Audit 395248

Reference Number: 2025-002 Prior Year Finding: No Federal Agency: U.S. Department Agriculture State Department Name: Department of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 202424N109941 (10/1/2023 – 1/30/2025) 202424L160341 (10/1/2023 – 1/30/2025) 202525N109941 (10/1/2024 – 1/28/2026) 202522L160341 (10/1/2024 – 1/28/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Department of Education (Department) did not report subaward information in accordance with FFATA requirements. Context Five of five subawards selected for testing were not reported per FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause The Department’s policies and procedures were not sufficient to ensure that required subaward information was reported accurately to FSRS no later than the end of the month following the date the subaward was issued. Internal controls did not prevent or detect the errors. Effect Subawards were not reported in accordance with FFATA requirements. Questioned costs None noted. Recommendation We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials The Department will revise and strengthen our policies and procedures to ensure full compliance with FFATA reporting requirements. Updated procedures will require that all applicable child nutrition subawards of $30,000 or more are reported in SAM.gov no later than the end of the month following the month in which the subaward is made, in accordance with Uniform Grant Guidance.

Reference Number: 2025-003 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Public Health Federal Program: WIC Special Supplemental Nutrition Program for Women, Infants, and Children Assistance Listing Number: 10.557 Award Number and Year: 241DE701W1003 (10/1/2023 – 9/30/2024) 251DE701W1003 (10/1/2024 – 9/30/2025) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Public Health (Division) did not have evidence of timely supervisory review and approval of employee timesheets. Context One of forty timesheets selected for testing was not certified timely by a program supervisor. The timesheet was certified several months after the end of the pay period. Questioned Costs None noted. Cause The Division’s controls are not sufficient to ensure that time and effort reporting is performed and documented in a timely manner, in accordance with federal requirements. Effect There is an increased risk of charging unallowed payroll costs to the program. Recommendation The Division should enhance procedures, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials On March 12, 2026, an email to all WIC supervisors was issued notifying the dates that all T&E reports are due to the Administration Office. The policy was reiterated during the March 17,2026 Supervisors meeting held via Zoom.

Reference Number: 2025-004 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Public Health Federal Program: WIC Special Supplemental Nutrition Program for Women, Infants, and Children Assistance Listing Number: 10.557 Award Number and Year: 241DE701W1003 (10/1/2023 – 9/30/2024) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Public Health (Division) did not have evidence of supervisory review and approval of a drawdown request. Context One of seventeen drawdown requests selected for testing did not have evidence of review and approval prior to submission. Questioned Costs None noted. Cause The Division’s controls are not sufficient to ensure that drawdown requests are reviewed and approved prior to submission in accordance with federal requirements. Effect There is an increased risk of an undetected error in a drawdown request to occur. The Division could be out of compliance with CMIA requirements. Recommendation The Division should enhance procedures and controls to ensure that drawdown requests are reviewed and approved prior to submission. Views of Responsible Officials The Division confirmed the drawdown transaction was accurate and appropriate. The Division reiterated the Cash Management procedure to all staff and confirmed their understanding. In addition, the Division has in place a review process for new staff regarding procedures with confirmation of completion. There is an established training manual which has been reviewed to ensure it contains the most update to date process. Manuals and procedures will be reviewed regularly and updated, as needed.

Reference Number: 2025-005 Prior Year Finding: 2024-005 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70% of cases must be completed within 60 days of the week ending date of the batch; • 95% of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98% of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) did not conduct weekly BAM investigations nor complete case investigations within the requirements established in the ET Handbook No. 395. Context Nine weekly batches were selected for testing BAM investigations. For seven of nine weeks selected, the Division did not perform the required number of investigations. Eighty-five paid cases were selected for testing case review timeliness. The Division did not meet the required time limits for closing cases within 60, 90, or 120 days. Specifically, we noted the following exceptions: • 1% of cases tested were closed within 60 days which is less than the required 70%. • 13% of cases tested were closed within 90 days which is less than the required 95%. • 86% of cases tested were closed within 120 days which is less than the required 98%. • The remaining 14% of cases tested were closed in greater than 120 days. Fifty-four denied cases were selected for testing case review timeliness. The Division did not meet the required time limits for closing cases within 60, 90, or 120 days. Specifically, we noted the following exceptions: • 6% of cases tested were closed within 60 days which is less than the required 70%. • 11% of cases tested were closed within 90 days which is less than the required 95%. • 83% of cases tested were closed within 120 days which is less than the required 98%. • The remaining 17% of cases tested were closed in greater than 120 days. Thirty-three separation cases were selected for testing case review timeliness. The Division did not meet the required time limits for closing cases within 60, 90, or 120 days. Specifically, we noted the following exceptions: • 0% of cases tested were closed within 60 days which is less than the required 70%. • 15% of cases tested were closed within 90 days which is less than the required 95%. • 85% of cases tested were closed within 120 days which is less than the required 98%. • The remaining 15% of cases tested were closed in greater than 120 days. Twenty-eight nonseparation cases were selected for testing case review timeliness. The Division did not meet the required time limits for closing cases within 60, 90, or 120 days. Specifically, we noted the following exceptions: • 4% of cases tested were closed within 60 days which is less than the required 70%. • 21% of cases tested were closed within 90 days which is less than the required 95%. • 75% of cases 2ested were closed within 120 days which is less than the required 98%. • The remaining 15% of cases tested were closed in greater than 120 days. Questioned Costs Undetermined. Cause The Division experienced staffing shortages and other pressures which impacted its ability to meet BAM requirements for weekly claim investigations and time limits for closing cases. Effect Noncompliance with BAM weekly claim investigations and time limits for closing cases could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation We recommend the Division review and enhance procedures and controls to ensure that it performs weekly claim investigations and that case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395. Views of Responsible Officials The Division of Unemployment Insurance (Division) acknowledges the finding and agrees that improvements are necessary to ensure full compliance with Benefits Accuracy Measurement (BAM) program requirements. The Division recognizes the importance of conducting weekly investigations and adhering to established timeliness standards to maintain the integrity and accuracy of unemployment insurance benefit payments and denied claims. The Division notes that the identified deficiencies were primarily due to significant staffing shortages and competing operational demands, which were further exacerbated by the sustained workload associated with pandemic-related programs. These challenges affected the Division’s capacity to complete the required number of weekly investigations and to meet prescribed case completion timeframes. To address these issues, the Division has taken and will continue to take corrective actions, including: · Actively recruiting and onboarding additional staff dedicated to BAM operations. · Providing enhanced training to ensure staff are equipped to conduct timely and thorough investigations. · Implementing improved case management and tracking mechanisms to monitor timeliness and workload distribution. · Evaluating internal processes to identify efficiencies and reduce delays in case completion. The Division is committed to strengthening internal controls and ensuring compliance with federal requirements. Management will continue to monitor progress and take additional corrective actions as necessary to meet BAM performance standards moving forward.

Reference Number: 2025-006 Prior Year Finding: 2024-007 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Reporting – ETA 2208A, Quarterly UI Above-Base Report Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: ETA 2208A, Quarterly UI Above-Base Report (OMB No. 1205-0132) – Quarterly report of staff years worked and paid by program category. Reports are due no later than 30 days after the end of each quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) was unable to provide supporting documentation for expenditures reported in the ETA 2208A – Quarterly UI Above-Base Report. Context The September 30, 2024 and March 31, 2025 quarterly ETA 2208A reports were selected for testing and the Division was unable to provide supporting documentation for the September 30, 2024 ETA 2208A report. Questioned Costs Undetermined. Cause The Division’s internal controls were not sufficient to ensure that it maintained supporting documentation for quarterly ETA 2208A reports. Effect Auditors were unable to verify that the ETA 2208A reports submitted by the Division were accurate and agreed to supporting documentation. Recommendation The Division should review and update its reporting internal controls to ensure that ETA 2208A – Quarterly UI Above-Base Reports tie to supporting documentation and that supporting documentation is retained and readily available for audit. Views of Responsible Officials We acknowledge the audit finding that the Division was unable to provide supporting documentation for QE 09/30/2024 ETA 2208A report. Procedures have been implemented to ensure documentation used to complete the ETA 2208A is saved in clearly marked folders on our Fiscal drive for ease of retrieval. Procedures will be documented and saved for ease of retrieval and use.

Reference Number: 2025-007 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Reporting – ETA 2112, UI Financial Transaction Summary Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement Compliance: ETA 2112, UI Financial Transaction Summary (OMB No. 1205-0154) – A monthly summary of transactions, which account for all funds received in, passed through, or paid out of the state unemployment fund. Form ETA 2112 provides a summary of data pertaining to state unemployment insurance (UI) tax collections, regular benefits paid, Federal and state shares of extended benefits paid, Federal temporary program benefits paid, and other transactions affecting the Unemployment Trust Fund. In addition, it reflects specific areas where adjustments are indicated to determine the adequacy of resources available for regular unemployment benefit payments. Data from this form is also used with data from other statistical reports to study trends in financial aspects of the UI program and as a basis for solvency studies. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) was unable to provide supporting documentation that ETA 2112 reports were reviewed and approved prior to submission. Context For three of three ETA 2112 reports selected for testing, the Division was unable to provide documentation that the reports had been reviewed and approved prior to submission. Questioned Costs Undetermined. Cause The Division does not have a control in place to ensure that reports are reviewed and approved prior to submission. Effect There is an increased risk of charging unallowed costs to the program if reports are not reviewed and approved prior to submission. Recommendation We recommend the Division review and enhance internal controls to ensure that ETA 2112 reports are reviewed and approved prior to submission. Views of Responsible Officials There is already a signature on the report we will now have that is signed and dated and will also add an additional line for preparer signature and date.

Reference Number: 2025-008 Prior Year Finding: 2024-010 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Allowable Cost/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) was unable to provide support to validate that payroll expenses charged to the federal program were reviewed. Timesheets did not have evidence of supervisory approval. Context For 2 of 60 timesheets selected for testing, the Division was unable to provide documentation that the timesheets were reviewed and approved by a supervisor. Questioned Costs Undetermined. Cause Controls were not operating effectively to ensure that time and effort reporting was performed and documented in a timely manner, in accordance with federal requirements. Effect There is an increased risk of charging unallowed payroll costs to the program. Recommendation The Division should reevaluate its current process, implement proper controls, and perform additional training for time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials We agree that the division was unable to provide documentation supporting the timesheet approval as asserted. However, we respectfully disagree that the lack of timesheet approval translates into charging the program with unallowed costs. It’s important that the auditors understand that the division’s responsibility to ensure that payroll charges to the program are appropriate begins with ensuring that each employee tasked with performing program functions are hired into the correct division internal program unit (“IPU”). And then further within that IPU, instruct employees to use a specific activity code that is assigned to various federal programs. In the samples reviewed, employees properly used the correct activity code to record time for the work performed. Auditor Rejoinder In its response, the Division acknowledges that it was unable to provide documentation to auditors that timesheets were reviewed and approved. Auditors recognize that an allowable activity code was used by the employees, but without review and approval, the actual time recorded and the validity of the activity code could not be verified. However, auditors recognize that the payroll costs would be allowable if they were reviewed by a supervisor and it was determined that appropriate activity codes were used for those employees in the given time periods. Therefore, auditors did not identify questioned costs for this finding due to a lack of documentation but reiterate that there is a possibility that questioned costs may exist if the employee time charged to the program was inappropriate.

Reference Number: 2025-009 Prior Year Finding: 2024-011 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (10/1/2024 – 12/31/2027) Compliance Requirement: Allowable Cost/Cost Principles – General Disbursements Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition Documentation to support General Disbursement transactions was not readily available for review. States are required to develop and implement internal controls to ensure proper supporting documentation is maintained and readily available for audit, but the Division of Unemployment Insurance (Division) was unable to provide supporting documentation to auditors on a timely basis. Context For three of sixty general disbursement transactions selected for testing, the Division was initially unable to provide supporting documentation and confirmed lack of support for these items to auditors. After the conclusion of audit test work, the Division provided support for the sample selections, however, it was not submitted for audit review in a timely manner. Questioned Costs None noted. Cause The Division’s procedures and controls are not sufficient to ensure timely submission of requested audit documentation. Effect Lack of effective controls could cause the Division to incur program charges without supporting documentation. Recommendation The Division should review and enhance its procedures and controls regarding general disbursements to ensure that supporting documentation is readily available upon audit request. Views of Responsible Officials We acknowledge that audit ready evidence was not produced in a timely fashion but respectfully disagree that the Division did not maintain this evidence. The lack of timely production can be attributed to lack of awareness of the proper repository where such audit evidence was maintained and/or could be easily retrieved, as opposed to no maintenance at all. We also maintain that the division was able to substantiate all expenses queried. Auditor Rejoinder On October 1, 2025, auditors sent a request to the Division for supporting documentation for sixty samples selected for testing. Documentation was provided to auditors on November 10, 2025, but for three of the sixty samples it was deemed insufficient for testing. Auditors followed up with the Division, requesting additional support for these samples, but it was not provided. On February 17, 2026, auditors met with Fiscal Management regarding the status of the outstanding supporting documentation and were informed it was not available and would not be provided. After this meeting, auditors finalized audit test work, drafted the audit finding, and sent it to the Division for a written response. On March 11, 2026, the Division provided additional support to auditors after the conclusion of audit test work. Auditors acknowledge that support was eventually provided but maintain that the Division’s procedures and controls are insufficient to ensure that adequate supporting documentation is readily available for audit.

Reference Number: 2025-010 Prior Year Finding: 2024-004 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: State Workforce Agencies (SWA) responsibilities include: (1) establishing specific, detailed policies and operating procedures which comply with the requirements of federal laws and regulations; (2) determining the state Unemployment Insurance (UI) tax structure; (3) collecting state UI contributions from employers (commonly called “unemployment taxes”); (4) determining claimant eligibility and disqualification provisions; (5) making payment of UI benefits to claimants; (6) managing the program’s revenue and benefit administrative functions; (7) administering the programs in accordance with established policies and procedures; and (8) enacting state unemployment compensation (UC) law that conforms with federal UC law. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) did not maintain documentation supporting claimant eligibility and did not properly set up claimants to recoup overpayments. Context Sixty claimants were selected for testing, and the following exceptions were noted: • For 3 of 60 claimants, the Division was unable to provide documentation that the claimant provided weekly updates. • 2 of 60 claimants were not properly set up to recoup overpayments. One claimant was determined to be ineligible, but benefits were paid. One claimant was initially determined to be eligible, but after the employer appealed the claim, the claimant was determined to be ineligible. Neither claimant was properly set up to recoup the overpayments. • For 1 of 60 claimants, documentation could not be provided that the Division contacted the employer to verify the claimant’s employment status. Questioned Costs Undetermined. Cause The Division’s procedures and internal controls were not sufficient to ensure that documentation to support claimant eligibility was retained nor that claimants were properly set up to recoup overpayments. Effect The Division did not recoup benefits paid to claimants which were determined to be ineligible. Failure to maintain eligibility documentation could allow benefits to be paid to ineligible claimants. Recommendation The Division should review and enhance procedures and controls to ensure that claimant eligibility is properly determined, that documentation supporting claimant eligibility is retained, and that documentation is readily available for audit. Views of Responsible Officials For 3 of 60 claimants, the Division was unable to provide documentation that the claimant provided weekly updates. These cases (sample 2,7 and 36) relate to claimant weekly certifications and their responses to required eligibility questions for the applicable benefit weeks. Due to existing mainframe system limitations, the Division does not have the ability to directly view all claimant responses within the system interface. In preparation for the CLA review, Application Support generated a comprehensive report capturing weekly certification responses for all sampled claimants, based on Social Security Numbers. However, three claimants did not appear on this report, and therefore their responses could not be verified at the time of review. The Division has identified both short-term and long-term corrective actions to address this discrepancy: • Short-term solution: A service ticket has been submitted to the Application Support team to investigate and resolve the issue that caused these claimants to be excluded from the report. Once resolved, future reports are expected to consistently capture all claimant responses associated with weekly certifications. • Long-term solution: The Division recognizes the need for a modernized system to improve the efficiency and reliability of claims processing and adjudication. Current case management systems are outdated and have limited functionality. Implementation of an updated system will allow for automated capture of weekly certification responses, improved data accessibility, and enhanced identification of potential compliance issues requiring investigation.

Reference Number: 2025-011 Prior Year Finding: 2024-012 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Reporting – ETA 9130, Financial Status Report, UI Programs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: The ETA 9130-Financial Status Report, UI Programs report is used to report program and administrative expenditures. All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UA Projects (administration and benefits). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) submitted ETA 9130 reports that did not agree with supporting documentation. Context Eight of forty-four ETA 9130 reports selected for testing did not agree with supporting documentation and auditors were unable to verify the accuracy of the reports. Specifically, we noted the following: • 5 of 24 reports selected from the 9/30/2024 quarter did not agree with supporting documentation. • 3 of 20 reports selected from the 3/31/2025 quarter did not agree with supporting documentation. Questioned Costs Undetermined. Cause The Division’s procedures were not sufficient to ensure that reports submitted agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect ETA 9130 reports did not agree with supporting documentation. Recommendation We recommend the Division review and enhance procedures and internal controls to ensure that ETA 9130 reports agree with supporting documentation and that documentation is maintained and is readily available for audit. Views of Responsible Officials We acknowledge the audit finding that several ETA 9130 reports did not agree with the supporting documentation. Procedures have been implemented to ensure documentation used to complete the ETA 9130 reports are reviewed by both the Certifying and Approving Officials before final sign off. Procedures will be documented and saved for ease of retrieval and use. Backup will be saved in clearly marked folders on our Fiscal drive for ease of retrieval.

Reference Number: 2025-012 Prior Year Finding: 2024-006 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Special Tests and Provisions – Employer Experience Rating Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement Compliance: Certain benefits accrue to states and employers as a result of the state having a federally approved experience-rated UI tax system. All states currently have an approved system. For the purpose of proper administration of the system, the State Workforce Agency (SWA) maintains accounts, or subsidiary ledgers, on a state UI taxes received or due from individual employers, and the UI benefits charged to the employer. The employer’s “experience” with the unemployment of former employees is the dominant factor in the SWA computation of the employer’s annual state UI tax rate. The computation of the employer’s annual tax rate is based on state UI law (26 USC 3303). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) did not apply the correct employer experience rate for an employer. Context For one of sixty employers selected for testing, due to a manual error, the Division improperly applied the employer experience rate using the 2013 new employer rate instead of the 2023 new employer rate. Questioned Costs Undetermined. Cause The Division’s procedures and controls were not sufficient to ensure that it applied the proper employer experience rate. Effect The Division incorrectly applied the employer experience rate to an employer. Recommendation The Division should review and enhance procedures and controls to ensure that employer experience rates are properly calculated and applied. Views of Responsible Officials We disagree with the finding as we believe the employer’s account effective date and liability status were established in accordance with the applicable state UI laws and regulations. Documentation can be provided to substantiate this determination. Account# 69821 was established in November of 2024 with a liability date of 04/2013 per employer’s application on file, which gave the employer a new employer rate of 2.8. After my discussion with the auditor on 3/19/26, I pulled the folder to further investigate. Based on this review, we conclude that the rate assignment was accurate and compliant, and therefore the finding appears to be based on a misunderstanding of the employer’s account status or the applicable rate criteria. The business already implemented a corrective action plan in 2025 which entailed changing how the calculation is performed. This calculation is now done outside of the Mainframe system in compliance with Title 19 rules with results uploaded into the system after calculation. The UI program successfully provided an auditable population for calendar year 2025. Auditor Rejoinder On January 26, 2026, auditors met with the UI Tax Administrator and Fiscal Analyst to discuss the Employer Experience rate assignment of 2.8% for Account #69821. Auditors reviewed state law HB433 and the ETA handbook requirements noting that all new employers added will receive an experience rate of 1.2%, or experienced employers will receive .6% if its benefit wage ratio does not exceed 20%. The UI Tax Administrator confirmed to auditors that the liability date of April 26, 2013, was entered in error instead of April 26, 2023, which caused the 2013 rate of 2.8% to be input into the employer experience rating letter sent to the employer. As documented in the guidance, there is no current benefit wage ratio calculation that would result in an employer experience rating of 2.8%.

Reference Number: 2025-013 Prior Year Finding: 2024-013 Federal Agency: U.S. Department of the Treasury State Department Name: Office of the Governor Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP0139 (3/3/2021 – 12/31/2024) SLFRP2629 (3/3/2021 – 12/31/2024) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per the Compliance and Reporting Guidance issued by the Department of the Treasury (Treasury), recipients must submit quarterly Project and Expenditure Reports. Required project information includes current period obligation, cumulative obligation, current period expenditure, cumulative expenditure, and capital project information. Per 31 CFR §35.6(b)(4), a recipient, other than a Tribal government, must prepare and submit written justifications for projects with capital expenditures enumerated by Treasury in the final rule and with total capital expenditures greater than $10 million. For projects with capital expenditures greater than or equal to $1 million but less than $10 million, written justifications must be maintained in project files. Such written justifications must include the following elements: (i) Describe the harm or need to be addressed; (ii) Explain why a capital expenditure is appropriate; and (iii) Compare the proposed capital expenditure to at least two alternative capital expenditures and demonstrate why the proposed capital expenditure is superior. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition Capital project justifications reported and/or maintained in project files did not include all required elements. Context The Office of the Governor (Office) prepares and submits quarterly Project and Expenditure Reports. Eight projects with capital expenditures greater than or equal to $1 million were selected for testing on the September 30, 2024 and December 31, 2024 quarterly reports. Projects selected consisted of four with capital expenditures greater than or equal to $10 million and four with capital expenditures less than $10 million. The following exceptions were noted: • For 1 of 4 projects greater than or equal to $10 million, the reported capital project justification did not include required elements (ii) or (iii). • For 2 of 4 projects greater than or equal to $10 million reported capital project justifications did not include required element (iii). • For 1 of 4 projects less than $10 million, the capital project justification maintained in the project file did not include required element (iii). Cause The Office’s procedures and internal controls were not operating effectively to ensure that capital project justifications reported or maintained in project files contained all required elements. Effect Capital project justifications are intended to demonstrate that each capital project over $1 million is the best and proper use of program funds for the intended purpose. Failure to ensure capital project justifications include all required elements could allow a capital project to be initiated that is not in the best interest of the program or the best use of program funds. Questioned Costs Undetermined. Recommendation We recommend that the Office enhance procedures and internal controls to ensure that it reports and/or maintains in project files capital project justifications that contain all required elements. The Office should provide training of State agency personnel and conduct periodic reviews of written capital project justifications to ensure that they comply with program requirements. Views of Responsible Officials The ARPA team acknowledges that the repeat finding related to capital project justifications resulted from gaps in enforcement and follow-up procedures with state agencies. While guidance was provided, the team did not consistently ensure that complete and compliant capital project justifications were obtained and reviewed prior to reporting. Contributing factors included limited staffing resources also impacted agencies’ ability to provide complete historical information for projects initiated in prior reporting periods. In several cases, agency personnel responsible for original project justifications were no longer available, making it more difficult to obtain sufficient documentation to meet Treasury requirements. However, the ARPA team recognizes that these challenges do not mitigate the responsibility to ensure compliance with reporting requirements. To address this, the ARPA team will implement enhanced controls to ensure compliance with capital project justification requirements. These include requiring complete justifications prior to reporting, use of a standardized template and review checklist, and a formal second-level review process to verify completeness and accuracy. In addition, the team will maintain centralized tracking of all submissions, implement formal escalation procedures for nonresponsive agencies, and provide ongoing training and guidance, including support for new agency personnel. Periodic compliance reviews will also be conducted to ensure continued adherence to program requirements.

Reference Number: 2025-014 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Department Name: Division of Libraries Federal Program: COVID-19 – Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Award Number and Year: CPFFN0144 (2/4/2022 – 12/31/2026) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per 2 CFR section 200.317 Procurements by states, when procuring property and services under a Federal award, a state must follow the same policies and procedures it uses for procurements from its non-Federal funds. Per 29 Del C. Chapter 69, section 6981 Large professional service procurement process: (a) Any state contract for which an agency is a party with probable fees, including reimbursable expenses and amendments, greater than the threshold amount or amounts established by the Contracting and Purchasing Advisory Council pursuant to § 6913 of this title for the completed job will be subject to the provisions of this subchapter. (b) Each agency shall publicly announce, not less than once a week for two consecutive weeks in a newspaper published or circulated in each county of the State, when professional services are required (c) Each agency shall publicly announce each professional services contract subject to subsection (a) of this section by electronic publication accessible to the public in a manner prescribed pursuant to § 6902(9) of this title for two consecutive weeks. (d) Such announcement shall include: (1) The project identification; (2) General description and scope of the project; (3) Location; (4) Deadline for submission of brief letters of interest; (5) Criteria for selection of professionals including any special criteria required for any particular project; (6) Indication of how interested professionals can apply for consideration; (7) The agency's intention to award to more than one firm, if applicable; and (8) A description of the selection process to be used, as defined in § 6982 of this title. (f) Each agency shall establish written administrative procedures for the evaluation of applicants. These administrative procedures shall be adopted and made available to the public by each agency before publicly announcing an occasion when professional services are required. One or more of the following criteria may be utilized in ranking the applicants under consideration: (1) Experience and reputation; (2) Expertise (for the particular project under consideration); (3) Capacity to meet requirements (size, financial condition, etc.); (4) Location (geographical); (5) Demonstrated ability; (6) Familiarity with public work and its requirements; or (7) Distribution of work to individuals and firms or economic considerations. (g) In addition to the above, other criteria necessary for a quality, cost-effective project may be utilized. (h) Each project shall be given individual attention, and a weighted average may be applied to criteria according to its importance to each project. (i) For the selection process described in § 6982(b) of this title, price may be a criteria used to rank applicants under consideration. Per 29 Del C. Chapter 69, section 6982 Selection: (a) Agencies shall use the selection process described in paragraphs (b)(1) through (3) of this section. (1) Based upon the criteria established pursuant to § 6981(f) of this title, the agency shall determine all applicants that meet the minimum qualifications to perform the required services. (2) The agency shall then interview at least one of the qualified firms. The agency may negotiate with one firm without terminating negotiations with another firm and may negotiate with one or more firms during the same period. At any point in the negotiation process, the agency may, at its discretion, terminate negotiations with any or all firms. (3) The agency may require the firm with whom the agency is negotiating to execute a truth-in-negotiation certificate stating the wage rates and other factual unit costs supporting the compensation are accurate, complete and current at the time of contracting. All professional service contracts shall provide that the original contract price and any additions thereto shall be adjusted to exclude significant sums where the agency determines the contract price was increased due to inaccurate, incomplete or noncurrent wage rates and other factual unit costs. All such contract adjustments shall be made within one year following the end of the contract. Sole source procurement shall be avoided, except when no reasonable alternative sources exist. A written determination by the agency for the sole source procurement shall be included in the agency's contract file. (29 Del. C. §6904(i)) Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Libraries (Division) was unable to provide evidence that it had procured a contract in accordance with the State’s procurement policies. Context For one of five contracts selected for testing, the Division was unable to provide supporting documentation that it had procured the contract in accordance with the State’s procurement policies. Questioned Costs Undetermined. Cause The Division’s internal controls were not sufficient to ensure that federal and statewide procurement policies were followed for purchases made for the program. Effect Failure to adhere to procurement policies and procedures may result in the contract being issued under terms and conditions that are not in the best interest of the federal program and/or the State. Recommendation The Division should review and enhance controls and procedures to ensure that it follows the State’s procurement policies for all contracts charged to the program. Views of Responsible Officials The Department of State, Division of Libraries disputes the audit finding of “significant deficiency in internal control over compliance, other matters” on the basis that Title 29, Chapter 69 of the Delaware Code is inapplicable and exempts the purchase of services by libraries from the State procurement process, including construction. Without admission to any deficiency in the Division’s “internal control over compliance, other matters,” the Division of Libraries will review all internal controls and procedures to ensure compliance with the State’s procurement process. Auditor Rejoinder Auditors acknowledge that Title 29, Chapter 69(d) of the Delaware Code includes exemptions related to libraries. Specifically, it states: “This chapter shall not apply to any purchase of library materials such as books, periodicals, subscriptions and software by libraries of any agency, nor shall this chapter apply to the purchase of services by libraries of any agency pursuant to Chapter 66 of this title.” Library services is further defined in Title 29, Chapter 66, §6602(a), Contracting for library services, which states the following: “In order to encourage the maintenance and development of proper standards, including personnel standards, hours of operation, library materials, collection standards and interlibrary resource sharing, and to provide for the development of statewide public library service, the Delaware Division of Libraries may contract with any public library, including privately incorporated public libraries or public library systems established pursuant to Chapter 8 of Title 9, which qualifies under standards established by the Division with the approval of the Delaware Council on Libraries, to provide library services.” Furthermore, Title 29, Chapter 66A, establishes requirements regarding library construction which includes a provision for proposal review and does not exempt such projects from following established procurement policies. The contract identified by auditors in this finding is a $22 million contract for “management and construction services for the North Wilmington Library Think Do (“Project”)”. Auditors believe the scope and nature of this agreement does not fall under the exemptions established for library services under Title 29, Chapter 69(d) of the Delaware Code. The Division was unable to provide auditors with documentation that it had followed established procurement procedures when it entered into this agreement.

Reference Number: 2025-015 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Department Name: Office of the Governor Federal Program: COVID-19 – Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Award Number and Year: CPFFN0144 (2/4/2022 – 12/31/2026) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per the CPF State Guidance issued by the Department of the Treasury (Treasury), recipients must submit quarterly Project and Expenditure Reports. Required project information includes current and cumulative obligations and expenditure and other information applicable to each specific category of project. For Multi-Purpose Community Facility Projects, recipients must report planned and actual square footage funded by CPF. Reported square footage must be within 10% of the square footage included in supporting documentation. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of the Governor (Office) reported square footage for a project that varied by more than 10% of the amount included in supporting documentation. Context Eight projects categorized as Multi-Purpose Community Facility Projects were selected for testing from the September 30, 2024 and March 31, 2025 quarterly reports. For one of eight projects selected, the planned square footage reported varied by more than 10% of the planned square footage maintained in project files. The square footage in project files was 11,000, but the amount reported was 18,000 which is a variance of 64%. Auditors noted the same amount was reported in both quarters tested. Cause Procedures and internal controls were not operating effectively to ensure that square footage reported agreed with supporting documentation. Effect Reported square footage did not agree with supporting documentation and the variance exceeded 10%. Questioned Costs None noted. Recommendation We recommend that the Office enhance its procedures and internal controls to ensure that reported square footage agrees with supporting documentation. Views of Responsible Officials The ARPA team acknowledges that the discrepancy in reported square footage resulted from a data entry error and insufficient controls to ensure that updates to project data were reflected in subsequent reporting periods. To address this, the team has implemented enhanced data validation procedures, including reconciliation of reported data to supporting documentation each reporting period, formal tracking of changes to project data, and a secondary review of key data elements prior to submission. Ongoing monitoring will be performed to ensure continued accuracy and consistency across reporting periods.

Reference Number: 2025-016 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: NU50CK000497 (8/1/2019 – 7/31/2027) NU51CK000334 (8/1/2024 – 7/31/2029) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Public Health (Division) inaccurately charged payroll costs to the program. Context For one of forty time sheets selected for testing, the employee’s time and effort certification indicated that 50% of the employee’s time was spent on the program, but 100% of the employee’s time was charged. Questioned Costs $1,742, the amount charged to the program in error. Cause Controls were not operating effectively to ensure that time and effort reporting was performed accurately. Effect Unallowed payroll costs were charged to the program. Recommendation The Division should reevaluate its current process, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials ELC Financial Lead will work with DPH Support Services to track all recoded time against grant. As recodes are identified, time certifications for affected staff will need to be revised and filed appropriately.

Reference Number: 2025-017 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Social Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 2501DETANF (10/1/2024 – 9/30/2025) 2401DETANF (10/1/2023 – 9/30/2024) 2301DETANF (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity’s written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Social Services (Division) did not have evidence of that employee time charged to the program was properly documented. Context Forty timesheets were selected for testing, and the following exceptions were noted: • 17 of 40 timesheets selected for testing could not be provided to auditors for testing. • 14 of 40 timesheets selected for testing were not certified timely by a program supervisor. The timesheets were certified several months after the end of the pay period. • 1 of 40 timesheets selected for testing was not certified by a program supervisor. Questioned Costs Undetermined. Cause The Division’s controls are not sufficient to ensure that time and effort reporting is performed and documented in accordance with federal requirements. Effect Employee time charged to the program could not be verified and there is an increased risk of charging unallowed payroll costs to the program. Recommendation The Division should enhance procedures, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials The following action will be taken to improve the current process. • The Fiscal unit is implementing procedures to serve as the central repository for all Time and Effort records, replacing the current practice of storing these forms at the program manager level. • Implement internal controls for Time and Effort Reporting. • Confirm that T&E information submitted is accurate and reconciled. • Provide training for Time & Effort certification.

Reference Number: 2025-018 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Social Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575. 93.596 Award Number and Year: SAI5406 (10/1/2022 – 9/30/2025) SAI5788 (10/1/2023 – 9/30/2026) SAI6656 (10/1/2024 – 9/30/2028) SAI6306 (10/1/2024 – 9/30/2027) Compliance Requirement: Eligibility Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: Lead Agencies must have procedures in place for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each Lead Agency in its approved plan. A Lead Agency is the designated state, territorial, or tribal entity to which the CCDF award is issued and that is accountable for administering the CCDF program. Procedures for documenting and verifying eligibility may be performed directly by the Lead Agency or other agencies engaged in the administration of CCDF. At the Lead Agency’s option, enrollment in other benefit programs or documents or verification used for other benefit programs may be used to verify eligibility as appropriate. State Lead Agencies, territory Lead Agencies, as well as those tribal Lead Agencies with Grant Year 2016 allocations of at least $250,000, must establish minimum 12-month eligibility periods before re-determining eligibility of CCDF families and must consider a child to be eligible between eligibility re-determinations. Control: Per 45 CFR Part 98, Child Care and Development Fund recipients must establish and maintain robust internal controls to ensure integrity and accountability of program funds. Recipients must implement procedures designed to investigate and recover fraudulent payments, to impose sanctions on clients or providers in response to fraud, document and verify eligibility, and promote compliance with all applicable laws and regulations. These internal control mechanisms serve to prevent misuse, mismanagement, or fraudulent activity, thereby fostering accountability and transparency in the stewardship of federal funds allocated through the CCDF program. Condition The Division of Social Services (Division) was unable to provide documentation that participants in the program met eligibility requirements. Context Forty program participants were selected for testing, and the following exceptions were noted: • For 7 of 40 participants selected for testing, the Division was unable to provide evidence that eligibility had been properly redetermined after twelve months. • For 1 of 40 participants selected for testing, the household did not meet income requirements and was ineligible to receive benefits under the program. • For 1 of 40 participants selected for testing, the Division was unable to provide documentation to support the eligibility determination nor support for the amount paid. Questioned Costs Undetermined Cause The Division’s procedures and internal controls were not operating effectively to ensure that participants in the program met eligibility requirements nor that documentation of participant eligibility was maintained. Effect There is an increased risk of ineligible participants receiving benefits under the program. Recommendation The Division should reevaluate its current process, implement proper controls, and perform additional training to ensure that participants receiving benefits under the program meet eligibility requirements. The Division should maintain documentation of participant eligibility and this documentation should be readily available for audit. Views of Responsible Officials The Division of Social Services (DSS) is currently conducting pilot sites to implement front-end scanning prior to case processing. Bi-weekly meetings with the vendor began in August 2024, and the first on-site visit to a pilot location took place in August 2025. Following successful implementation of the scanning process, a statewide rollout is planned for April–May 2026. The DSS Training Department has developed targeted mini training courses focusing on areas with high error rates. The Learning Innovation Team (LIT) will collect and analyze pre- and post-assessment data from child care training to measure effectiveness. Additionally, open lab sessions will be introduced to provide hands-on support, with a focus on accurately entering authorizations based on need for care and addressing other common error areas identified through Quality Control audits.

Reference Number: 2025-019 Prior Year Finding: 2024-020 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Social Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575. 93.596 Award Number and Year: SAI5406 (10/1/2022 – 9/30/2025) SAI5788 (10/1/2023 – 9/30/2026) SAI6656 (10/1/2024 – 9/30/2028) SAI6306 (10/1/2024 – 9/30/2027) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: As part of their CCDF plans, Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address eleven specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Control: Per 45 CFR Part 98, Child Care and Development Fund recipients must establish and maintain robust internal controls to ensure integrity and accountability of program funds. Recipients must implement procedures designed to investigate and recover fraudulent payments, to impose sanctions on clients or providers in response to fraud, document and verify eligibility, and promote compliance with all applicable laws and regulations. These internal control mechanisms serve to prevent misuse, mismanagement, or fraudulent activity, thereby fostering accountability and transparency in the stewardship of federal funds allocated through the CCDF program. Condition The Division of Social Services (Division) did not maintain documentation to support providers’ compliance with the program’s health and safety requirements. Context Sixty providers were selected for testing, and the following exceptions were noted: • For 18 of 60 providers selected for testing, the Division indicated that annual site visits had been performed for the current year, but it was unable to provide documentation of the site visits due to a technical issue. Auditors were unable to verify that the site visits were performed, documented, and any violations were identified and corrected. • For 2 of 60 providers selected for testing, the Division was unable to provide evidence that the provider was properly licensed, that they had completed required training nor that other eligibility requirements were met. • For 1 of 60 providers selected for testing, the Division was unable to provide evidence that the provider was properly licensed. • 2 of 60 providers selected for testing were determined by the Division to be incorrectly included in the population provided to auditors for sampling. The Division determined the individuals had never been employed by childcare providers who serve children receiving subsidies under the program. Questioned Costs Undetermined. Cause The Division’s procedures and controls were not sufficient to ensure that providers met the program’s health and safety requirements. Controls were not operating effectively to ensure that documentation of providers’ compliance with health and safety requirements was maintained and available for audit. Effect Failure to verify and document compliance with health and safety requirements could allow ineligible providers to perform services under the program. Recommendation The Division should reevaluate its current process and perform additional training to ensure all providers are compliant with required health and safety requirements and that documentation is maintained and readily available for audit. Views of Responsible Officials The Department of Education, Early Childhood Excellence team will reevaluate its current process and perform additional training to ensure all providers are compliant with required health and safety requirements. Reporting will operate effectively in a new data system to ensure that documentation of providers’ compliance with health and safety requirements is maintained and readily available for audit.

Reference Number: 2025-020 Prior Year Finding: 2024-019 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Social Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575. 93.596 Award Number and Year: SAI5406 (10/1/2022 – 9/30/2025) SAI5788 (10/1/2023 – 9/30/2026) SAI6656 (10/1/2024 – 9/30/2028) SAI6306 (10/1/2024 – 9/30/2027) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 45 CFR Part 98, Child Care and Development Fund recipients must establish and maintain robust internal controls to ensure integrity and accountability of program funds. Recipients must implement procedures designed to investigate and recover fraudulent payments, to impose sanctions on clients or providers in response to fraud, document and verify eligibility, and promote compliance with all applicable laws and regulations. These internal control mechanisms serve to prevent misuse, mismanagement, or fraudulent activity, thereby fostering accountability and transparency in the stewardship of federal funds allocated through the CCDF program. Condition The Division of Social Services (Division) did not have evidence of timely supervisory review and approval of employee timesheets. Context Three of sixty timesheets selected for testing were not certified timely by a program supervisor. The timesheets were certified several months after the end of the pay period. Questioned Costs None noted. Cause The Division’s controls are not sufficient to ensure that time and effort reporting is performed and documented in a timely manner, in accordance with federal requirements. Effect There is an increased risk of charging unallowed payroll costs to the program. Recommendation The Division should enhance procedures, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials The following action will be taken to improve the current process. • The Fiscal unit is implementing procedures to serve as the central repository for all Time and Effort records, replacing the current practice of storing these forms at the program manager level. • Implement internal controls for Time and Effort Reporting. • Confirm that T&E information submitted is accurate and reconciled. • Provide training for Time & Effort certification.

Reference Number: 2025-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Children’s Health Insurance Program Assistance Listing Number: 93.767 Award Number and Year: SAI000005399 (10/1/2023 – 9/30/2024) Compliance Requirement: Period of Performance Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: A non-Federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) was unable to provide evidence that expenditures were incurred during the grant’s allowable period of performance. Context Forty disbursement transactions recorded during September and October 2024 were selected for testing. For forty of forty transactions selected, the Division was unable to provide documentation that the costs were incurred during the grant’s period of performance. Cause The Division’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect Costs could be deemed unallowable by the awarding agency if funds are expended and/or obligated outside of the allowable period of performance. Questioned Costs Undetermined. Recommendation The Division should review and enhance its procedures and internal controls to ensure that it maintains documentation that expenditures charged to the program are incurred within an award’s allowable period of performance. Views of Responsible Officials To prevent recurrence, we are implementing the following actions: 1. Enhanced Monitoring Controls o Establish a centralized tracking system for all awards, including start and end dates. 2. Staff Training and Accountability o Conduct mandatory training for program and finance staff on compliance with period of performance requirements. o Assign clear responsibility for monitoring award timelines to designated personnel. 3. Pre-Closeout Review Process o Introduce a formal pre-closeout review 60 days before the award end date to identify and resolve outstanding obligations. o Require certification from both program and finance leads confirming that all expenditures fall within the allowable period. 4. Post-Expenditure Review o Perform monthly reconciliation of expenditures against the period of performance. o Immediately flag and correct any discrepancies identified.

Reference Number: 2025-022 Prior Year Finding: 2024-023 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2405DE5MAP (10/1/2023 – 9/30/2024) 2505DE5MAP (10/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions – Provider Health and Safety Standards Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. Context For thirty-six of sixty providers selected for testing, the Division was unable to provide evidence that the provider complied with health and safety standards. Questioned Costs Undetermined. Cause The Division’s procedures and controls were not sufficient to ensure that it maintained documentation that providers met the program’s health and safety requirements. Effect Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Recommendation The Division should reevaluate its current process and perform additional training to ensure documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of Responsible Officials DMMA will review the process of storing all data for provider’s screening and credentialing information. In addition, when a provider enrolls or revalidates into DMAP, they will be required to submit updated credentials and license information.

Reference Number: 2025-023 Prior Year Finding: 2024-022 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Children’s Health Insurance Program, Medicaid Cluster Assistance Listing Number: 93.767, 93.775, 93.777, 93.778 Award Number and Year: 2405DE5021 (10/1/2023 – 9/30/2025) 2505DE5021 (10/1/2024 – 9/30/2026) 2405DE5MAP (10/1/2023 – 9/30/2024) 2505DE5MAP (10/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions – Managed Care Financial Audit Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) was unable to provide documentation that it had posted results of managed care financial audits on its website. Context For three of three MCOs within the state, the Division did not post the results of the audits on its website. Questioned Costs None noted. Cause The Division’s procedures and controls were not sufficient to ensure that the results of MCO independent audits were posted to its website once completed. Effect The Division is not in compliance with the transparency requirements regarding MCO independent audits. Recommendation The Division should implement procedures and controls to ensure that it posts the results of independent audits to its website once completed, as required. Views of Responsible Officials DMMA will review the procedures and provide additional training for staff to ensure each MCO has had an audit, obtain copies of the audit, reviews the results, and post the results of the audit on the website.

Reference Number: 2025-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2405DE5MAP (10/1/2023 – 9/30/2024) 2505DE5MAP (10/1/2024 – 9/30/2025) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) did not maintain documentation supporting participant eligibility. Context For two of forty participants selected for testing, the Division did not maintain copies of the application, case comments, and/or renewal determination for the participants. Questioned Costs Undetermined. Cause The Division’s procedures and controls were not sufficient to ensure that it maintained documentation supporting participant eligibility. Effect Failure to maintain eligibility documentation could result in ineligible participants receiving benefits under the program. Recommendation The Division should implement procedures and controls to ensure that it maintains documentation supporting participant eligibility and this documentation should be readily available for audit. Views of Responsible Officials The Division of Medicaid and Medical Assistance (DMMA) in partnership with the Division of Social Services (DSS) will provide training for determination of member eligibility. DSS will also ensure supporting participant eligibility documentation is properly maintained.

Reference Number: 2025-025 Prior Year Finding: 2024-024 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Substance Abuse and Mental Health Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: H79TI085764 (9/30/2022 – 9/29/2024) 6H79TI085764 (9/30/2023 – 9/29/2025) 5H79TI083305 (9/30/2024 – 9/29/2027) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition Timesheets provided by the Division of Substance Abuse and Mental Health (Division) were not reviewed and approved timely by a supervisor. Context 16 of 28 timesheets selected for testing were not certified timely by a program supervisor. The timesheets were certified several months after the end of the pay period. Questioned Costs Undetermined. Cause The Division’s controls are not sufficient to ensure that time and effort reporting is performed and documented in a timely manner, in accordance with federal requirements. Effect There is an increased risk of charging unallowed payroll costs to the program. Recommendation The Division should enhance procedures, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials The Division evaluated the developed process and implemented controls for completion of the process within 60 days with added monitoring roles for accuracy and timeliness. The Division will be performing training for assigned staff, monitoring completion and will continue to improve the process for efficiency and compliance.

Reference Number: 2025-026 Prior Year Finding: 2024-025 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Substance Abuse and Mental Health Federal Program: Opioid STR Assistance Listing Number: 93.788 Award Number and Year: H79TI085764 (9/30/2022 – 9/29/2024) 6H79TI085764 (9/30/2023 – 9/29/2025) 5H79TI083305 (9/30/2024 – 9/29/2027) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Substance Abuse and Mental Health (Division) did not report required subaward information per FFATA requirements. Context Five of eleven subawards selected for testing were not reported timely per FFATA requirements. One subaward was issued on 9/22/2024 and has not been reported to SAM.gov. Four subawards were not reported timely and were reported 1 to 118 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause The Division’s policies and procedures were not sufficient to ensure that required subaward information was reported accurately no later than the end of the month following the date the subaward was issued. Internal controls did not prevent or detect the errors. Effect Subawards were not reported in accordance with FFATA requirements. Questioned Costs None noted. Recommendation We recommend that the Division develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Division develop controls and procedures to ensure that all required subawards are reported accurately and timely SAM.gov. Views of Responsible Officials The Division has reviewed the FFATA reporting requirements and evaluated the procedures in place for identifying and reporting subawards in SAM.gov. During the audit period, the Division relied on existing processes that did not include a formalized secondary review to ensure all reportable subawards were submitted within the required timeframe. In response to this finding, the Division has implemented enhanced internal controls and monitoring procedures to ensure compliance with FFATA reporting requirements. These actions include: • Development of a standardized FFATA tracking log to monitor all subawards issued under applicable federal programs. • Implementation of a secondary review process to verify that all reportable subawards meeting FFATA thresholds are identified and submitted in SAM.gov within required deadlines. • Coordination between program and fiscal staff to confirm subaward execution dates, amounts, and reporting applicability prior to the reporting deadline. • Periodic review of SAM.gov submissions to ensure completeness and accuracy. These corrective actions are intended to strengthen internal controls over FFATA reporting and ensure timely and accurate submission of required subaward reports going forward.

Reference Number: 2025-027 Prior Year Finding: 2024-026 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Substance Abuse and Mental Health Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: SAI000006426 (10/1/2023 – 9/30/2025) SAI000005888 (10/1/2022 – 9/30/2024) SAI000005101 (9/1/2021 – 9/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Substance Abuse and Mental Health (Division) did not report required subaward information in accordance with FFATA requirements. Context Two of five subawards selected for testing were not reported in accordance with FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause The Division’s policies and procedures were not sufficient to ensure that required subaward information was reported accurately no later than the end of the month following the date the subaward was issued. Internal controls did not prevent or detect the errors. Effect Subawards were not reported in accordance with FFATA requirements. Questioned Costs None noted. Recommendation We recommend that the Division develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Division develop controls and procedures to ensure that all required subawards are reported accurately and timely to SAM.gov. Views of Responsible Officials Regarding the subaward identified as not timely reported, the Division confirms that the subaward was submitted in SAM.gov on December 9, 2024. In accordance with FFATA reporting requirements, the subaward should have been reported no later than the end of the month following the month in which the subaward was issued. The delay in reporting was the result of administrative oversight. Since the prior finding, the Division has reviewed and strengthened its internal controls related to FFATA reporting to ensure compliance with federal requirements. Updated procedures have been implemented to formally track all subawards subject to FFATA reporting, including documentation of subaward issuance dates, calculation of reporting due dates, and verification of submission in SAM.gov within the required timeframe. In addition, the Division has implemented a secondary review process to monitor FFATA reporting on an ongoing basis. This includes periodic review of subaward activity and confirmation that all required reports have been submitted timely. These enhanced controls are intended to prevent recurrence of late reporting and to ensure full compliance with FFATA requirements going forward.