by $1.2 million. Context: In fiscal year 2025, Health Disparities program expenditures totaled $6.7 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in inaccurate information used for programmatic, policy, or statistical purposes. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement policies and procedures to ensure expenditures are appropriately reported on the SEFA. Corrective Action Plan: See F-19 Management’s Response: The DHHS and the DHHS Financial Service Center agree with this finding. The Service Center will update policies and procedures to ensure expenditures are appropriately reported on the SEFA by August 2026. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 25-1123-01)

(2025-031) Title: Internal control over Health Disparities program cash management needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services Public Safety State Bureau: Health and Human Services Service Center Maine Center for Disease Control & Prevention Emergency Medical Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Chapter 50 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of funds transfers must be as close as is administratively feasible to the Department’s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than 7 business days. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. MeCDC has a memorandum of understanding in place with the Department of Public Safety’s Emergency Medical Services (EMS) Bureau to assist in administering the Health Disparities program. The Department of Health and Human Services’ Service Center is responsible for drawing down Federal funds for disbursement for program purposes. The Office of the State Auditor (OSA) identified that MeCDC began fiscal year 2025 with a $1.7 million surplus of program funds and ended the fiscal year with a $1.2 million surplus of funds. The surplus was the result of a MeCDC drawdown of $3.0 million during fiscal year 2022 which was provided to EMS for use in support of the Health Disparities program. EMS returned $1.2 million of unused funds to MeCDC in fiscal year 2025. Therefore, EMS had excess cash on hand from July 1, 2024, through April 15, 2025, and MeCDC had excess cash on hand from April 15, 2025, through June 30, 2025, which is not in compliance with Federal cash management requirements. MeCDC fully returned the surplus funds to the Federal government in July 2025. In addition, OSA tested 3 payments made to subrecipients by EMS and found a significant delay between receipt of invoice from the EMS subrecipient and issuance of payment. The delay in payment issuance ranged between 62 to 80 days. Context: In fiscal year 2025, MeCDC expended $6.7 million in Health Disparities program funds. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight • Staff turnover which delayed the processing of invoices Effect: • Noncompliance with Federal regulations • The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. • The State could incur an interest liability on excess Federal cash balances. • Delays in issuing payments to subrecipients. Recommendation: We recommend that the Departments develop policies and procedures to: • govern inter-departmental transfers of funds to ensure cash management requirements are adhered to; and • ensure the timely processing of invoices. Corrective Action Plan: See F-18 Management’s Response: DHHS Response: The Department agrees with this finding. At the onset of the Health Disparities grant period, the Maine CDC and the Department of Public Safety (DPS) established an MOU to approve the single transfer of all Health Disparity grant funds allocated to DPS prior to DPS expenditure of funds. In March 2025, the Health Disparities grant was prematurely terminated and unspent funds in the amount of $1.2 million were returned to U.S. CDC. In May 2025, Maine CDC was among other Health Disparities grant recipients eligible to again utilize Health Disparities grant funds following the reinstatement of the grant as a result of successful challenging litigation. In June 2025, Maine CDC was granted internal approval to proceed with utilization of grant funds. During the process of grant termination and reinstatement and prior to undergoing the SFY25 audit, it was recognized that the MOU should include terms for reimbursement of funds based on service provision rather than authorizing the single transfer of funds prior to expenditure. Following the reinstatement of the Health Disparities grant, Maine CDC and DPS worked collaboratively to revise the original MOU to include terms for distribution of funds, including monthly submission or financial reporting to receive funds based on services provided. The revised MOU was signed by DPS and DHHS Commissioners in June and August 2025, respectively. DHHS Contact: Eden Hale, Associate Director, Division of Population Health Equity, MeCDC, 207-441-1090 DPS Response: The Department agrees with this finding. The Department of Public Safety acknowledges that there was a delay in the processing of the three invoices made to subrecipients by EMS which were all identified during the Audit. This was a result of turnover in multiple positions within the bureau including the Director and the Office Specialist II who both play an important role in the processing of invoices. Contact: Derek Gorneau, Assistant to the Commissioner, DPS, 207-530-3531 (State Number: 25-1123-02)

(2025-032) Title: Internal control over Health Disparities program subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services Public Safety State Bureau: Maine Center for Disease Control & Prevention Emergency Medical Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information. • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. • monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. MeCDC has a memorandum of understanding in place with the Department of Public Safety’s Emergency Medical Services (EMS) Bureau to assist in administering the Health Disparities program. The Office of the State Auditor (OSA) tested 11 contracts or contract amendments issued by MeCDC and 3 contracts issued by EMS for compliance with: • award identification requirements and found: o 9 contract amendments issued by MeCDC did not include the name of the Federal agency issuing the award, the Federal award identification number, or the Federal award date; and o all 3 contracts issued by EMS did not include the Federal award identification number, the Federal award date, the assistance listing title and number, or the indirect cost rate for the Federal award. • subrecipient risk evaluation procedures and found through inquiry of program personnel at MeCDC and EMS that policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. As a result, subrecipient monitoring activities were the same for all subrecipients/contracts, regardless of risk. • subrecipient monitoring requirements and found that documentation could not be provided to support that: o follow-up occurred regarding late receipt of an incomplete financial report for 1 contract overseen by MeCDC; o an appropriate response was completed to previously identified inaccurate expense reporting for 1 contract overseen by MeCDC; o a required report was reviewed for 1 contract overseen by EMS; and o required reports were received or that appropriate action was taken in response for 2 contracts overseen by EMS. OSA determined that payments made to subrecipients for the aforementioned reporting deficiencies were allowable based upon subsequent reports and other monitoring procedures performed. OSA utilized a risk-based approach to select 2 contracts issued by MeCDC and selected a non-statistical random sample of all other contracts. Context: In fiscal year 2025, MeCDC provided $3.2 million from a total of $6.2 million and EMS provided $301,000 from a total of $449,000 to Health Disparities program subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Potential future questioned costs and disallowances Recommendation: We recommend that the Department implement policies and procedures: • to ensure that all required information is included in contracts and contract amendments; • that require evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed; and • implement policies and procedures to ensure all required subrecipient monitoring activities are performed. Corrective Action Plan: See F-19 Management’s Response: DHHS Response: The Department partially agrees with this finding. We agree with the recommendations that the Department implement policies and procedures to ensure all required information is included in contracts and that all required subrecipient monitoring is completed. The Department disagrees that we do not have subrecipient risk evaluation procedures. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. DHHS Contact: Eden Hale, Associate Director, Division of Population Health Equity, Maine CDC, 207-441-1090 DPS Response: The Department partially agrees with this finding. The Department of Public Safety acknowledges that EMS was missing policies and procedures around specific subrecipient monitoring activities and required contract language identifying the Federal Grant. However, the Department has these policies and procedures in place for the Contract/Grant Team which oversees the majority of the Federal Funding for the Department. The Department will ensure all Bureaus receive guidance, training, and policies and procedures. DPS Contact: Derek Gorneau, Assistant to the Commissioner, DPS, 207-530-3531 Auditor’s Concluding Remarks: DHHS: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. DPS: The Department asserts that policies and procedures are in place for the Contract/Grant Team, but did not demonstrate that these policies and procedures were adhered to in relation to contracts for the Health Disparities program. The finding remains as stated. (State Number: 25-1123-03)

(2025-033) Title: Internal control over Health Disparities program payments to subrecipients needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of the award. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. MeCDC has a memorandum of understanding in place with the Department of Public Safety’s Emergency Medical Services (EMS) Bureau to assist in administering the Health Disparities program. The Office of the State Auditor (OSA) tested 27 payments issued by MeCDC to subrecipients and found: • 2 payments totaling $69,535 to 1 subrecipient against a contract for which a cash surplus existed at the time of payment. • 1 payment of $40,621 based on a quarterly financial report that contained detailed expense information that did not match approved contract expenditures. • 2 payments totaling $252,824 to 1 subrecipient to close out a contract were issued prior to receipt by the Department of the required final progress reports. Therefore, MeCDC does not have policies and procedures in place to prevent payments to subrecipients that do not meet the criteria set forth in 2 CFR 200.303 at the time of payment. Subsequently, MeCDC was able to provide reports to demonstrate that the funds had been used in accordance with the terms and conditions of the award. OSA utilized a risk-based approach to select 9 payments issued by MeCDC and selected a non-statistical random sample of subrecipient contracts to test all payments made in fiscal year 2025 that were related to those contracts. Context: MeCDC provided $3.2 million from a total of $6.2 million to Health Disparities program subrecipients during fiscal year 2025. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that MeCDC implement procedures and enhance oversight to ensure payments made to subrecipients are accurate, allowable, and adequately supported at the time of payment. Corrective Action Plan: See F-20 Management’s Response: The Department disagrees with this finding. The conditions noted do not support that costs were unallowable. Furthermore, the Department demonstrated that the funds had been used in accordance with the terms and conditions of the award. The Department’s processes provide reasonable assurance that payments are appropriate. Contact: Eden Hale, Associate Director, Division of Population Health Equity, Maine CDC, 207-441-1090 Auditor’s Concluding Remarks: OSA acknowledges that subsequent information demonstrated that the funds were used for allowable purposes; however, this does not absolve the Department of responsibility to ensure accuracy and appropriateness at the time of payment. The Department did not demonstrate that controls are in place to ensure that all payments to subrecipients are allowable at the time of payment. The finding remains as stated. (State Number: 25-1123-04)

(2025-034) Title: Internal control over Health Disparities program subrecipient cash management needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. The Department makes equal advance monthly payments to subrecipients and then reconciles those amounts to quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes, and MeCDC’s subrecipient monitoring procedures do not include review of subrecipient compliance with cash management requirements. As a result, MeCDC procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Context: MeCDC provided $3.2 million from a total of $6.2 million to Health Disparities program subrecipients during fiscal year 2025. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that MeCDC implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the Health Disparities program. Corrective Action Plan: See F-20 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of the funds. Payments are made as close as is administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1) ... that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Eden Hale, Associate Director, Division of Population Health Equity, MeCDC, 207-441-1090 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation emphasizes a single sentence from the broader paragraph, omitting context that informs the regulation’s full intent. According to the 2025 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR 200.305(b)(1)). 2 CFR 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. The finding remains as stated. (State Number: 25-1123-05)

(2025-036) Title: Internal control over PDG subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services Education State Bureau: Office of Child and Family Services Office of Teaching and Learning Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $128,333 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of subrecipients who received program funds during fiscal year 2025 and identified known questioned costs associated with 1 of those subrecipients based on various compliance attributes. Since circumstances are unique to each subrecipient, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information. • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. • monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. • ensure that the subrecipient takes corrective action on all Single Audit findings related to the subaward, other audit findings, site visits, and written notifications of adverse conditions which will impact the ability to meet milestones or the objectives of a subaward. Condition: The Every Student Succeeds Act/Preschool Development Grants (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Department of Health and Human Services’ (DHHS) Office of Child and Family Services (OCFS). DHHS has a memorandum of understanding in place with the Department of Education (DOE) to assist in administering PDG. OSA tested 2 contracts issued by OCFS and 2 contracts issued by DOE for compliance with: • award identification requirements, and found: o 2 contracts issued by OCFS did not include the Federal award identification number or the grant award number; and o 2 contracts issued by DOE did not include the Federal award identification number, the Federal award date, the assistance listing title and number, the name of Federal agency, the assistance listing title and number, identification of whether the Federal award is for research and development, or the indirect cost rate for the Federal award. • subrecipient risk evaluation procedures, and found through inquiry of program personnel at OCFS and DOE that policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. As a result, subrecipient monitoring activities were the same for all subrecipients/contracts regardless of risk. • subrecipient monitoring requirements, and found that OCFS did not identify an appropriate level of monitoring for 1 contract. Evidence of significant developments, including inability to meet performance goals, that impacted the subrecipient’s ability to meet the objectives of the subaward were present prior to quarterly reporting. OSA determined that payments made to this subrecipient for the aforementioned monitoring deficiencies were not allowable based upon subsequent financial reports and the results of other monitoring procedures performed during the fiscal year. Payments to the subrecipient were withheld after April 2025. OSA has questioned the full amount of program expenditures paid to this subrecipient during the fiscal year, totaling $128,333. OSA selected a non-statistical random sample of all PDG subrecipient contracts. Context: In fiscal year 2025, PDG expenditures totaled $11.5 million, of which approximately $910,000 was paid to OCFS subrecipients and $709,000 was paid to DOE subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Payments may be issued in error to subrecipients not in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. • Known questioned costs • Potential future questioned costs and disallowances Recommendation: We recommend that the Department enhance oversight and implement policies and procedures to ensure that: • all required information is included in contracts and contract amendments; • an evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring is performed; and • all required subrecipient monitoring activities are performed. Corrective Action Plan: See F-21 Management’s Response: The Departments partially agree with this finding. DHHS agrees that two contracts did not include the Federal award identification number or the grant award number. DOE agrees that two contracts did not include the Federal award identification number, the Federal award date, the assistance listing title and number, the indirect cost rate for the Federal award, name of Federal agency, assistance listing title and number, identification of whether the Federal award is for research and development, and the indirect cost rate for the federal award. The Departments disagree that subrecipient risk evaluation policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. DOE utilizes a risk assessment tool when developing monitoring of invoices associated with subrecipients. Contact: Tara Williams, Associate Director of Early Care & Education, OCFS, DHHS, 207-557-2342 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. DHHS’ existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. Furthermore, as noted in the Condition, OSA found that DHHS did not identify an appropriate level of monitoring for 1 contract. If DHHS had adequate controls in place over subrecipient risk evaluation requirements, appropriate subrecipient monitoring procedures would have been developed and performed in response to the subrecipient’s inability to meet the objectives of the subaward, including withholding payments to the subrecipient sooner. Additionally, the risk assessment tool that DOE refers to in Management’s Response only determines the frequency of invoicing (monthly or quarterly) and does not determine the level of subrecipient monitoring needed based on the subrecipient’s risk. The finding remains as stated. (State Number: 25-1122-04)

(2025-039) Title: Internal control over PDG procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a non-competitively bid contract. Condition: The Every Student Succeeds Act/Preschool Development Grants (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Office of Child and Family Services (OCFS). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 calendar days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. The Office of the State Auditor (OSA) tested 10 OCFS contracts, 4 procured competitively and 6 procured noncompetitively, that accounted for $5.6 million of the $6.5 million in OCFS PDG procurement-related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OCFS were accurate. • For 6 contracts, DCM provided the PJF to OSPS for their review after the contract had commenced, between 16 and 192 days after the contract start date. For 8 contracts, OSPS approved the PJF after the contract commenced, between 18 and 214 days after the contract start date. For 1 contract, documentary evidence of PJF approval by OSPS could not be provided. • For 4 noncompetitive contracts, OSPS posted the NOI after contract performance had commenced, between 38 and 214 days after the contract start date. Additionally, for 1 noncompetitive contract, services had been initiated and financial obligations incurred and a NOI was not posted to the OSPS webstie. OSA utilized a risk-based approach to select 5 contracts issued by OCFS and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $6.5 million in OCFS procurement-related transactions from PDG funds of $11.5 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OCFS develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by OCFS for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-22 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1122-05)

(2025-037) Title: Internal control over PDG SEFA reporting needs improvement Prior Year Findings: None State Department: Health and Human Services Education Administrative and Financial Services State Bureau: Office of Child and Family Services Office of Teaching and Learning Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR.303; 2 CFR 200.510 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number and include the total amount provided to subrecipients from each Federal program. Condition: The Every Student Succeeds Act/Preschool Development Grants (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school, and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Department of Health and Human Services’ (DHHS) Office of Child and Family Services. DHHS has a memorandum of understanding in place with the Department of Education (DOE) to assist in administering PDG. The DHHS Service Center (SC) and DOE must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State’s SEFA. OSC is responsible for compiling this information on behalf of the State. The Office of the State Auditor (OSA) reviewed amounts reported on the SEFA for PDG and identified both DHHS SC and DOE incorrectly reported direct expenditures and amounts provided to subrecipients. As a result, the initial amount reported on the SEFA was overstated by $2.6 million. In addition, OSA identified $436,074 incorrectly reported as amounts provided to subrecipients that should have been reported as direct expenditures for the program. OSC subsequently corrected the SEFA for all errors identified by OSA. Context: In fiscal year 2025, PDG expenditures totaled $11.5 million. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Inaccurate reporting of expenditure amounts on the SEFA, which are submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. • Noncompliance with Federal regulations Recommendation: We recommend that the Departments increase oversight and implement policies and procedures to ensure expenditures are appropriately classified and reported on the SEFA. Corrective Action Plan: See F-21 Management’s Response: The DHHS, the DOE and the DHHS Financial Service Center agree with this finding. The Departments will update policies and procedures to ensure expenditures are appropriately reported on the SEFA. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 25-1122-01)

(2025-038) Title: Internal control over PDG special reporting needs improvement Prior Year Findings: None State Department: Education State Bureau: Office of Teaching and Learning Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR.303; 2 CFR 170 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) System for Award Management (SAM). Condition: The Every Student Succeeds Act/Preschool Development Grants’ (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Department of Health and Human Services’ (DHHS) Office of Child and Family Services. DHHS has a memorandum of understanding in place with the Department of Education (DOE) to assist in administering PDG. When an amount exceeding the first-tier subaward threshold is awarded to a DOE subrecipient, DOE must collect and enter data into SAM. DOE inaccurately identified subrecipients as vendors within the State’s accounting system; as a result, they were excluded from FFATA reporting. In fiscal year 2025, DOE did not report any of its first-tier subawards for PDG. Federal regulations require the following information for identified noncompliance to be included in FFATA findings. 10 subawards totaling $1,419,855: • were not reported; • were not reported timely; • had no reported subaward amount; and • had no key data elements reported. Context: In fiscal year 2025, DOE was required to report 10 first-tier subawards totaling $1,419,855 under PDG. DOE provided approximately $709,000 from a total of $11.5 million to PDG program subrecipients during fiscal year 2025. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • DOE first-tier subaward information for PDG was not reported to the Federal government. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that DOE: • implement policies and continue to ensure that subrecipients are appropriately classified and reported; and • increase oversight to ensure that first-tier subawards are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-22 Management’s Response: The Department agrees with this finding. The passthrough subawards, previously omitted from monthly FFATA reporting, have now been reported in SAM.gov. The department's FFATA review procedure has been updated to include supervisory review to confirm that passthrough subawards are included in monthly reporting moving forward. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 25-1122-02)

(2025-040) Title: Internal control over PDG subrecipient cash management needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. Condition: The Every Student Succeeds Act/Preschool Development Grants (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Department of Health and Human Services’ Office of Child and Family Services (OCFS). The Department makes equal advance monthly payments to subrecipients and then reconciles those amounts to quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes, and OCFS’ subrecipient monitoring procedures do not include review of subrecipient compliance with cash management requirements. As a result, OCFS procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Context: OCFS provided approximately $910,000 from a total of $11.5 million to PDG program subrecipients during fiscal year 2025. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that OCFS implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the PDG program. Corrective Action Plan: See F-22 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of the funds. Payments are made as close as is administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1) ...that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Tara Williams, Associate Director of Early Care & Education, OCFS, DHHS, 207-557-2342 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation emphasizes a single sentence from the broader paragraph, omitting context that informs the regulation’s full intent. According to the 2025 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR 200.305(b)(1)). 2 CFR 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. Furthermore, in finding 2025-036, Internal control over PDG subrecipient monitoring procedures needs improvement, the Office of the State Auditor identified that 1 PDG subrecipient received equal advance monthly payments that significantly outpaced the subrecipient’s spending of PDG funds throughout fiscal year 2025. Payments to the subrecipient were withheld after April 2025 for the subrecipient’s inability to meet performance goals, not due to the Department’s monitoring of subrecipient cash management, and OCFS allowed the subrecipient to retain the excess PDG funds. This exception corroborates that controls are not in place over subrecipient cash management. The finding remains as stated. (State Number: 25-1122-03)

(2025-046) Title: Internal control over TANF procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a noncompetitively bid contract. Condition: The Temporary Assistance for Needy Families (TANF) program was implemented to provide temporary cash assistance, job training, and support services to low-income families with children. The TANF program is administered by the Office for Family Independence (OFI). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 calendar days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. The Office of the State Auditor (OSA) tested 14 contracts, 6 procured competitively and 8 procured noncompetitively, that accounted for $21.6 million of the $35.0 million in TANF procurement-related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OFI were accurate. • For 7 contracts, DCM provided the PJF to OSPS for their review after the contract had commenced, between 5 and 109 days after the contract start date. For 12 contracts, OSPS approved the PJF after the contract commenced, between 11 and 159 days after the contract start date. For 1 contract, the PJF was not provided. • For 2 noncompetitive contracts, OSPS posted the NOI after contract performance had already commenced, between 44 and 59 days after the contract start date. For both of these contracts, services had been initiated and financial obligations incurred prior to the NOI. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department expended $35.0 million in procurement-related transactions from TANF funds of $100.2 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OFI develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by OFI for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-24 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1111-10)

(2025-041) Title: Internal control over TANF client payments needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 263.11 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must use Federal Temporary Assistance for Needy Families (TANF) funds for expenditures that are reasonably calculated to accomplish the purposes of TANF. Use of funds in violation of this is considered misuse of funds. Condition: The TANF program provides time-limited assistance to needy families with children so that the children can be cared for in their own homes or in the homes of relatives; to end dependence of needy parents on government benefits by promoting job preparation, work, and marriage; to prevent out-of-wedlock pregnancies, including establishing prevention and reduction goals; and to encourage the formation and maintenance of two-parent families. The Department issues monthly cash benefits to TANF clients while they work towards self-sufficiency. The Department also issues TANF support service payments directly to TANF clients for various items and services, and to providers on behalf of TANF clients for services rendered such as childcare and transportation. The Office of the State Auditor (OSA) tested 60 cash benefits and 60 support service payments and found: • 1 cash benefit issued in March 2025 did not include all members of the household, resulting in an underpayment of $395. Upon further review, OSA found an additional $3,843 underpaid to the client during fiscal year 2025. • 2 support service payments issued for transportation were calculated by the Department using a distance other than the most direct route as required. The payments included: o one payment issued in November 2024 that overpaid a TANF client $3. Upon further review, OSA found an additional $15 overpaid to the client during fiscal year 2025. o one payment issued in September 2024 that underpaid a TANF client $3. Upon further review, OSA found an additional $11 underpaid to the client during fiscal year 2025. • 1 support service payment overpaid a childcare provider by $2. Upon further review, OSA found an additional $8 that was overpaid to the provider during fiscal year 2025. OSA selected non-statistical random samples. Context: In fiscal year 2025, $51.7 million from a total of $104.9 million was paid to TANF clients for services and direct cash benefits. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department: • implement additional procedures to ensure that payments made to TANF clients are accurate, allowable, and adequately documented; • increase monitoring procedures over these payments; • establish recoupments for the identified overpayments; and • issue benefits/payments to clients or providers for identified underpayments. Corrective Action Plan: See F-23 Management’s Response: The Department agrees with this finding. Actions have been taken to issue corrective payments for benefits that were underpaid and benefits that were overpaid have been referred for recoupment. The Corrective Action Plan will mitigate the agreed upon errors from reoccurring. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-06)

(2025-042) Title: Internal control over Income Eligibility and Verification System procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 205.55 and .56 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to comply with Federal Income Eligibility and Verification System (IEVS) exchange rules and regulations in accordance with program agreements. The Department is required to request through IEVS: • wage information from the State Wage Information Collection Agency for all applicants at the first opportunity following receipt of the application and for all recipients on a quarterly basis; • unemployment compensation information from the agency administering the State’s unemployment compensation program; • all available information maintained by the Social Security Administration; • unearned income information from the Internal Revenue Service; and • any income or other information affecting eligibility available from agencies in the State or other states. The Department is required to resolve all discrepancies identified through IEVS reports within 45 days of receipt. Condition: IEVS is used to exchange information among State and Federal agencies to verify various information needed to determine eligibility for Federal financial assistance. This information is updated in the Automated Client Eligibility System (ACES) to ensure eligibility determinations are made based on current information. IEVS generates various discrepancy reports on a weekly, monthly, and quarterly basis. The Department is required to review reports and resolve all discrepancies identified through IEVS within 45 days of report receipt and document the resolution in ACES. The Department determined that the value of Quarterly Income Discrepancy Reports is limited because discrepancy information is available through other sources on a more frequent basis. As a result, the Department did not allocate resources to completing reviews of these quarterly reports during fiscal year 2025. Context: A total of 224 IEVS reports are required to be generated annually. Of the 224 reports generated, reviews for 4 quarterly reports were not completed during fiscal year 2025. The number of Temporary Assistance for Needy Families (TANF) discrepancies on each report can vary. Cause: Lack of resources Effect: • IEVS information may not be updated timely in ACES, which could affect program eligibility. • Failure to maintain documentation to support compliance with required TANF exchange rules may result in the U.S. Department of Health and Human Services penalizing the State up to 2 percent of the grant award. Recommendation: We recommend that the Department allocate resources to ensure that all reviews are completed and discrepancies identified through IEVS are resolved timely and documented in ACES. Corrective Action Plan: See F-23 Management’s Response: The Department agrees with this finding. The Corrective Action Plan from SFY 2024 included the dedication of staff resources to complete the review of the quarterly income discrepancy report effective for SFY 2026. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-03)

(2025-043) Title: Internal control over TANF subrecipient risk evaluation procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal regulations for the purpose of determining the appropriate level of subrecipient monitoring to be performed. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Department provided evidence to support that subrecipient monitoring procedures were performed; however, documentation that risk evaluation procedures performed corresponded to the appropriate level of monitoring activities could not be provided. Context: The Department provided $35.0 million from a total of $104.9 million to TANF subrecipients during fiscal year 2025. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-23 Management’s Response: The Department disagrees with this finding. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 25-1111-02)

(2025-044) Title: Internal control over TANF performance reporting procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 261.60 through .62; 45 CFR 265.7 and .8 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain adequate documentation, perform adequate verification, and implement other control procedures for Temporary Assistance for Needy Families (TANF) client work participation. Work participation activities include unsubsidized employment, job search and job readiness, job skills training directly related to employment, vocational education, and other work-related programs. The Department must report the actual hours that a work-eligible TANF client participates in these work-related activities, on the ACF-199 TANF Data Report on a quarterly basis. These reports are required by the Federal government. Condition: The Department must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of information reported to the Federal government and used to calculate work participation rates. The Department utilizes a vendor for case management services and development of individualized training and employment plans for Additional Support for People in Retraining and Employment (ASPIRE) clients. These services directly impact and enforce client work participation requirements. Vendor data is exchanged with the Department on a monthly basis and is utilized in conjunction with client data in the Automated Client Eligibility System to comprise client work participation data that is reported on the ACF-199 report to the Federal government. The Department reported incorrect work participation information on the ACF-199 report. Of the 30 clients tested by the Office of the State Auditor (OSA), 23 inaccurate work participation data elements were reported for 19 clients, including inaccurate: • parent with minor child status for 13 cases; • unsubsidized employment hours for 4 cases; • countable months towards the Federal time limit of 60 months for 3 cases; • relationship to head of household status for 1 case; • community service program hours for 1 case; and • education related to employment with no high school diploma indicator for 1 case. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the number of families reported on the ACF-199 report ranged from 11,000 to 12,000 per quarter. Cause: • Lack of adequate procedures to ensure accurate reporting • Lack of supervisory oversight Effect: Inaccurate work participation data reported to the Federal government may affect the Federal requirement for TANF’s State Maintenance of Effort. Recommendation: We recommend that the Department enhance existing procedures to ensure that the information reported on the ACF-199 report is accurate and complete prior to submission to the Federal government. Corrective Action Plan: See F-24 Management’s Response: The Department agrees with this finding. The Corrective Action Plan will mitigate the agreed upon errors from reoccurring. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-04)

(2025-045) Title: Internal control over TANF work verification plan procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 261.60 through .65; Work Verification Plan for the State of Maine The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain adequate documentation, perform adequate verification, and implement other control procedures for Temporary Assistance for Needy Families (TANF) client work participation. Work participation activities include unsubsidized employment, job search and job readiness, job skills training directly related to employment, vocational education, and other work-related programs. The Work Verification Plan for the State of Maine requires Additional Support for People in Retraining and Employment (ASPIRE) supervisors to review a minimum of 5 random cases per regional office per month. ASPIRE Case Review Tool (ACRT) reviews are intended to validate all case data to include (but not limited to) work assessment, appropriateness of the individual work plan, work verification data consistency, documentation, and work plan outcomes. Accuracy of all aspects of the individual cases is assessed as part of these reviews, including participation activity/hours documentation. Condition: The ASPIRE program helps TANF recipients move towards financial independence through case management, job training, education, support, and employment services. The Department contracts with a subrecipient service provider to perform outreach and case management services for the ASPIRE program. ASPIRE supervisors perform ACRT reviews of client case activity recorded by its subrecipient service provider to ensure that all case data including, but not limited to, work participation rate data is documented, verified, and reported in accordance with work verification plan requirements. The Office of the State Auditor (OSA) tested 40 ACRT reviews performed during fiscal year 2025 and found: • 2 reviews did not indicate the date the review was performed. As a result, OSA could not determine whether follow up was timely. • 2 reviews did not document activities and verification of activities to support compliance with work verification activities. • 3 reviews did not follow up with the subrecipient service provider timely. Follow-up meetings took place between 3 and 8 months after the initial review. • one review did not ensure the subrecipient service provider addressed all actionable items. OSA selected a non-statistical random sample. Additionally, the Department did not adhere to the Work Verification Plan’s requirement to review a minimum of 5 random cases per regional office per month; instead, ACRT reviews were performed based on each regional office’s caseload. Furthermore, ACRT reviews were not performed for the months of December 2024 and January 2025, and only 33 of the 65 required monthly ACRT reviews were performed for February 2025. Finally, a component of work verification plan requirements states that work participation data is required to be accurately reported on the ACF-199 TANF Data Report to the Federal government. OSA identified a significant deficiency as issued in finding 2025-044 for inaccurate work participation data reported on the ACF-199 report. Therefore, since work participation rate data was not documented, verified, or reported in accordance with the State’s work verification plan, the Department is not in compliance with Federal work verification plan requirements. Context: The Department must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of information reported to the Federal government and used to calculate work participation rates. Cause: • Lack of adequate oversight procedures to ensure that ACRT reviews are accurate and complete and work verification plan requirements are met • Revisions to the method of selecting cases for review from 5 random cases per regional office per month to an allocation based on each regional office’s caseload were not incorporated into the Work Verification Plan. • The subrecipient service provider contract was renegotiated during fiscal year 2025, which resulted in revisions to the ACRT and a pause on ACRT reviews. Effect: The Federal government may penalize the State by an amount not less than 1 percent and not more than 5 percent of the grant award for violation of work verification plan requirements. Recommendation: We recommend that the Department enhance existing procedures and oversight to ensure that work verification plan requirements are met. This should include: • confirming that ACRT reviews are performed accurately and completely, which will ensure the reliability of client data used to calculate work participation rates reported to the Federal government; and • updating the Work Verification Plan to accurately reflect the ACRT case review selection criteria as deemed necessary. Corrective Action Plan: See F-24 Management’s Response: The Department agrees with this finding. The Department agrees with the exceptions identified as a result of a non-statistical random sample. The Corrective Action Plan will mitigate the agreed upon errors from reoccurring. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-01)

(2025-047) Title: Internal control over TANF subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Department is required to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Office of the State Auditor (OSA) tested 9 contracts issued to Temporary Assistance for Needy Families (TANF) subrecipients and found that documentation could not be provided to support that: • required performance reports were received and that appropriate action was taken in response for 4 contracts; and • required reports were reviewed for 6 contracts. OSA determined that payments made to subrecipients for the aforementioned reporting deficiencies were allowable based upon subsequent reports and other monitoring procedures performed. OSA selected a non-statistical random sample. Context: The Department provided $35.0 million from a total of $104.9 million to TANF subrecipients during fiscal year 2025. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Potential future questioned costs and disallowances Recommendation: We recommend that the Department implement policies and procedures to ensure that all required reports are received from subrecipients and reviewed by program personnel, and that appropriate action is taken to address any deficiencies identified through subrecipient monitoring. Corrective Action Plan: See F-25 Management’s Response: The Department agrees with this finding. The Department will create a process to ensure the documentation of the review of sub-recipient performance reports. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-08)

(2025-048) Title: Internal control over Child Support Services expenditures needs improvement Prior Year Findings: None State Department: Health and Human Services Administrative and Financial Services Judicial Branch State Bureau: Office for Family Independence Health and Human Services Service Center Administrative Office of the Courts Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Child Support Services Assistance Listing Number: 93.563 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302 and .403; Cooperative Agreement between the State of Maine Department of Health and Human Services (DHHS) and Maine State Judicial Branch for State Fiscal Years 2024 and 2025, Article V, Section B.3 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs must be adequately documented. The State’s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to determine that such funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Administrative Office of the Courts (AOC) must provide a report to the DHHS Division of Support Enforcement and Recovery (DSER) for all Judicial Branch estimated expenditures. This report must detail costs that are eligible for Federal financial participation and must be provided within 60 calendar days after the close of the quarters ending in March, June, September, and December. These estimated expenditures are calculated using the per minute rate that was in effect for the prior fiscal year. By November 30th, the Judicial Branch will update the per minute rate and provide DSER a report with actual expenditures for the State fiscal year. Condition: The Child Support Services (CSS) program is administered by DSER. DHHS has a cooperative agreement with AOC that defines roles, relationships, and responsibilities of the parties, and sets forth a basis for financial reimbursement for court services provided to DHHS by AOC. These services include conducting paternity hearings; hearings to establish, modify, or enforce support orders; civil and criminal complaint hearings related to CSS; providing mediation services; and conducting proceedings related to income withholding responsibilities. AOC sends monthly invoices to the DHHS Service Center (DHHS SC) with estimated costs for work performed for the CSS program. DHHS SC is responsible for transferring funds from the CSS program to AOC on the following schedule: • On a quarterly basis, AOC provides DHHS SC with a reconciliation of estimated costs based on assigned caseload. This quarterly reconciliation utilizes the per minute rate that was in effect for the prior fiscal year and is due 60 days after the close of the quarter. • Annually, the per minute rate is updated and AOC provides DHHS SC with a final report of actual costs with the updated per minute rate. This final report is due by November 30th each year. Upon receipt of the final report, a final payment/reimbursement will be issued to reconcile to actual costs. The Office of the State Auditor (OSA) tested 7 transfers from DHHS SC to AOC and found that costs incurred for court services were not adequately supported, as follows: • DHHS SC did not receive 1 quarterly report from AOC; therefore, court expenditures were based on estimated costs rather than actual costs. • The annual report and reconciliation of estimated costs to actual costs was not complete; AOC updated minutes charged but the actual cost per minute rate was not updated. Therefore, expenditure amounts reported by the CSS program are not based on actual costs and the submitted final report used the estimated cost per minute rate. OSA selected a non-statistical random sample. Context: The CSS program expended $17.7 million in Federal funds during fiscal year 2025, of which $2.7 million was used for court services. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: Since DSER is utilizing the estimated cost per minute instead of the actual cost per minute: • CSS program expenditures could be misstated; and • the State may not be in compliance with State matching requirements of 34 percent of actual costs. Recommendation: We recommend that the Departments strengthen policies and procedures and increase oversight to ensure that the CSS program is in compliance with Federal regulations. Corrective Action Plan: See F-26 Management’s Response: The Departments agree with this finding. The Office of the Courts will strengthen policies, procedures, and oversight to ensure that the Child Support Servies program remains in full compliance with Federal regulations by March 31, 2026. Contact: Jerry Joy, Director, Division of Support Enforcement and Recovery, DHHS, 207-624-6985 (State Number: 25-1128-01)

(2025-051) Title: Internal control over CCDF procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a noncompetitively bid contract. Condition: The Child Care and Development Fund (CCDF) Cluster is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 calendar days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. The Office of the State Auditor (OSA) tested 13 contracts, 3 procured competitively and 10 procured noncompetitively, that accounted for $10.1 million of the $14.4 million in CCDF program procurement- related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OCFS were accurate. • For 11 contracts, DCM provided the PJF to OSPS for their review after the contract had commenced, between 7 and 198 days after the contract start date. For 12 contracts, OSPS approved the PJF after the contract commenced, between 12 and 200 days after the contract start date. • For 3 of the noncompetitive contracts, OSPS posted the NOI after contract performance had commenced, between 12 and 208 days after the contract start date. For all 3 contracts, services had been initiated and financial obligations incurred prior to the NOI. OSA utilized a risk-based approach to select 2 contracts issued by OCFS and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $14.4 million in procurement-related transactions from CCDF funds of $45.1 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OCFS develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by OCFS for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-26 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1114-06)

(2025-049) Title: Internal control over CCDF financial reporting needs improvement Prior Year Findings: See Schedule of findings and Questioned Costs for chart/table State Department: Health and Human Services Administrative and Financial Services State Bureau: Office of Child and Family Services Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 98.50 and .65 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department shall submit financial reports to the Administration for Children & Families (ACF) quarterly for each fiscal year until funds are expended. At a minimum, a state’s quarterly report shall include the following information on expenditures under Child Care and Development Fund (CCDF) grant funds: • Childcare administration • Quality activities, including any sub-categories of quality activities as required by ACF • Direct services for both grant or contracted slots and certificates • Non-direct services, including establishment and maintenance of computerized childcare information systems, certificate program cost/eligibility determination, and all other non-direct services • Such other information as specified Pursuant to CCDF regulations at 45 CFR 98.65(g), and as part of the terms and conditions of the grant award, states and territories are required to complete and submit a quarterly financial status report (ACF-696). The direct services category consists solely of expenditures for childcare subsidies to eligible children. The costs of eligibility determination and re-determination are considered a non-direct service activity and should be reported separately. Non-direct services are the costs of providing childcare subsidies or other activities not considered administrative costs. Condition: The CCDF program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. The program had 3 ongoing Federal grant award years during fiscal year 2025, for grant years 2023, 2024, and 2025. For each grant award, quarterly CCDF ACF-696 financial status reports are required. The Department of Health and Human Services’ Service Center (DHHS SC) prepares and submits quarterly ACF-696 reports on behalf of OCFS. DHHS SC utilizes a spreadsheet designed by OCFS to track and summarize expenditure information and related earmarking requirements, and to prepare the ACF-696 reports. The Office of the State Auditor (OSA) reviewed all quarterly ACF-696 reports required to be filed during fiscal year 2025 and found that in all the required reports filed, the amount reported as direct expenditures included amounts that were not for childcare subsidies. Reported direct expenditures erroneously included non-direct costs related to the establishment of a new computerized childcare information system, costs of eligibility determinations, and costs associated with error rate reporting requirements. In addition, OSA reviewed 1 revised report filed during fiscal year 2025, in response to prior year finding 2024-059, that properly reported direct and indirect amounts on the correct reporting lines. Context: CCDF expenditures totaled $45.1 million for fiscal year 2025. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: Noncompliance with Federal reporting requirements Recommendation: We recommend that the Departments enhance existing procedures and increase oversight to ensure that all information reported on quarterly ACF-696 reports is accurate and complete prior to submission to the Federal government. Corrective Action Plan: See F-25 Management’s Response: The Departments agree with this finding. The DHHS Financial Service Center updated existing procedures and increased oversight to ensure that all information reported on quarterly ACF-696 reports is accurate and complete prior to submission to the Federal government. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 25-1114-03)

(2025-050) Title: Internal control over CCDF provider health and safety requirements needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 98.33, .41, .42, and .68 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to disseminate to the general public, through a consumer-friendly and easily accessible website, results of monitoring and inspection reports for all eligible and licensed childcare providers. Full monitoring and inspection reports must be posted timely. The Department is required to design, implement, and enforce health and safety requirements for the protection of children. Unannounced inspections of childcare providers and facilities, performed by licensing inspectors, are required not less than annually to ensure compliance with all childcare licensing and health and safety standards. In the Child Care and Development Fund (CCDF) State Plan, the Department is required to describe effective internal controls that are in place to ensure program integrity and accountability while maintaining continuity of services. Condition: The CCDF program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. OCFS completes annual childcare provider site visits or licensing inspections for providers receiving subsidies from the CCDF program. During site visits and licensing inspections, OCFS personnel review Federal program health and safety requirements using a provider compliance checklist. Any deficiencies are noted, corrective action by the provider is required, and the frequency of site visits or licensing inspections is increased until remediation of noted deficiencies is complete. The Office of the State Auditor (OSA) tested 60 providers subject to health and safety site visits or licensing inspections and identified: • 1 provider facility inspection was noted in the provider file as complete; however, the completed inspection report was not posted publicly as required. • 2 provider facilities’ annual unannounced site visits did not occur within the required timeframe. OSA selected a non-statistical random sample. Context: The Department provided approximately $26 million to CCDF program childcare providers in fiscal year 2025. Cause: • Lack of resources • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Providers not meeting CCDF program regulations for health and safety may go undetected. Recommendation: We recommend that OCFS enhance oversight to ensure that: • annual childcare provider site visits and licensing inspections are performed timely; and • all inspection reports, including corrective action, are posted publicly. Corrective Action Plan: See F-26 Management’s Response: The Department agrees with this finding. The Department acknowledges that two facilities annual unannounced inspections did not occur within 12 months, being 3 days and 10 days past due. The Department also agrees with the finding that one facility inspection was not posted publicly. Contact: Janet Whitten, CLIS Program Manager, OCFS, DHHS, 207-441-2259 (State Number: 25-1114-02)

(2025-052) Title: Internal control over CCDF eligibility determinations needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 98.21, .100, and .101 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must have procedures in place for verifying eligibility for children receiving Child Care and Development Fund (CCDF) subsidies in accordance with Federal eligibility requirements, as well as the specific eligibility requirements selected by each lead agency in its approved State plan. The Department is required to calculate, prepare, and submit to the Federal government a triennial report of errors occurring in the administration of CCDF grant funds. States must use this report to calculate error rates, which is defined as the percentage of cases with an error, the percentage of cases with an improper payment, the percentage of improper payments, the average amount of improper payment, and the estimated amount of improper payments. Improper payments include any payment of CCDF grant funds to an ineligible recipient or for an ineligible service, any duplicate payment of CCDF grant funds, and payments of CCDF grant funds for services not received. In preparing the error reports, the Department shall conduct comprehensive reviews of case records by selecting a random sample of case records which is estimated to achieve the calculation of an estimated annual amount of improper payments with a 90 percent confidence interval of 5 percent. Condition: The CCDF program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. CCDF provides childcare benefits to parents based on financial and program eligibility factors. Eligibility for benefits is determined based on application information from families through the childcare management system. On a monthly basis, the Department’s Quality Assurance Team performs Quality Control Reviews (QCRs) of a random sample of cases to review eligibility determinations and benefit amounts. The Department tracks error rates of improper payments which are reported to the Federal government on a triennial basis on the ACF-404 State Improper Payments Report. The Department did not perform QCRs in April and May 2025. Context: The Department did not perform 46 of the 276 required QCRs in fiscal year 2025. The Department provided $25.9 million in CCDF provider payments from total CCDF program expenditures of $45.1 million in fiscal year 2025. Cause: • Lack of adequate oversight procedures to ensure monthly QCRs are performed • Lack of resources Effect: • CCDF provider payments may be incorrectly calculated, resulting in households being underpaid and/or overpaid. • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance existing oversight procedures to ensure that eligibility for children receiving CCDF subsidies is in accordance with Federal requirements. This should include confirming that QCRs are performed monthly as required. Corrective Action Plan: See F-27 Management’s Response: The Department agrees with this finding. During the rollout of the Baxter child care management system, a system error prevented the random selection of cases needed for monthly Quality Assurance (QA) audits. As a result, the 46 QA reviews scheduled for May and June 2025 were not completed. The issue was promptly identified, corrected, and normal QA activity resumed in July 2025. The Department would like to note that Maine’s QA process significantly exceeds federal requirements. While federal rules require 276 case reviews over a three‑year cycle, Maine reviews 276 cases annually—totaling approximately 828 over three years. Even with the missed 46 cases, the Department will complete 782 reviews this cycle, remaining well above federal minimums. Contact: Gina Forbes, Child Care Services Program Manager, OCFS, DHHS, 207-592-0865 Auditor’s Concluding Remarks: The Department agrees with the finding but states that “Maine’s QA process significantly exceeds federal requirements. While federal rules require 276 case reviews over a three‑year cycle, Maine reviews 276 cases annually—totaling approximately 828 over three years.” The Department is erroneously referencing ACF-404 reporting requirements rather than the controls they are relying on to ensure compliance over eligibility requirements, which have been documented in the Federally-approved State plan. Since the random sample of QCRs performed by the Department are based on initial eligibility determinations, adequate controls were not in place over initial eligibility determinations made in April and May 2025. The finding remains as stated. (State Number: 25-1114-01)

(2025-053) Title: Internal control over CCDF subrecipient cash management needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. Condition: The Child Care and Development Fund (CCDF) program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. The Department makes equal advance monthly payments to subrecipients and then reconciles those amounts to quarterly financial reports submitted by the subrecipient. This procedure does not consider the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes, and OCFS’ subrecipient monitoring procedures do not include a review of subrecipient compliance with cash management requirements. As a result, OCFS procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Context: OCFS provided $2.8 million from a total of $45.1 million to CCDF program subrecipients during fiscal year 2025. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that OCFS implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the CCDF program. Corrective Action Plan: See F-27 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of the funds. Payments are made as close as is administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1) ...that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Tara Williams, Associate Director of Early Care & Education, OCFS, DHHS, 207-557-2342 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation emphasizes a single sentence from the broader paragraph, omitting context that informs the regulation’s full intent. According to the 2025 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR 200.305(b)(1)). 2 CFR 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. The finding remains as stated. (State Number: 25-1114-04)

(2025-054) Title: Internal control over CCDF subrecipient risk evaluation procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Child Care and Development Fund (CCDF) program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. The CCDF program contracts with subrecipients to administer the First 4 ME Pilot Project, a community-based, coordinated birth through kindergarten entry program which provides comprehensive, high-quality early child care and education to support a child’s school readiness. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal regulations for the purpose of determining the appropriate level of subrecipient monitoring to be performed. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Department provided evidence to support that subrecipient monitoring procedures were performed; however, documentation that risk evaluation procedures performed corresponded to the appropriate level of monitoring activities could not be provided. Context: The Department provided $2.8 million from a total of $45.1 million to CCDF subrecipients during fiscal year 2025. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure that subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-27 Management’s Response: The Department disagrees with this finding. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: John Feeney, Chief Operating Officer, OCFS, DHHS, 207-626-8614 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While the Office of the State Auditor acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 25-1114-05)

(2025-055) Title: Internal control over the Foster Care and Adoption Assistance eligibility and benefit determination process needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Foster Care – Title IV-E Adoption Assistance – Title IV-E Assistance Listing Number: 93.658; 93.659 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 93.658 $51,247 ALN 93.659 $42,689 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of clients who received Title IV-E benefits during fiscal year 2025 and identified known questioned costs associated with 11 clients based on various eligibility attributes. Since each exception is unique to the client, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 1356.21 and .40; 42 USC 671; Department of Health and Human Services (DHHS) 10-148 Chapter 16 Rules Providing for the Licensing of Family Foster Homes for Children; Office for Child and Family Services’ (OCFS) Financial Resource Specialist (FRS) Policy and Procedure Manual The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. 45 CFR 1356.21 outlines eligibility criteria which, if met, allows the State to pay foster care maintenance payments on behalf of eligible children, in accordance with the Title IV-E agency’s foster care maintenance payment rate schedule, to individuals serving as foster family homes, to childcare institutions, or to public or private child-placement or childcare agencies. 45 CFR 1356.40 outlines eligibility criteria which, if met, allows the State to pay a portion of the Federal Adoption Assistance maintenance payments and claim Federal financial participation for the payment. 42 USC 671 requires that prospective foster parents and any other adult living in the home who has resided in the provider home in the preceding 5 years satisfactorily meet a child abuse and neglect registry check. The requirement applies to foster care maintenance payments made on behalf of the foster child. DHHS 10-148 Chapter 16 Rules Providing for the Licensing of Family Foster Homes for Children states that an application may be denied if the applicant(s) have an open Child Protective Services case or a closed substantiated and/or indicated Child Protective Services case. In addition, applications for renewal of a license shall be made 60 days prior to the date of expiration to ensure that necessary licensing procedures may be completed for the continuity of the license. The OCFS FRS Policy and Procedure Manual defines Supplemental Security Income (SSI) as unearned income; documentation to support unearned income includes benefit award letters, copies of checks, child support printouts, Automated Client Eligibility System (ACES) printouts or other documentation. In addition, a child may be eligible for both SSI and Title IV-E. The Department, through an FRS, must make a decision as to which would yield greater financial benefits for the State. Condition: OCFS administers the Foster Care – Title IV-E (Foster Care) and Adoption Assistance – Title IV-E (Adoption Assistance) programs for the State as outlined below: • The Foster Care program is designed to help states provide safe and stable out-of-home care for children under its jurisdiction until the children are returned home safely, placed with adoptive families, or placed in other planned arrangements for permanency. • The Adoption Assistance program provides Federal funds to states to facilitate the timely placement of children, whose special needs or circumstances would otherwise make them difficult to place, with adoptive families. Funds are available for a one-time payment to assist with the costs of adopting a child, as well as for subsidies to adoptive families for the care of the eligible child on an ongoing basis. An FRS determines program eligibility and initiates benefits through completion of a determination checklist. The FRS reviews program eligibility factors, gathers required supporting documentation, and documents the certification decision on the checklist. The FRS enters the information into the child welfare information system for processing. Once the client is determined eligible in the child welfare information system, a level of benefits is assigned. OCFS relies on this information and the related system coding to ensure that benefits are accurately provided to eligible clients. OSA tested 60 initial client eligibility determinations and found 1 client’s prospective foster parent did not satisfactorily meet a child abuse and neglect registry check in accordance with 42 USC 671 and DHHS Rules Providing for the Licensing of Family Foster Homes for Children. The Resource Family Home (RFH) received $12,566 in Federal Foster Care benefits on behalf of 2 clients, resulting in questioned costs of the entire amount. OSA tested 60 Adoption Assistance benefit payments and 60 Foster Care benefit payments, along with the related eligibility determination for those clients, and found: • 5 clients who were placed in a RFH that the foster/adoptive parent did not satisfactorily meet a child abuse and neglect registry check in accordance with 42 USC 671 and DHHS Rules Providing for the Licensing of Family Foster Homes for Children. The RFHs received benefits from both Federal programs on behalf of multiple clients, resulting in questioned costs for the Foster Care and Adoption Assistance programs of $7,629 and $42,689, respectively. • 2 clients determined to be ineligible by OCFS due to a conversion issue within the newly implemented child welfare information system continued to receive Foster Care benefit payments during the fiscal year, resulting in questioned costs of $11,768. • 1 client who received Federal benefits for both Title IV-E and SSI during the fiscal year. OCFS could not provide documentation of their consideration of the SSI documented in ACES, or their decision regarding claiming Title IV-E benefits instead of SSI benefits, resulting in questioned costs for the Foster Care program of $12,687. • 1 client determined ineligible due to an inactive license for 6 months past the initial renewal period, continued to receive Foster Care benefit payments during the fiscal year, resulting in questioned costs for the Foster Care program of $6,447. • 1 client received a one-time payment to adjust Adoption Assistance childcare benefits; however, it was paid out of Foster Care benefits, resulting in questioned costs of $150. OSA selected non-statistical random samples. Context: In fiscal year 2025, the State provided approximately: • 1,000 Foster Care clients with $5.3 million in Federal benefits; and • 4,500 Adoption Assistance clients with $25.5 million in Federal benefits. Identified Cause: • Lack of adequate policies and procedures • Lack of appropriate oversight over eligibility and benefit determinations Potential Effect: • Known questioned costs • Potential future questioned costs and disallowances • Benefits were provided to ineligible clients. • Noncompliance with Federal regulations Recommendation: We recommend that the Department: • implement additional procedures to ensure that payments made on behalf of clients are accurate and allowable in accordance with program regulations; • establish recoupments for the overpayments identified; and • strengthen licensing practices for background screening of potential and current RFHs. Corrective Action Plan: See F-28 Management’s Response: The Department partially agrees with this finding. OCFS disagrees with the condition that child abuse and neglect registry checks for RFH require a denial. According to State of Maine Department of Health and Human Services Chapter 16 Rules Providing for the Licensing of Family Foster Homes for Children: Section 9: Licensing Requirements for Family Foster Homes for Children, Sect A. (9): An application may be denied if the applicant(s) have an open Child Protective Services Case or a closed substantiated and/or indicated Child Protective Services case. An open Child Protective Services Case includes a pending disposition of an open report, a case open for assessment or a case open for services. OCFS also disagrees with the condition that Title IV-E was claimed in error during their foster care placement, since the Social Security Administration (SSA) did not stop SSI payments to the biological parent, and is requiring OCFS to pay back the Title IV-E funding that was received to help pay for the child's care. This is an error of the SSA office that DHHS has no responsibility over. DHHS reports all children removed from their parents’ custody to SSA through a monthly federally required reporting process. SSA would be responsible for taking any action based on that reporting. DHHS does not agree that Maine taxpayers should be penalized for the federal agency's failure to take action and stop benefits to the parent. OCFS agrees to the remaining conditions noting that: Changes were made to the Katahdin system (User story 3002158) that were released on 8/3/2025 to avoid overlapping payments for childcare in both Foster Care and Adoption. Changes were made to the OCFS Licensing policy in July 2025, removing the 60-day time limit on the license renewal process. Contact: Robert Blanchard, Associate Director, OCFS, DHHS, 207-624-7955 Auditor’s Concluding Remarks: Regarding the exceptions related to child abuse and neglect registry checks for RFHs, OCFS is only citing State policy and omitting the Federal requirement (42 USC 671) which states that prospective foster parents and any other adult living in the home who has resided in the provider home in the preceding 5 years satisfactorily meet a child abuse and neglect registry check. For all 5 clients in the Condition, the foster/adoptive parent did not satisfactorily meet a child abuse and neglect registry check; 2 of the 5 clients were subsequently removed from the RFH as a result of the child abuse and neglect registry checks. Regarding the client who received both SSI and Federal Title IV-E benefits, though OCFS states that this exception is SSA’s responsibility, the FRS did not properly identify that the client was receiving SSI benefits when determining Foster Care eligibility. As a result, the FRS did not decide which benefit would yield greater financial benefits for the State, and the client received Federal benefits from both Title IV-E and SSI during fiscal year 2025. The finding remains as stated. (State Number: 25-1109-03)

(2025-056) Title: Internal control over Foster Care level of care assessments needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Foster Care – Title IV-E Assistance Listing Number: 93.658 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 93.658 $3,003 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of clients who received Title IV-E benefits during fiscal year 2025 and identified known questioned costs for 1 client based on various level of care (LOC) requirements. Since each exception is unique to the client, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 45 CFR 1356.21; Department of Health and Human Services 10-148, Chapter 14 Rules for LOC for Foster Homes; Office of Child and Family Services’ (OCFS) Child and Family Services Manual The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Title IV-E agency must review, at reasonable, specific, time-limited periods established by the agency, the amount of payments made for foster care maintenance to assure their continued appropriateness, and the amount made to a licensed or approved relative or kinship foster family home is the same as the amount that would have been made if the child was placed in a licensed or approved non-relative foster family home. Within 90 days of placement in a family foster home or a specialized foster home, an initial child assessment will be done by LOC reviewers to determine the child’s level of need. Initial assessments are conducted on children that are new in care and placed in a resource home and on children that have been previously assessed, have transitioned out of residential care, or have been placed in a resource home. This assessment should be conducted within the first 90 days of placement. Condition: OCFS administers the Foster Care – Title IV-E (Foster Care) program for the State and operates under a Federally-approved plan that requires the agency to perform a periodic review of payment rates for Foster Care maintenance payments to ensure the rates remain appropriate. Maintenance payments are issued based on the number of days in a bi-weekly period a child remains in placement. The payment amounts are established by State regulations but vary by the LOC needed for a child. The 2 types of foster homes where a child can be placed are: • a resource home for basic needs. The 2 LOCs are Levels A and B. LOC Level A receives the entry reimbursement rate and Level B receives an increased rate based on the child’s level of need. • a treatment foster care home. The 3 applicable LOCs are Levels C, D, and E. LOC Level C receives the entry reimbursement rate and Levels D and E receive increased rates based on the child’s level of need. OCFS’ schedule for periodic review is as follows: • All LOC levels require an initial 90-day assessment; • LOC Level A children remain at that level until an event triggers a review, or a request for reassessment is made; • LOC Level B children require a reassessment every 12 months; and • LOC Levels C, D, or E children require a reassessment every 6 months. OSA tested 60 cases with Foster Care maintenance payments and found: • 36 clients did not have an initial LOC assessment within 90 days of placement. Initial LOC assessments ranged from 11 to 302 days past the 90-day requirement. • 3 clients did not have an annual reassessment conducted as required for Level B. • 2 clients did not have a 6-month reassessment conducted as required for Levels C, D, and E. • 1 client’s LOC assessment was automatically adjusted by the child welfare information system from a Level A to a Level B, based on draft policies and procedures that have not been formally approved and implemented, resulting in questioned costs of $3,003 for fiscal year 2025. • 1 client’s LOC assessment was not approved by the LOC manager. OSA selected a non-statistical random sample. Context: The Department provided approximately 1,000 Foster Care clients with $5.3 million in Federal maintenance payments in fiscal year 2025. Cause: • Lack of adequate policies and procedures • Lack of resources • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Inaccurate client benefit payments • Noncompliance with Federal regulations Recommendation: We recommend that the Department allocate resources and enhance policies, procedures, and oversight to ensure LOC assessments are performed in accordance with the Federally-approved schedule for LOC assessments. Corrective Action Plan: See F-23 Management’s Response: The Department agrees with this finding. The Office of Child and Family Services has developed and will implement a corrective action plan to address the issues identified. Contact: Robert Blanchard, Associate Director, OCFS, DHHS, 207-624-7955 (State Number: 25-1109-02)

(2025-057) Title: Internal control over Foster Care procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Foster Care – Title IV-E Assistance Listing Number: 93.658 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a noncompetitively bid contract. Condition: The Foster Care – Title IV-E (Foster Care) program is designed to help states provide safe and stable out-of-home care for children under its jurisdiction until the children are returned home safely, placed with adoptive families, or placed in other planned arrangements for permanency. The Foster Care program is administered by the Office of Child and Family Services (OCFS). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 calendar days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. The Office of the State Auditor (OSA) tested 4 contracts, 1 procured competitively and 3 procured noncompetitively, that accounted for approximately $4 million of the $4.6 million in Foster Care program procurement-related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OCFS were accurate. • For 1 contract, DCM provided the PJF to OSPS for their review after the contract had commenced, 38 days after the contract start date. For all 4 contracts, OSPS approved the PJF after the contract commenced, between 25 and 60 days after the contract start date. • For 1 of the noncompetitive contracts, OSPS posted the NOI after contract performance had commenced, 40 days after the contract start date. For this contract, services had been initiated and financial obligations incurred prior to the NOI. OSA utilized a risk-based approach to select 2 contracts issued by OCFS and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $4.6 million in procurement-related transactions from Foster Care funds of approximately $12 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OCFS develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by OCFS for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-28 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1109-04)

(2025-059) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Active Plan: See F-29 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-1109-05)

(2025-058) Title: Internal control over Foster Care and Adoption Assistance cash management needs improvement Prior Year Findings: None State Department: Health and Human Services Administrative and Financial Services State Bureau: Office of Child and Family Services Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Foster Care – Title IV-E Adoption Assistance – Title IV-E Assistance Listing Number: 93.658; 93.659 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and other assets related to the Federally-funded activities. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as administratively feasible to the Department’s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than 7 business days. Condition: The Office of Child and Family Services administers the Foster Care – Title IV-E (Foster Care) and Adoption Assistance – Title IV-E (Adoption Assistance) programs for the State. The programs are designed to help states provide safe and stable out-of-home care for children under its jurisdiction until the children are returned home safely, placed with adoptive families, or placed in other planned arrangements for permanency. The Department of Health and Human Services’ Service Center (DHHS SC) is responsible for the drawdown of Federal funds and grant accounting and reporting for the Foster Care and Adoption Assistance programs. Though DHHS SC monitors compliance with Federal cash management requirements by utilizing a cash on hand analysis, the analysis combines the following Title IV-E programs: • Foster Care • Adoption Assistance • Title IV-E Prevention Program • Guardianship Assistance As a result, Department procedures do not ensure that each individual program is in compliance with Federal cash management requirements. The Office of the State Auditor performed individual analyses for the Foster Care and Adoption Assistance programs and determined that both programs complied with cash management requirements for fiscal year 2025. Context: In fiscal year 2025, there were: • 52 Federal grant drawdowns totaling $21.5 million for the Foster Care program. • 50 Federal grant drawdowns totaling approximately $35 million for the Adoption Assistance program. Cause: • Lack of adequate procedures to ensure that the cash balance for each Title IV-E program is considered separately before requesting Federal funds • Lack of supervisory oversight Effect: Department policies and procedures would not identify noncompliance with cash management requirements, which could result in: • the Federal government imposing more stringent program-specific cash management requirements based on noncompliance. • the State incurring an interest liability on excess Federal cash balances. • noncompliance with Federal regulations. Recommendation: We recommend that the Department enhance existing procedures and increase oversight to ensure that Federal program cash balances are tracked by program in accordance with Federal requirements. Corrective Action Plan: See F-29 Management’s Response: The Departments agree with this finding. The DHHS Financial Service Center will update existing procedures and increase oversight to ensure that Federal program cash balances are tracked by program in accordance with Federal requirements by 3/31/2026. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 25-1109-01)

(2025-060) Title: Internal control over the Adoption Assistance – Title IV-E eligibility and benefit determination process needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Adoption Assistance – Title IV-E Assistance Listing Number: 93.659 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned costs Known Questioned Costs: $1,645 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of clients who received Title IV-E benefits during fiscal year 2025 and identified known questioned costs for 1 client based on various eligibility attributes. Since each exception is unique to the client, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 1356.40 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The State is allowed to pay a portion of the Federal Adoption Assistance maintenance payments and claim Federal financial participation for Title IV-E eligible clients. Condition: The Adoption Assistance – Title IV-E (Adoption Assistance) program provides Federal funds to states to facilitate the timely placement of children, whose special needs or circumstances would otherwise make them difficult to place, with adoptive families. Funds are available for a one-time payment to assist with the costs of adopting a child as well as for subsidies to adoptive families to assist with the care of the eligible child on an ongoing basis. The Office of Child and Family Services (OCFS) administers the Adoption Assistance program for the State. OCFS financial resource specialists (FRS) are responsible for determining program eligibility and initiating benefits. The FRS uses the Adoption Assistance Checklist to ensure that program eligibility factors, required supporting information, and final determination for Federal Adoption Assistance benefits are obtained and documented. Once the client is determined eligible in the child welfare information system, a daily rate is negotiated by OCFS and the adoptive parents at a rate that does not exceed what the client would qualify for under the Foster Care – Title IV-E program. OSA tested 60 client benefit payments and identified that: • 1 adoptive parent continued to receive Adoption Assistance maintenance payments after OCFS was informed that the client moved out of the home. In addition, the client’s clothing allowance payment was erroneously sent to the individual they were living with at the time of issuance instead of the adoption placement. The client received a daily Adoption Assistance rate of $26.25, resulting in questioned costs of $1,645 during fiscal year 2025. • 1 client, who was eligible for Adoption Assistance, erroneously received a State-funded Foster Care childcare payment while also receiving Federally-funded Adoption Assistance childcare payments during fiscal year 2025. • 1 client, who was eligible for Adoption Assistance, erroneously received 2 weeks of State-funded Foster Care maintenance payments while also receiving Federally-funded Adoption Assistance maintenance payments during fiscal year 2025. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the State provided approximately 4,500 Adoption Assistance clients with $25.5 million in Federal benefits. Cause: • Lack of adequate policies and procedures over verification and accuracy of benefit determinations and associated Adoption Assistance payments • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal and State regulations Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure the accuracy of eligibility and benefit determinations, and verify that benefit payments are made in accordance with Federal regulations. Corrective Action Plan: See F-29 Management’s Response: The Department agrees with this finding. The Department will develop training information for distribution to child welfare staff defining steps for them to take when they discover that a child in an adoption assistance agreement is no longer receiving support from the adoptive parents. These steps will raise the information to the OCFS Adoption Unit Manager's attention so they can take appropriate actions. Contact: Denise Merrill, Manager of Child Welfare Statewide Programs, DHHS, 207-822-2255 (State Number: 25-1110-01)

(2025-061) Title: Internal control over Medicaid Nursing Facility audits needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Division of Audit Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 447.253(g); MaineCare Benefits Manual, Chapter III, Section 67 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to provide for the periodic audits of the financial and statistical records of participating providers. The MaineCare Benefits Manual (MCBM) Chapter III, Section 67 outlines the documentation and support required to be included in a provider’s annual cost report filing submission to the Division of Audit. The Division of Audit’s requirements for reviewing the cost reports and performing uniform desk reviews is also outlined. Section 67 states that the Division of Audit must perform a uniform desk review on each Nursing Facility (NF) cost report submission within 365 days of receipt of an acceptable cost report filing. Condition: For each participating Long Term Care Facility, the Department must provide for the filing of uniform cost reports in order to establish payment rates and must provide for the periodic audits of financial and statistical records. The specific audit requirements will be established by the State plan. The MCBM states uniform desk reviews shall be completed within 365 days after receipt of an acceptable cost report filing, including financial statements and other information requested from the provider, except in unusual situations including, but not limited to, delays in obtaining necessary information from a provider. Unless the Division of Audit intends to schedule an on-site audit or an unusual situation referenced above exists, a written summary report of findings and adjustments shall be issued upon completion of the uniform desk review. The Division of Audit did not complete NF audits in accordance with Federal regulations. The population of NF uniform desk reviews due for completion in fiscal year 2025 was 88. Of those 88 uniform desk reviews, none were completed at the time of audit testing in October 2025. Context: During fiscal year 2025, the Department: • provided $270.4 million in Federal Medicaid funding and $112.0 million in State Medicaid funding to NFs. • completed 61 NF uniform desk reviews related to prior fiscal years. Cause: Lack of resources Effect: • Noncompliance with Federal and State regulations • The determination of amounts owed to or from NFs is delayed. Recommendation: We recommend that the Department reallocate resources to address the backlog of NF uniform desk reviews. Timely audit issuance will minimize the impact on providers of potential payables and receivables. Corrective Action Plan: See F-30 Management’s Response: The Department agrees with this finding. Progress toward compliance is taking longer than expected due to continued difficulty in hiring staff and the completion of COVID related audit work. The COVID audit work is still hindering the audit process. However, recent changes to the Nursing Facility reimbursement methodology, effective January 1, 2025, reduce the amount of testing required in these audits. Contact: Herb Downs, Director, Division of Audit, DHHS, 207-287-2403 (State Number: 25-1106-01)

(2025-065) Title: Internal control over Medicaid procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a noncompetitively bid contract. Condition: The Medicaid program is administered by the Office of MaineCare Services (OMS). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 calendar days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. The Office of the State Auditor (OSA) tested 26 contracts, 6 procured competitively and 20 procured noncompetitively, that accounted for $42.8 million of the $91.3 million in Medicaid procurement-related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OMS were accurate. • For 18 contracts, DCM provided the PJF to OSPS for their review after the contract had commenced, between 5 and 152 days after the contract start date. For 18 contracts, OSPS approved the PJF after the contract commenced, between 7 and 182 days after the contract start date. For 2 contracts, documentary evidence of PJF approval by OSPS could not be provided. • For 9 noncompetitive contracts, OSPS posted the NOI after contract performance had commenced, between 7 and 169 days after the contract start date. For 7 of these contracts, services had been initiated and financial obligations incurred prior to the NOI. OSA utilized a risk-based approach to select 6 contracts issued by OMS and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $91.3 million in procurement-related transactions from Medicaid funds of $3.4 billion. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OMS develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by OMS for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-32 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1106-06)

(2025-062) Title: Internal control over Medicaid drug rebates needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; Section 1927 of the Social Security Act (42 USC 1396r-8) The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Section 1927 of the Social Security Act requires manufacturers that wish to have their outpatient drugs covered by Medicaid to enter into an agreement with the Centers for Medicare & Medicaid Services (CMS), under which the manufacturers agree to pay rebates for drugs dispensed and paid for by the State Medicaid agencies under the State plan. Drug rebates are shared between the State and Federal government. Condition: Drug manufacturers are required to submit a list of all covered outpatient drugs, along with each drug’s average manufacturer price and “best price” to CMS. Utilizing this information, CMS calculates a unit rebate amount (URA) for each covered outpatient drug and provides the amounts to the State on a quarterly basis. The Department is required to maintain drug utilization data that identifies, by National Drug Code (NDC), the number of units of each covered outpatient drug for which the Department has paid pharmacy providers. The utilization data is provided to CMS and the manufacturers. The number of dispensed units is applied to the URA to determine the rebate amount due from each manufacturer. The State contracts with a vendor to calculate the drug rebate amounts and invoice manufacturers for drug rebates. The Office of the State Auditor (OSA) identified that the Department does not have adequate procedures in place to ensure the accuracy and completeness of the drug rebate amounts invoiced by the vendor. Audit procedures identified that: • prior to issuing invoices, the Department reviews a sample of 10 invoices to ensure the drugs are rebatable and accurately calculated; however, the invoices are judgmentally selected and not based on risk. • though the Department reviews invoiced drug rebates for reasonableness, this review is performed at a summary level and after the invoicing cycle. Context: In fiscal year 2025, the State invoiced approximately $300 million for rebatable drugs. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Inaccurate or incomplete invoicing of drug rebates would result in overpayments or underpayments to the State and Federal government. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement procedures to confirm the drug rebate amounts calculated and invoiced by the vendor are accurate and complete. These procedures should occur prior to issuing invoices and provide adequate coverage of the drug rebates invoiced, including: • validating that only rebatable drugs are invoiced; • verifying that all rebatable drugs are included for invoicing; • comparing drug utilization data to the number of dispensed units invoiced; and • corroborating the correct URA is applied to each NDC. This will ensure that correct drug rebate amounts are returned to the State and Federal government. Corrective Action Plan: See F-30 Management’s Response: The Department disagrees with this finding. Drug Rebate pre-invoicing and post-invoicing is completed quarterly. As demonstrated during walkthroughs and during our meetings Maine completes specific tasks to ensure accuracy of the invoicing process. The pre-invoicing and post-invoicing procedures are documented in the Pharmacy Rebate Information Management System (PRIMS) Desk Level Procedure (DLP). The pre-invoicing work is performed by the State that compares drug utilization data to the number of dispensed units invoiced. Upon the completion of the pre-invoicing review approval is provided to the vendor allowing them to continue with the invoicing process. There is no requirement on how we select our sample of invoices to review. Based on OSA noting no exceptions to the drug rebate amounts, our system in place to review invoiced drug rebates is functioning as intended. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 Auditor’s Concluding Remarks: The procedures mentioned in Management’s Response only address whether the drug rebate information presented by the vendor for invoicing by the Department is reasonable. The Department’s procedures do not independently substantiate that all rebatable drugs are included for invoicing. Furthermore, the existing invoice review procedures address only a limited number of invoices and dispensed units, are performed at a summary level and do not consider risk factors. As a result, the Department does not have adequate assurance that all rebatable drugs are invoiced accurately and completely. The finding remains as stated. (State Number: 25-1106-05)

(2025-063) Title: Internal control over Medicaid SEFA reporting needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must include the total amount provided to subrecipients from each Federal program. Condition: The Department of Health and Human Services’ Service Center must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State’s SEFA. OSC is responsible for compiling this information on behalf of the State. The Office of the State Auditor reviewed amounts reported on the SEFA and identified $11.8 million of Federal expenditures incorrectly reported as amounts provided to subrecipients that should have been reported as direct expenditures. OSC subsequently corrected the SEFA. Context: In fiscal year 2025, Federal Medicaid expenditures totaled $3.4 billion. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department implement policies and procedures to ensure expenditures are appropriately classified and reported on the SEFA. Corrective Action Plan: See F-31 Management’s Response: The DHHS and the DHHS Financial Service Center agree with this finding. The DHHS Financial Service Center will update policies and procedures to ensure expenditures are appropriately classified and reported on the SEFA by February 2026. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 25-1106-03)

(2025-064) Title: Internal control over Medicaid utilization control needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 456.3 and .23 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Utilization control requirements are applicable to all services provided under a State plan. The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that provides for the oversight and monitoring of all services provided under the State plan, including procedures for ongoing post-payment review of all Medicaid services. The post-payment review must identify exceptions so that the SMA can correct misutilization practices of beneficiaries and providers on a timely basis. Condition: The Department’s Office of MaineCare Services’ Program Integrity Unit (PIU) is responsible for implementing and monitoring the State’s Medicaid utilization control (UC) program. A Medicaid UC program is a State-mandated, Federally-required system that monitors and manages the appropriateness, quality, and necessity of all medical services, and includes a sampling plan and post-payment review process designed to provide an ongoing evaluation of Medicaid beneficiaries and providers. PIU’s UC program includes a monthly sampling plan that relies on various data analytics. The results of the data analytics are reviewed to determine the extent of beneficiary or provider post-payment reviews. The Office of the State Auditor (OSA) reviewed PIU’s policies and procedures, the monthly sampling plan, and a selection of post-payment review files, and performed data analytics to determine the appropriateness of the design and implementation of the UC program. PIU could not provide documentation of the methodology used to identify projects and post-payment reviews performed in relation to surveillance of all Medicaid services provided under the State plan. Additionally, a sampling plan relying on data analytics as a source of post-payment review limits the scope of the UC program to only what can be identified through data anomalies. PIU’s sampling plan does not document consideration of misutilization practices of beneficiaries or providers. As a result, OSA could not determine the completeness of the UC program. Context: In fiscal year 2025, the State paid $3.2 billion to approximately 10,600 providers, including $2.5 billion in Federal funds. Cause: Lack of adequate policies and procedures Effect: PIU’s UC program may not provide adequate monitoring of all Medicaid services, resulting in potential noncompliance with Federal regulations. Recommendation: We recommend that the Department document policies and procedures to ensure that PIU’s UC program is designed to provide ongoing monitoring and evaluation of all Medicaid services provided under the State plan, and that documentation to support the extent of such monitoring is properly maintained. Corrective Action Plan: See F-31 Management’s Response: The Department disagrees with this finding. This finding represents a misunderstanding of the applicable federal regulations and the state entity responsible for compliance. A Utilization Control (UC) program is the responsibility of the State Medicaid Agency as a whole, not the Program Integrity Unit (PIU). Additionally, there are many more federal regulations governing UC programs than cited by the Office of State Auditor (OSA) in the finding and touch on a host of controls that were not reviewed or considered in this audit. Moreover, the OSA appears to be basing findings on interpretations that are unsupported by the regulatory text cited. Second, the OSA confuses PIU's annual review plan (a yearly plan of focused program integrity areas of focus and review) with an agency-wide UC program: these are not the same, nor are they required to be. The Department's current processes for PIU's annual review plan were implemented in response to OSA findings in 2015 relating to an OSA finding that the Department was not fully utilizing available data analytics. In the intervening years, the OSA has not found Program Integrity's annual review plan, or the process of developing the plan, to be deficient. There has been no change in the Department's process or the regulation to justify the OSA's newly found position here. The OSA's criticism of PIU's use of data analytics contradicts a prior OSA findings on data analytics use, is contrary to accepted Department adjustments made in response, and represents a significant departure from federal guidance and industry standards around best practices for leveraging data analytics to prevent and detect improper payments and/or utilization. The PIU's annual review plan supplements post-payment reviews that PIU conducts based upon complaints and referrals. Finally, this finding’s singular focus on PIU's annual review plan fails to account for a myriad of other systems and processes the Department has in place to monitor utilization, including, but not limited to: 1. A contracted vendor (HMS) performing post-payment reviews of hospitals, nursing facilities, and other long-term care facilities; 2. MaineCare's Case Mix unit - performing look back reviews of documentation and services in nursing facilities and other long-term care units; 3. A contracted vendor (Acentra) reviewing authorization requests for behavioral health services and continuing stay reviews of services at designated intervals; 4. A contracted vendor (Maximus) that performs assessments and authorizations for nursing and personal care services; 5. A contracted vendor (Optum) that performs prior authorization reviews for pharmacy services and produces a variety of reports on drug utilization; 6. Fiscal intermediaries performing oversight and administrative support for self-directed services; 7. State staff who review and approve plans of care for Home and Community Based Waiver Services and conduct quality reviews of providers; 8. State staff performing quality assurance reviews of providers of mental and behavioral health services; 9. State staff monitoring and addressing inappropriate emergency department usage by beneficiaries; and 10. State staff with oversight and performing qualitative and quantitative reviews of a variety of programs operated under delivery service reform, including: Accountable Communities, Behavioral Health Homes, Certified Community Behavioral Health Clinics, Community Care Teams, MaineMOM, Opioid Health Homes, and Primary Care Plus. 11. State and contracted vendor (Gainwell) staff reviewing medical necessity and other allowability for medical services requiring prior authorization for initial requests and renewals. 12. A CMS-compliant Electronic Visit Verification (EVV) system, in accordance with Section 12006 of the 21st Century Cures Act, that ensures payment for applicable services is tied to an EVV record demonstrating that the service occurred; data from the system also contributes to post-payment reviews for applicable services. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 Auditor’s Concluding Remarks: PIU’s Policy and Procedure Handbook identifies PIU as the office responsible for ensuring the Medicaid program is in compliance with 42 CFR 456.3 and .23; these Federal requirements reference procedures that directly correlate to the data analysis and post-payment review processes performed by PIU. In response to the Department’s criticism of OSA’s approach, OSA develops an audit plan annually, independent of prior year audit procedures or results, in response to risks affecting each audit. In fiscal year 2025, OSA’s procedures performed over UC requirements were tailored in response to identified risks and should not be designed to support audit results from prior years; those procedures identified a population of Medicaid providers that PIU could not provide documentation to support monitoring had been performed. These providers and services do not appear to be included in the “other systems and processes” listed in Management’s Response. The finding remains as stated. (State Number: 25-1106-04)

(2025-066) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Active Plan: See F-33 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-0900-02)

(2025-067) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Active Plan: See F-33 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-0900-03)

(2025-068) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Active Plan: See F-34 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-0900-04)

(2025-069) Title: Internal control over DG – PA program special reporting needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) System for Award Management (SAM). Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient of the Disaster Grants – Public Assistance (DG – PA) program, Maine Emergency Management Agency (MEMA) must collect and enter data into SAM. The Office of the State Auditor (OSA) tested 60 DG – PA program subawards totaling $16,759,534 that exceeded the first-tier subaward threshold. Federal regulations require the following information for identified noncompliance to be included in FFATA findings: • 11 subawards totaling $4,106,246 were not reported; • 60 subawards totaling $16,759,534 were not reported timely; • 10 subaward amounts were reported incorrectly; and • 49 subawards reported incorrect key data elements. OSA selected a non-statistical random sample. Context: In fiscal year 2025, MEMA was required to report 574 first-tier subawards totaling $135.6 million under the DG – PA program. First-tier subawards account for 84 percent of the program’s fiscal year 2025 expenditures. Cause: Lack of resources Effect: • Noncompliance with Federal regulations • Accurate first-tier subaward information for the DG – PA program was not reported to the Federal government timely and included inaccurate or incomplete information. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department allocate resources to ensure that first-tier subawards are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. Corrective action was implemented beginning in November of 2025. Untimely or missing reports were primarily due to staff turnover in the agency, which has been remedied by successful recruitment efforts. Incorrect data elements were attributed to an ineffective element of the prior reporting process, which increased the reporting burden by tasking staff with creating ad-hoc unique identifiers rather than using existing unique identifiers. In the monthly reporting process since November 2025, federally assigned project numbers are used to distinctly identify each subaward, and reporting personnel retrieve obligation reports directly from the relevant federal system, minimizing the overall staff burden in reporting. Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-03)

(2025-070) Title: Internal control over DG – PA program financial reporting needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with reporting requirements. Condition: The Maine Emergency Management Agency (MEMA) administers the Disaster Grants – Public Assistance (DG – PA) program for the State. MEMA is required to submit quarterly DG – PA program Federal Financial Reports (FFRs) to the Federal Emergency Management Agency (FEMA) Regional Office. FFRs provide FEMA with the status of funds for the award, Federal expenditures, and cost-sharing requirements. The Office of the State Auditor (OSA) tested 7 FFRs due in fiscal year 2025 and found deficiencies in 6, as follows: • 1 FFR inaccurately reported total Federal funds authorized as $442,026,321 when the correct total was $442,015,638, and the recipient share of expenditures as $19,499,834 when the correct share was $7,338,371; • 1 FFR inaccurately reported total Federal funds authorized as $16,582,190 when the correct total was $16,560,302, and the recipient share of expenditures as $13,249,493 when the correct share was $5,367,072; • 1 FFR inaccurately reported total Federal funds authorized as $17,805,320 when the correct total was $17,142,335; • 1 FFR inaccurately reported the recipient share of expenditures as $13,077,332 when the correct share was $13,081,295; • 1 FFR inaccurately reported the recipient share of expenditures as $4,698,599 when the correct share was $3,893,046; and • 1 FFR inaccurately reported the recipient share of expenditures as $778,776 when the correct share was $199,157. OSA selected a non-statistical random sample. Context: During fiscal year 2025, 45 FFRs were required to be filed by MEMA for the DG – PA program. Cause: • Lack of adequate policies and procedures to ensure data used for financial reporting is complete and accurate • Lack of supervisory oversight Effect: • Noncompliance with Federal reporting requirements • Inaccurate tracking of subawards may result in noncompliance with Federal matching requirements. Recommendation: We recommend that MEMA enhance policies and procedures to ensure that FFRs are accurate and include all required information for compliance with Federal reporting requirements. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. The Department will publish and implement a revised Federal Financial Reporting procedure to fully preserve reporting/validation source material and clearly document the justification for any variances from the source material. Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-04)

(2025-071) Title: Internal control over DG – PA program subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 2 CFR 200.521 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow up and ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. The Department must issue a management decision for audit findings that relate to Federal awards provided to the subrecipient within 6 months of acceptance of the audit report by the Federal Audit Clearinghouse (FAC). Condition: The Maine Emergency Management Agency (MEMA) administers the Disaster Grants – Public Assistance (DG – PA) program for the State. MEMA is required to verify and document that Single Audits have been completed in the FAC and issue a management decision for audit findings related to awards to subrecipients. The Office of the State Auditor (OSA) tested 4 DG – PA program subrecipients subject to Single Audit requirements and found that documentation of review for 2 subrecipients could not be provided. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department expended $160.5 million in DG – PA program funds, of which $154.6 million was provided to 27 subrecipients. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients not complying with Federal statutes, regulations, or the terms and conditions of subawards may not be implementing appropriate corrective action in response to audit findings. Recommendation: We recommend that the Department enhance policies and procedures to ensure that adequate documentation is maintained and that subrecipient audits are received, reviewed, and appropriate action is taken in response to audit findings. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. The Department will publish and implement an updated subrecipient monitoring procedure to require more extensive and narrative documentation of the single audit review process, including: - a list of subrecipients required to file a single audit report for a given audit year - whether or not an audit had been filed as of the review date - analysis of audit findings as relevant - summary of required actions per the subrecipient monitoring procedure, and/or updates on actions/communications since the prior review period as relevant Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-05)