Audit 396807

Finding Number: 2025-003 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 10.646 - Summer Electronic Benefit Transfer Program for Children Federal Awarding Agency: U.S. Department of Agriculture Federal Award Number(s): 246AR303N1175 Federal Award Year(s): 2024 Compliance Requirement(s) Affected: Cash Management Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: The Summer Electronic Benefit Transfer Program for Children (Summer EBT/S-EBT) is subject to the requirements of 31 CFR Part 205, Subpart B, including that the State must minimize the time between the drawdown of federal funds from the federal government and the disbursement for federal program purposes. Further, the regulations state that the timing and amount of funds transferred must be as close as is administratively feasible to a state’s actual cash outlay for direct program costs. Additionally, 7 CFR § 292.21(6) states that the financial management systems for program funds in Summer EBT must provide controls that minimize the time between the receipt of federal funds from the United States Treasury and their disbursement for program costs. In the Letter of Credit system, the Summer EBT agency must make drawdowns from the U.S. Treasury as nearly as possible to the time of making the disbursements. The U.S. Department of Agriculture (USDA) issued guidance that defined the federal share of expenditures as disbursements for direct charges related to Summer EBT benefits. This guidance further defined the federal share of unliquidated obligations as the value of benefits that have been issued to participants but for which no cash disbursements have been made. Based upon this guidance, expenditures or disbursements under the Summer EBT program are incurred when participants have used the issued benefits to purchase food at an approved retailer. Initial guidance for state implementation, issued by the USDA on June 7, 2023, in Memo SEBT 01-2023, states that “at the point of redemption, the State will draw funds from the FNS-provided Summer EBT benefit grant through the associated Automated Standard Application for Payments (ASAP) account.” Condition and Context: The Arkansas Department of Human Services (DHS) established the Summer EBT program through AASIS, the State’s accounting system, to allow for the drawdown of federal funds and the recording of expenditures in the accounting system. From June 2024 through November 2024, the Agency initiated drawdowns of federal funds totaling $35,220,720 into a State Treasury fund. The funds were then transferred to a commercial bank account, and an expenditure was recorded for the Summer EBT program in AASIS. While reviewing the revenue and expenditure transactions, ALA discovered that DHS did not base the drawdowns on actual expenditures for Summer EBT benefits. Rather, the drawdowns were comprised of benefits that were approved to be issued on participants’ EBT cards for the Summer 2024 operational period. Each of the 293,503 recipients, identified by DHS, for the Summer 2024 operational period was issued benefits of $120, resulting in $35,220,720 in funds drawn. Because expenditures were not based on participants’ actual food purchases, federal funds were drawn in advance of program expenditures. DHS contracted with a third-party vendor to manage the Summer EBT cards. DHS was responsible for drawing down funds from the federal awarding agency through the ASAP system and then transferring the funds to the commercial bank account used for the settlement of participants’ food purchases. The third-party vendor made daily withdrawals from the bank account to cover card activity of participants’ food purchases. Based on the agreement between DHS and the vendor, funds to cover the issuance amount loaded on each card were drawn and deposited in the bank account at the time the cards were loaded and issued to the participants, not as the expenditures occurred. Participants have 122 days to spend the Summer EBT benefits. After the 122 days, the benefits are expunged from the EBT cards. As of June 30, 2025, $30,214,545 in benefits has been used by participants on food purchases for the Summer 2024 operational period. Because 122 days had passed since benefit issuance, $5,006,175 was expunged from the cards, and the State was required to return these unused funds to the federal grantor. The State was unaware of the expunged balance until notified by auditors and, therefore, had not returned the funds to the federal grantor as of end of fieldwork. Statistically Valid Sample: Not applicable Questioned Costs: $5,006,175 Cause: The Agency did not properly review the guidance for drawing funds for the Summer EBT program, causing the Agency to draw funds prior to incurring expenditures. Additionally, the Agency did not have adequate procedures in place to identify unused benefits, which were required to be returned to the federal awarding agency. Effect: DHS recorded program expenditures that were not supported, received federal funds in advance of program expenditures, and did not minimize the time between the drawdown of federal funds from the federal government and the disbursement for federal program purposes. In addition, the Agency failed to track the amount of issuances not used by the participants at the end of the allowable period and failed to return the expunged funds to the federal awarding agency. Recommendation: ALA staff recommend the Agency ensure recorded expenditures are supported by program expenditures, develop a method to minimize the time between the recognition of expenditures and the drawdown of federal funds, and ensure any excess funds drawn are returned to the federal awarding agency timely. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has updated its internal procedures to comply with FNS guidance that requires Summer EBT funds to be drawn down after expenditures are made. All funds expunged from EBT cards are in the process of being returned to FNS. Anticipated Completion Date: 3/31/2026 Contact Person: Renee Ikard Chief Financial Officer Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 681-8985 Renee.Ikard@dhs.arkansas.gov

Finding Number: 2025-004 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 10.646 - Summer Electronic Benefit Transfer Program for Children Federal Awarding Agency: U.S. Department of Agriculture Federal Award Number(s): 246AR303N1175 and 256AR303N1175 Federal Award Year(s): 2024 and 2025 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: No applicable Criteria: Per 7 CFR § 292.6, children eligible for the Summer Electronic Benefit Transfer Program for Children (Summer EBT/S-EBT) include those who, at any time during the period of eligibility are: • School-aged and categorically eligible, • Enrolled in a National School Lunch Program (NSLP)/School Breakfast Program (SBP) participating school, and: o Categorically eligible; o Meet the requirement to receive free or reduced price meals as determined through an NSLP/SBP application; o Otherwise are determined eligible to receive a free or reduced priced meal; or o Determined eligible through a Summer EBT application. • Enrolled in a special provisional school, and: o Categorically eligible; o Otherwise meets the requirements to receive free or reduced price meals, as determined through an NSLP/SBP application; or o Determined eligible through a Summer EBT application. Categorically eligible means considered income eligible for Summer EBT, as applicable, based on documentation that a child is a member of a household and one or more children in that household are receiving assistance under Supplemental Nutrition Assistance Program, Temporary Assistance for Needy Families, or Food Distribution Program on Indian Reservations, or another means tested program, as approved by the Secretary. A foster child, homeless child, a migrant child, a Head Start child, and a runaway child are also categorically eligible. The terms “categorical eligibility” and “automatic eligibility” may be used synonymously. Per 7 CFR § 292.14(a)(2), the State is required to complete a verification sample equal to 3% of all approved paper and electronic applications from February 1 through April 1. The Agency elected to use an alternative method for verification sample review, which was approved by the federal awarding agency in the Summer 2025 Plan for Operations and Management (POM). The alternative method modified the review period to all approved applications for the months of February, March, and April 2025. Condition and Context: ALA reviewed 40 children (from a population of 293,444) who received Summer EBT benefits for Summer 2024 and 40 children (from a population of 336,059) who received benefits for Summer 2025. The review was performed to ensure the child receiving the benefit was determined to be categorically eligible or eligible through a paper/electronic application. Our review resulted in the following instances of noncompliance and control deficiencies: • In one instance for Summer 2024, a child was approved as both categorically eligible and through a paper/citizen portal application, resulting in a duplication of benefits issued to the recipient. • In one instance for Summer 2025, the Agency was not able to provide ALA with the record used to determine eligibility. The issuance file indicated the child was categorically eligible through the National School Lunch Program. However, the Department of Education file provided to ALA identified the child as having full paid lunch status and, therefore, not a participant in the National School Lunch program. • Additional data analytics performed on the issuance files for Summer 2024 and Summer 2025 identified potential duplication of benefits of $501,000 (4,175 recipients) for Summer 2024 and $609,120 (5,076 recipients) for Summer 2025. Additionally, the Agency failed to meet the minimum verification sample requirements as defined at 7 CFR § 292.14(a)(2). When identifying the total approved paper/citizen portal applications to sample, the Quality Control Unit included all approved applications from February 2025 through May 7, 2025. Based on documentation provided by the Quality Control Unit, approved applications from this period totaled 1,384. The Agency was required to review 3%, or 41, of the approved applications; however, supporting documentation provided by the Agency demonstrated that only 25 approved applications (1.8% of the population) were reviewed. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: 246AR303N1175 - $120 256AR303N1175 - $120 (Known questioned costs greater than $25,000 for a type of compliance requirement are required to be reported. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned [likely questioned costs], not just the questioned costs specifically identified. The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program.) Cause: The Agency failed to adequately implement internal controls to prevent and detect benefits issued to children who were not eligible for the Summer EBT program or the duplication of benefit issuances. Additionally, the Agency did not implement adequate controls to ensure that the Quality Control Unit met the requirement to review 3% of the approved applications. Effect: Summer EBT funds were issued to potentially ineligible children, and some children received a duplication of benefits. Recommendation: ALA staff recommend the Agency strengthen controls to ensure only eligible children receive Summer EBT benefits, benefits are issued to each eligible child only once, and documentation is maintained to support eligibility determinations. Additionally, ALA staff recommend the Agency strengthen controls to ensure the minimum verification sample requirements are met and documented. Views of Responsible Officials and Planned Corrective Action: DHS concurs, in part, and disagrees, in part with this finding. The DCO ARIES team analyzed all potential duplicates for 2024 and 2025. DCO considers 59.1% of the records to not be duplicates, because the records have different SSN’s and dates of birth. A total of 35.9% of cases have the same date of birth but different SSN’s and are potential duplicates. DCO is in the process of reviewing these cases to determine if any system or process adjustments are needed to prevent potential duplicates in the future. The remaining potential duplicates identified by ALA have already been resolved or are being investigated. A refresher training will be conducted with staff who determine eligibility and issue benefits for the Summer EBT program before the program starts in 2026. DCO disagrees that it did not meet the minimum sample verification requirements. A sample of 3% of approved applications received were reviewed according to the 2025 Plan of Operational Management that was approved by FNS. Anticipated Completion Date: 6/30/2026 Contact Person: Mary Franklin Director, Division of County Operations Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 681-8377 Mary.Franklin@dhs.arkansas.gov

Finding Number: 2025-005 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 10.646 - Summer Electronic Benefit Transfer Program for Children Federal Awarding Agency: U.S. Department of Agriculture Federal Award Number(s): 246AR303N1175 Federal Award Year(s): 2024 Compliance Requirement(s) Affected: Reporting Type of Finding: Material Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the award. Per U.S. Department of Agriculture, Food and Nutrition Service (FNS) guidance for the Summer Electronic Benefit Transfer Program for Children (Summer EBT/S-EBT), issued on June 13, 2024, in Memo SEBT 04-2024, the Form SF-425 S-EBT report will provide FNS with the financial data necessary to monitor and closeout the Summer EBT benefit grant. The overarching concept of this financial status report is to document the approved total grant level and the value of Summer EBT benefit issuances as they move from issuances (unliquidated obligations) to redemptions (outlays), net of expungements and other de-obligations. Summer EBT benefit expungements should be reported within the bounds of the fiscal year of the summer operational period for which the benefits were intended. If S-EBT benefits are expunged after September 2024, the benefit expungement should be reported as a reduction of the federal share of expenditures on the September 2024 SF-425 S-EBT report. Condition and Context: The Agency’s Division of Managerial Accounting staff prepare the required federal financial reports for the Summer EBT program. ALA reviewed the annual SF-425 S-EBT report for federal fiscal year 2024 to ensure the Agency completed the form based on the federal awarding agency instructions and that the annual report included cumulative expenditures through September 30, 2024. The amount reported on row 10e of the annual report should represent the sum of cash disbursements for direct charges, net any decreases due to Summer EBT benefit expungements and de-obligations. The Agency failed to reduce the report amount by Summer EBT benefit expungements. As a result, the total federal share of expenditures was overstated by $5,006,175. Statistically Valid Sample: Not applicable Questioned Costs: None Cause: Agency staff did not adequately review instructions published by the federal awarding agency detailing reporting requirements or receive proper training on how to complete the required federal financial reports. Effect: Inaccurate data was submitted on the FNS-425 S-EBT annual financial report. Recommendation: ALA staff recommend the Agency adequately train staff completing the federal reports to ensure correct information is reported. ALA staff also recommend the Agency strengthen controls over reporting to ensure that amounts reported are accurate, complete, and in compliance with federal reporting requirements. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has updated its internal procedures to comply with FNS guidance on completion of the FNS-425 S-EBT annual financial report. Staff have been trained on the updated procedures. Anticipated Completion Date: Complete Contact Person: Renee Ikard Chief Financial Officer Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 681-8985 Renee.Ikard@dhs.arkansas.gov

Finding Number: 2025-006 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 10.646 - Summer Electronic Benefit Transfer Program for Children Federal Awarding Agency: U.S. Department of Agriculture Federal Award Number(s): 246AR303N1175 Federal Award Year(s): 2024 Compliance Requirement(s) Affected: Reporting Type of Finding: Noncompliance and Material Weakness Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and the terms and conditions of the award. Additionally, in accordance with 7 CFR § 292.23, Summer Electronic Benefit Transfer Program for Children (Summer EBT/S-EBT) agencies must report participation and issuance monthly. These reports include the FNS-46 S-EBT Issuance Reconciliation Report and the FNS-388 S-EBT State Issuance and Participation Estimates Report. Per the U.S. Department of Agriculture (USDA) Food and Nutrition Service (FNS), the Form FNS-46 S-EBT report is an issuance reconciliation report used to account for benefits issued during a report month. The report is also used to identify and report card expungements. An expungement is defined as the removal of Summer-EBT benefits from the EBT account to which they were issued. The funds loaded on the EBT card for the Summer EBT program are available for 122 days, as allowed by 7 CFR § 292.15(h). Per FNS guidance issued June 13, 2024, in Memo SEBT 04-2024, to ensure the fiscal year integrity of the FY 2024 S-EBT benefit grant, Summer EBT benefits intended for the FY 2024 summer operational period, but issued after September 30, 2024, should be reported as September data on the FNS-46 S-EBT. In addition, Summer EBT benefit expungements should be reported within the bounds of the fiscal year of the summer operational period for which the benefits were intended. The S-EBT Agency should provide the final amount of federal fiscal year 2024 benefits issued (including benefit expungements) in September and any month after September within the September 2024 FNS-46 S-EBT Report. This approach will allow FNS to capture all financial activity related to FY 2024 S-EBT benefits within FY 2024 reports. Condition and Context: The Agency’s Division of Managerial Accounting staff prepare the required federal financial reports for Summer EBT. The FNS-46 S-EBT Issuance Reconciliation Report is used to account for benefits issued during a report month. ALA completed a reconciliation between the monthly FNS-46 S-EBT Financial Reports submitted for June 2024 – November 2024 and the benefit data obtained from DHS ARIES (Arkansas Integrated Eligibility System) relating to the 2024 Summer EBT program. Testing revealed the following discrepancies: • The Agency failed to report correct monthly issuance totals for Summer 2024 issuances. Amounts reported on the FNS-46 S-EBT for June, July, August, September, October, and November 2024 do not trace to the ARIES Issuance file submitted to the third-party vendor for card upload. Additionally, the Agency failed to accurately identify and report card expungements on FNS-46 S-EBT reports submitted to the federal awarding agency for Summer 2024. • Before the ARIES Issuance file was generated, the Agency manually accumulated information to complete the FNS-46 report. Total issuances reflected on the FNS-46 reports do not match the Agency’s supporting documentation for five months (June, July, August, October, and November 2004). • The Agency failed to combine activity after September 2024 in the September 2024 report, as instructed by USDA FNS. Instead, separate FNS-46 S-EBT reports were completed by the Agency for October and November 2024. The total Summer EBT issuances reported on the form FNS-46 S-EBT report for Summer 2024 were overstated by $1,848,000, and the total Summer EBT expungements reported on the form FNS-46 S-EBT report for Summer 2024 were understated by $5,003,859. ALA reviewed documentation to determine that the FNS-46 S-EBT and FNS-388 reports were properly reviewed and approved prior to submission to the federal awarding agency for the six monthly reports submitted during state fiscal year 2025. In two instances (August 2024 and September 2024), the FNS-46 S-EBT report was completed, reviewed, and submitted by the same individual. Additionally, in one instance (June 2024), the Agency was not able to provide evidence of review of the FNS-388 report prior to submission. Statistically Valid Sample: Not Applicable Questioned Costs: None Cause: Agency staff did not receive proper training on how to complete the required federal financial reports. Additionally, the Agency failed to properly review the federal financial reports prior to submission. Effect: Inaccurate data was submitted on the FNS-46 S-EBT monthly federal financial reports for Summer 2024 issuances and Summer 2024 expungements. Recommendation: ALA staff recommend the Agency strengthen controls over reporting to ensure that amounts reported are accurate, complete, and properly supported by appropriate records to ensure compliance with federal laws and regulations. ALA staff also recommend the Agency continue to strengthen controls to ensure the monthly FNS-46 S-EBT and FNS-388 S-EBT reports are properly completed and reviewed prior to submission. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The agency has updated its internal procedures to comply with FNS guidance on completion of the FNS-46 S-EBT and FNS-388 S-EBT reports. All noted reports have been revised, if necessary, reviewed, and certified. Staff have been trained on the updated procedures. Anticipated Completion Date: Complete Contact Person: Renee Ikard Chief Financial Officer Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 681-8985 Renee.Ikard@dhs.arkansas.gov

Finding Number: 2025-007 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: N/A AL Number(s) and Program Title(s): 14.228 – Community Development Block Grants Federal Awarding Agency: Department of Housing and Urban Development Federal Award Number(s): B18DC050001, B20DC050001, BC21DC050001, B22DC050001, and B23DC050001 Federal Award Year(s): 2018, 2020, 2021, 2022, and 2023 Compliance Requirement(s) Affected: Reporting Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: In accordance with Appendix A of 2 CFR Part 170, direct recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. In addition, 2 CFR § 200.303 requires that a recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition and Context: During state fiscal year 2025, reimbursements were made to subrecipients represented by approximately 125 subaward agreements. ALA staff performed testing of 28 subawards, made by the Arkansas Economic Development Commission (AEDC), to confirm submission of subawards in accordance with FFATA. ALA’s review revealed nine subawards were not reported to SAM.gov (previously the Federal Subaward Reporting System) at the beginning of audit field work. Additionally, the Agency records the date subawards are submitted on internal data collection sheets. Submission dates were not recorded on the data collection sheets for seven subawards even though four had been reported timely. Conversely, submission dates were inaccurately recorded for six subawards that were not reported, as required by FFATA, at the beginning of audit field work. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The failure of Agency controls was caused by employee turnover. Effect: The Agency was not in compliance with Appendix A of 2 CFR § 170. Failure to file Federal Funding Accountability and Transparency Act Subaward reports could result in the reduction or termination of future funding. Recommendation: ALA staff recommend the Agency strengthen controls over financial reporting compliance to ensure reports are submitted timely and in accordance with federal laws and regulations. Views of Responsible Officials and Planned Corrective Action: The AEDC Grants Division has established internal controls and procedures to ensure compliance with the Federal Funding Accountability and Transparency Act (FFATA), primarily focused on AEDC’s responsibility for accurate and timely reporting of CDBG subawards of $30,000 or more. AEDC’s established compliance controls for FFATA include, as reported to ALA staff at the beginning of their field work in this area, are: • Grants Coordinator and/or Division Director checks SAM.gov at the beginning of the grant funding year (after HUD Grant Awards have been signed) or upon the need to report on the first subaward to ensure HUD’s award to the State of Arkansas is entered as a Prime Contract. • All CDBG applicants are required to submit application Exhibit K, FFATA (Federal Funding Accountability & Transparency Act) Reporting Form. This form and ACEDP Policies & Procedures require subrecipients to have an active registration in the System for Award Management (SAM.gov) and obtain a Unique Entity Identifier and AEDC verifying the accuracy of this information before issuing a subaward. • If funding is awarded, completed FFATA Reporting Form is included in the grant agreement packet, prepared by the Grants Manager and approved by the Division Director. A Grant Review Form checklist includes a check that this form is included. • Once a Grant Agreement is executed and the packet returned to the Grants Coordinator for processing, the Grants Coordinator will use the FFATA Reporting Form and information from the Grant Agreement to enter the subaward in SAM.gov, as a subaward associated with the applicable Prime Award (annual allocation). Also included in the packet is a copy of the subawardee’s active Registration and UEI, as well as a Data Collection Sheet which includes a space for the Grants Coordinator to write the date the subaward was entered in SAM.gov. • A timely submission procedure ensures that subaward information is entered into the FSRS at SAM.gov no later than the end of the month following the month in which the subaward obligation was made. To ensure AEDC meets this timely submission requirement, subawards are entered upon return of the AEDC executed grant agreement from the Deputy Director to the Grants Coordinator, who enters the date of the Deputy Director’s signature as the Award Date. • In the ACEDP Grant Agreement the subawardee agrees to comply with The Federal Funding Accountability and Transparency Act, and related federal requirements. • Project closeout procedures include a File Composition Checklist which lists the FFATA Form and the Data Collection Sheet (with subaward reporting date). By the Anticipated Completion Date, the Grants Coordinator and/or the Division Director will ensure each previously awarded subaward has been reported to SAM.gov, and will follow the above controls going forward to ensure compliance. Anticipated Completion Date: 06/30/2026 Contact Person: Jean Noble Director, Grants Division Arkansas Economic Development Commission 1 Commerce Way, Ste. 601 Little Rock, AR 72201 (501) 682-7389 jnoble@arkansasedc.com

Finding Number: 2025-008 State/Educational Agency(s): Arkansas Department of Education Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 21.027 – COVID 19: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): SLFRP3627 Federal Award Year(s): 2021 Compliance Requirement(s) Affected: Allowable Costs / Cost Principles Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.403(g), costs must be adequately documented to be allowable under federal awards. Condition and Context: ALA staff selected five payments to literacy coaching contractors who provide services under the Literacy Empowerment Accountability Readiness Networking and School Safety (LEARNS) Act to determine if sufficient, appropriate documentation was maintained to support that reimbursements were made for allowable literacy coaching expenses. ALA review revealed the following: • Of the 32 schools that received literacy coaching services from a contractor, 3 were randomly selected for testing. The Agency did not have adequate supporting documentation, including a description of daily activities performed by the contracted coach (e.g., a daily log), for two of the three schools. Questioned costs for this contractor totaled $109,557. • Of the 22 schools that received literacy coaching services from a different contractor, 2 were randomly selected for testing. The Agency did not have adequate supporting documentation, including a description of daily activities performed by the coach (e.g., a daily log), for either of the schools. Questioned costs for this contractor totaled $36,000. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $145,557 – SLFRP3627 Cause: Discussion with Arkansas Department of Education (ADE) management indicates they were unaware of uniform guidance documentation requirements for costs charged to federal programs. In addition, the Agency did not have controls in place to ensure a review of documentation supporting invoices was properly performed prior to issuing payments. Effect: Payments to literacy coaching contractors may have been issued without the contractor performing the contractual obligations. Recommendation: ALA staff recommend the Agency strengthen controls by providing training to Agency personnel approving disbursements to literacy coaching contractors, as well as to literacy coaching contractors, to ensure all costs are adequately documented. Views of Responsible Officials and Planned Corrective Action: During the audit, initial evidence was submitted, including monthly and daily logs from vendor coaches to verify coaching activities. Additional documentation, including daily logs obtained from vendors, is available for review. Adjustments and recommendations that have resulted from this audit will be incorporated into future processes and requirements for vendor coaches, to further strengthen our oversight and ensure ongoing adherence to required standards. There are procedures put into place to monitor vendor adherence to scheduled coaching days, with vendors consistently held to a high standard and expectation to fully complete contracted days by requiring vendors to do the following: • Submit monthly evidence of coaching activities that align with contracted days. The Division Received monthly summaries from vendors detailing coaching support, activities, and specific dates when coaching was provided. • Conduct scheduled site visits with state content leaders • Complete monthly walkthroughs with school leaders, with consistency of walkthrough data being outcomes-based and providing tangible evidence that coaching actions directly supported the improvement of instructional programs. Data is collected through Jot Form and displayed on an Air Table Dashboard. This has been maintained since 2023. • Hold ongoing meetings with district staff to review outcomes and address improvement areas, ensuring fulfillment of literacy coaching contracts under Agency requirements Transparency and compliance remain a priority. Required documentation will continue to be accessible to support any future reviews. Anticipated Completion Date: Continuous. Contact Person: Greg Rogers Chief Fiscal Officer DESE 4 Capitol Mall, Room 204-A Little Rock, AR 72201 (501) 682-4475 Greg.Rogers@ade.arkansas.gov

Finding Number: 2025-009 State/Educational Agency(s): Arkansas Department of Education Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 21.027 – COVID 19: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): SLFRP3627 Federal Award Year(s): 2021 Compliance Requirement(s) Affected: Procurement and Suspension and Debarment Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: 2 CFR § 200.214 holds entities subject to 2 CFR Part 180, which restricts awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Condition and Context: The Agency is responsible for ensuring that entities receiving awards are registered in the System for Award Management (SAM) database and have not been suspended or debarred. Registration must occur prior to the issuance of a contract or grant agreement. ALA staff reviewed 13 unique entity identifiers to determine if the Agency was in compliance with the requirement. The Agency failed to ensure two vendors, with agreements executed between September 2024 and October 2024, were registered with SAM prior to the Agency’s issuance of subawards to them. Statistically Valid Sample: Not a statistically valid sample. Questioned Costs: None Cause: The Agency failed to adhere to documented internal control procedures and did not provide oversight to ensure vendors receiving federal funding were monitored to determine federal exclusion. Effect: Failure to develop, document, and implement procedures for internal control over compliance increases risk for issuance of contracts and grant agreements to excluded or ineligible entities. Recommendation: ALA staff recommend the Agency strengthen internal controls by developing, documenting, and establishing policies to ensure contracts and grant agreements are only issued to eligible entities. Views of Responsible Officials and Planned Corrective Action: During the audit, it was noted that for a federally funded contract exceeding $25,000, documentation was not maintained to demonstrate that the vendor was verified as not suspended or debarred through Sam.gov as required by ADE policy and federal regulation. We acknowledge that the required verification was not documented. This occurrence was an oversight in our internal contract review process and a lack of standardized checklist to ensure verification was completed and retained. Upon identification of this finding, we have taken the following corrective action: 1. Immediate corrective action: We are working with the identified vendors to register in Sam.gov. 2. Process Improvement: Documentation of Sam.gov verification will be printed/saved and added to the contract file for all contracts using federal funds over $25,000. 3. Training: Relevant staff responsible for procurement and contract management have been trained in federal suspension and debarment requirements and ADE policy. DESE is committed to full compliance with federal requirements and ADE policy. These corrective actions are designed to ensure that suspension and debarment verification is consistently performed and properly documented for all applicable federally funded contracts going forward. Anticipated Completion Date: Completed. Contact Person: Greg Rogers Chief Fiscal Officer DESE 4 Capitol Mall, Room 204-A Little Rock, AR 72201 (501) 682-4475 Greg.Rogers@ade.arkansas.gov

Finding Number: 2025-010 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Allowable Cost/Cost Principles Type of Finding: Material Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.403(g), allowable costs must be adequately documented. Arkansas State Broadband Office (ASBO) Administrative Procedures require reimbursement requests to be specific to the project and to be for incurred costs documented by attached source documentation, such as receipts, vouchers, bills, invoices, etc. All subaward expenditures must be allowable, necessary, and reasonable for the proper and efficient administration of the grant; be allocable to the grant; be authorized or not prohibited under state or local laws; and conform to the limits of exclusions in federal laws and regulations. Condition and Context: ALA selected five broadband infrastructure projects, totaling $39,789,080, for testing, from a total of 20 broadband infrastructure projects totaling $127,227,854. During testing, ALA reviewed 247 invoices totaling $20,486,786 and identified issues with 212 invoices totaling $6,666,409. The invoices with issues did not have appropriate documentation to identify the items purchased, to support proof of payment by the subrecipient for the items, and/or to determine the expense was related to the specific project. Also, ALA discovered duplicate invoices and invoices associated with other projects. Many invoices had a combination of these various issues. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $6,666,409 Cause: ASBO management did not properly review invoices submitted by subrecipients for appropriate supporting documentation. Effect: Failure to obtain proper supporting documentation for invoices may result in the reimbursement of unallowable expenses. Recommendation: ALA staff recommend the Agency follow established procedures for review of reimbursement requests. Invoices should have appropriate source documentation enabling the reviewer to determine the cost meets the criteria for allowability. Views of Responsible Officials and Planned Corrective Action: ASBO respectfully notes that Treasury’s SLFRF and CPF Supplementary Broadband Guidance provides that ISPs receiving fixed amount subawards for broadband infrastructure projects are not required to comply with the cost principles of 2 CFR Part 200, Subpart E (see U.S. Department of the Treasury, SLFRF and CPF Supplementary Broadband Guidance, available at: https://home.treasury.gov/system/files/136/SLFRF-and-CPF-Supplementary-Broadband-Guidance.pdf) Further, the guidance states, “...[m]ore specifically, subawards that provide for a maximum payment amount that is calculated based on a reasonable estimate of actual cost (see 2 CFR 200.201(b)(1)) will be considered fixed amount subawards even if the subaward agreement also provides that payments to the ISP subrecipient will be limited to actual costs after review of evidence of costs.” Arkansas’ CPF subawards meet these criteria. In short, relative to the applicability of cost principles under the Uniform Guidance, U.S. Treasury treats Arkansas’ CPF subawards as fixed amount subawards, exempting cost principles. Accordingly, ALA’s citation to §200.403(g) under Subpart E is not directly applicable to Arkansas’ CPF Program. Nevertheless, while ASBO maintains that the cost principles standard noted above does not apply to the awards in question, the office conducted a detailed review of the invoices identified. That review determined the following: • A substantial portion of the invoices were specific to approved CPF projects and included subrecipient certification statements affirming project use. • Certain invoices flagged as insufficiently detailed included annotations or supporting documentation sufficient to trace costs to the relevant project. • Invoices identified as potential duplicates were, in several cases, attributable to mixed inventory usage (allowed under GAAP) or subsequent credit/refund adjustments. • A limited subset of invoices (approximately $47,047.79) may require further reconciliation due to a known calculation variance. This funding may be returned, if deemed necessary. ASBO does not concur that the invoices totaling $6,666,409 represent unallowable expenditures. Rather, the observation reflects differences in documentation presentation, invoice formatting, and inventory accounting practices. The office maintains that the costs were associated with eligible broadband infrastructure activities under CPF. Further, in accordance with 2 CFR § 200.201(b)(1), the CPF broadband projects reviewed were monitored through routine oversight and reporting. To strengthen documentation consistency and audit traceability, ASBO is implementing a standardized reimbursement checklist requiring clearer identification of project attribution and supporting documentation prior to approval. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding Number: 2025-011 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Allowable Cost/Cost Principles Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: As outlined in the Uniform Guidance at 2 CFR Part 200, Subpart E, regarding Cost Principles, allowable costs must meet the following criteria: (1) be necessary, reasonable, and allocable for the performance of the federal award, (2) be accorded consistent treatment as either a direct cost or indirect cost, and (3) be adequately documented. In accordance with 2 CFR § 200.405(d), if a cost benefits two or more projects or activities and can be determined without undue effort or cost, the cost must be allocated to the projects based on the proportional benefit. However, when those proportions cannot be determined because of the interrelationship of the work involved, then the costs may be allocated or transferred to benefited projects on any reasonable, documented basis. Condition and Context: The Arkansas State Broadband Office (ASBO) administers several grants that provide capital projects funding for the construction of infrastructure for broadband networks. The Coronavirus Capital Projects Fund grant allows the agency to request reimbursement for administrative costs incurred over the period of performance that do not exceed the greater of five percent of the total amount of the grant received under the Capital Projects Fund or $25,000. ALA reviewed five administrative cost reimbursement drawdowns totaling $887,309, from 16 administrative drawdowns totaling $1,338,559, and noted the Agency allocated staff salaries and other professional services to three different broadband grant programs. The Agency did not maintain support for the basis used to allocate the administrative expenses to the grants. Additionally, ALA recalculated the draw amounts using the Agency’s allocation percentages and noted the Agency had overdrawn on the Capital Projects Fund grant by $22,516. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $22,516 Cause: Determination of percentage allocations was based on verbal communications between ASBO staff members; however, the Agency did not maintain documentation to support these determinations. Also, management did not ensure calculations of the drawdown amounts were accurate. Effect: Failure to properly document the basis for the allocation of administrative costs could lead to a disproportional amount of costs charged to the various grants. As a result, the grants could exceed the maximum amounts allowed by Federal Guidance. Recommendation: ALA staff recommend the Agency develop an administrative cost allocation percentage based on the proportional benefit to each grant. The Agency should maintain documentation to support the determination. Management should ensure the percentages are accurately applied to the respective grants prior to submitting any request for reimbursement. Views of Responsible Officials and Planned Corrective Action: Administrative costs charged to CPF were program-related and remained within the statutory administrative cap. ASBO acknowledges, however, that documentation supporting the internal methodology used to allocate administrative costs across multiple broadband funding streams was not sufficiently formalized during the period reviewed. The identified variance of $22,516 reflects an administrative reconciliation issue rather than an unallowable expenditure, and the variance amount was reduced from a subsequent administrative cost drawdown. Moving forward, the team will more formalize its administrative cost allocation methodology to include a narrative explanation to support allocation percentages, as well as authorizing signatures. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding Number: 2025-012 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Allowable Cost/Cost Principles Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(b), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward. The following is a partial listing of the information a pass-through entity must provide when available: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient’s unique entity identifier (UEI). Condition and Context: ALA reviewed five broadband infrastructure projects totaling $39,789,080, from a total of 20 broadband infrastructure projects totaling $127,227,854, and noted the grant awards had been issued to internet service providers (ISPs) with a unique entity identifier; however, the ISP was not always the entity that would construct and own the broadband network. Several of these ISPs were wholly owned subsidiaries of electric cooperatives, which have a different unique entity identifier. ALA reviewed 247 invoices associated with 15 reimbursement requests and noted 173 invoices totaling $10,793,988 in which the expenses submitted for reimbursement were incurred and paid by the electric cooperative instead of the ISP. ALA also noted 6 instances totaling $3,364,595 in which the reimbursement payments related to these invoices were made to the electric cooperative instead of the ISP. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Arkansas State Broadband Office (ASBO) did not execute the grant agreements with the party that would have ownership of the broadband network when the project was complete. Effect: Failure to ensure grant agreements are executed with the appropriate subrecipient could lead to the submission of expenses and payments that are improper. Recommendation: ALA staff recommend the Agency ensure the subrecipient in the grant agreement is the party that will construct and own the broadband network when it is complete. Doing so will ensure the subrecipient is able to submit and be reimbursed for expenses incurred and place the liability for completion of the project with the appropriate party. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation regarding the execution of subaward agreements with ISP entities that are wholly owned subsidiaries of electric cooperatives and the related affiliate payment structure. Subaward agreements were executed with legally distinct ISP entities holding unique entity identifiers (UEIs) and responsible for performance under the Capital Projects Fund (CPF) award. In certain instances, affiliated parent entities processed invoice payments as part of established intercompany accounting practices. These arrangements reflected corporate structure and operational efficiencies rather than an intent to shift accountability or bypass program requirements. ASBO notes that no questioned costs were identified and that project deliverables were completed in accordance with the terms of the award. The ISP entities remained responsible for reporting, certification, and compliance under the executed agreements. ASBO recognizes, however, that clearer documentation of intercompany payment flows would strengthen audit traceability and reduce ambiguity regarding which legal entity incurred and paid specific costs. To enhance documentation clarity, ASBO will require subrecipients with affiliated entities to maintain documented intercompany reconciliations where applicable and will update subaward templates to further clarify entity-level responsibility for payment, ownership, and record retention. Internal review procedures will also be reinforced to ensure alignment between invoicing practices and designated subrecipient entities. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding Number: 2025-013 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Cash Management Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: Pursuant to 31 CFR § 205.33, state recipients are required to minimize the time elapsing between drawdowns of award funds and outlays of award funds. Arkansas State Broadband Office (ASBO) procedures indicate the Agency should disburse funds within 15 days of drawdown from the U.S. Department of the Treasury. Condition and Context: ALA reviewed drawdowns from the U.S. Department of the Treasury to determine the funds were disbursed timely. Of 34 drawdowns, 19 exceeded the 15-day maximum processing time for disbursements. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: ASBO management did not ensure funds drawn down from the U.S. Department of the Treasury were paid to the subrecipient in accordance with Agency procedures. Effect: Failure to comply with federal regulations for minimizing time between the drawdown of funds from the U.S. Department of the Treasury and disbursement to the subrecipient may result in the denial of future requests for funds, suspension or termination of the federal award, or pursuit of other legal remedies. Recommendation: ALA staff recommend the Agency ensure drawdown of funds from the U.S. Department of the Treasury are disbursed to subrecipients within the 15-day maximum processing time in accordance with Agency procedures. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation regarding the timing of disbursements following drawdowns from the U.S. Department of the Treasury. ASBO procedures include a 15-day internal processing target intended to promote efficient payment processing. While 19 of 34 drawdowns exceeded this internal benchmark, the applicable federal standard under 31 CFR § 205.33 requires recipients to minimize the time between drawdown and disbursement. Additionally, under 2 CFR § 200.305(b)(3), when the reimbursement method is used, payment must be made within 30 calendar days after receipt of a proper payment request. ASBO recognizes the importance of maintaining strong cash management controls and ensuring timely payment to subrecipients. The State of Arkansas is enhancing tracking, reconciliation, and workflow controls within its financial management processes to better monitor drawdown-to-disbursement timing. These measures are intended to strengthen timeliness and prevent recurrence. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding Number: 2025-014 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Matching, Level of Effort, and Earmarking Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(b)(2), a pass-through entity must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes all requirements of the subaward, including requirements imposed by federal statutes, regulations, and the terms and conditions of the federal award. Arkansas State Broadband Office (ASBO) procedures also require any special conditions to be disclosed in the grant agreement. Condition and Context: Federal guidelines do not require cost sharing or matching funds; however, ASBO procedures require a minimum match of 25%. The specific amount of matching required above can vary with each project. A proposed matching amount is submitted by each applicant for a project and evaluated as part of the award process. ASBO did not include the final required matching amount in the grant agreement. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: ASBO management did not include required matching amounts in the grant agreement. Effect: Failure to include all significant terms in the grant agreement could result in a subrecipient’s noncompliance due to lack of knowledge and understanding of required responsibilities. Recommendation: ALA staff recommend the Agency include all significant terms (including required matching amounts) in the grant agreement. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation regarding the inclusion of required matching amounts in the executed grant agreements. The Capital Projects Fund (CPF) program does not require cost sharing or matching funds under federal guidance. However, the Arkansas State Broadband Office (ASBO) incorporated a minimum match expectation as part of its state-level program design and evaluation process. Proposed match commitments were submitted by applicants and evaluated during the award process. ASBO recognizes that the final required match amount was not expressly stated in the executed grant agreement. While match expectations were documented during application review and award evaluation, ASBO agrees that explicitly including the finalized match requirement in the executed agreement would provide greater clarity and reduce ambiguity. ASBO notes that no questioned costs were identified in connection with this finding. ASBO will update its grant agreement templates to ensure that any state-imposed matching requirements are explicitly incorporated into the final executed agreement. This enhancement will ensure alignment between program evaluation criteria and formal award documentation going forward. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding Number: 2025-015 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Reporting Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: All recipients of federal funds must complete financial, performance, and compliance reporting as required by the Grant Agreement, 2 CFR § 200.328 – 329, and as outlined in Part 2 of Coronavirus Capital Projects Fund Compliance and Reporting Guidance. In accordance with Coronavirus Capital Projects Fund Compliance and Reporting Guidance, Capital Project Fund recipients are responsible for reporting on subawards in the Federal Subaward Reporting System (FSRS). A Project and Expenditure Report must be completed for each project included in an approved Program Plan. The Project and Expenditure Report provides information on projects funded, obligations, expenditures, project status, outputs, performance indicators, and other information. Condition and Context: ALA reviewed the Q2 2025 Project and Expenditure Report for five of the 20 projects to determine expenditure and obligation amounts used for matching requirements were accurately reported to the U.S. Department of the Treasury. ALA noted the cumulative obligations for two of the five projects contained errors. The cumulative obligations for one of the projects was overstated by $2,569,790 and understated by $574,066 for the other project. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: Arkansas State Broadband Office (ASBO) management did not adequately review amounts submitted to the U.S. Department of the Treasury for accuracy. Effect: Failure to accurately report project obligations and expenditures to the U.S. Department of the Treasury could result in noncompliance with federal laws and regulations. Recommendation: ALA staff recommend the Agency management ensure all amounts submitted on Project and Expenditure Reports are accurate. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation regarding cumulative obligation amounts reported for two projects in the Q2 2025 Project and Expenditure Report submitted to the U.S. Department of the Treasury. The variances identified were the result of an administrative reporting error within a quarterly submission spreadsheet and did not reflect improper expenditures, questioned costs, or misuse of funds. The Agency identified the discrepancy during its internal review process and submitted corrected information to Treasury. By the time of audit review, the corrected reporting had already been provided. This issue was isolated to a specific reporting period and did not impact the underlying financial integrity of the projects. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding Number: 2025-016 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Subrecipient Monitoring Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(e), a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. As outlined in the Uniform Guidance at 2 CFR Part 200, Subpart E regarding Cost Principles, allowable costs must meet the following criteria: (1) be necessary, reasonable, and allocable for the performance of the federal award, (2) be accorded consistent treatment as either a direct cost or indirect cost, and (3) be adequately documented. Condition and Context: The broadband infrastructure grants are for the construction and deployment of broadband infrastructure projects designed to deliver, upon project completion, service that reliably meets or exceeds symmetrical download and upload speeds of 100 Mbps. When construction and deployment are completed, the subrecipient notifies the Arkansas State Broadband Office (ASBO) in writing. ASBO has contracted with a third-party vendor to perform a technical close-out, which involves field visits and the issuance of a letter to confirm the work has been completed in accordance with the grant agreement. ALA reviewed 5 of 20 projects and noted that 1 project reviewed was not properly closed out. The project was completed in October 2024, and a technical close-out letter was issued in December 2024. In October 2025, the subrecipient requested permission to perform equipment upgrades to the network, and the third-party contractor rescinded the close-out letter, allowing additional expenses of $2,096,990 to be submitted for reimbursement. As indicated in the technical close-out letter issued in December 2024, these upgrades were not necessary for completion of the network in accordance with the grant agreement. Once the network has been completed, any further costs incurred are considered maintenance costs and are the responsibility of the subrecipient. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: $2,096,990 Cause: ASBO management did not ensure that only expenses necessary for performance of the federal award were included as allowable costs. Effect: Failure to properly close-out grants in compliance with Agency procedures could result in reimbursement of expenses that are unallowable. Recommendation: ALA staff recommend the Agency follow close-out procedures and ensure maintenance expenses incurred after the completion of the project are not included as allowable costs. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation regarding the sequencing of the technical close-out letter and subsequent expenditures for one project. ASBO respectfully clarifies that a Technical Close-Out Letter reflects that the primary network infrastructure has been constructed and service capability established. It does not necessarily signify final project completion for all eligible cost components under the grant agreement. Project completion for reporting purposes occurs upon final reporting to the U.S. Department of the Treasury. In October 2025, the subrecipient requested approval to perform additional network equipment upgrades using remaining grant funds. ASBO obtained written confirmation from the U.S. Department of the Treasury Senior Federal Program Officer that the identified OLT upgrade constituted an eligible network component necessary to deliver service and was not maintenance. No additional grant funds were awarded for this work; the proposal involved remaining grant balances. It should be noted that as of the date of audit review, no expenses had been incurred related to the proposed upgrade. As such, ASBO does not concur that the identified $2,096,990 represents ongoing maintenance costs or unallowable expenditures. In fact, all reimbursements to date include eligible network build-out costs incurred prior to “technical closeout” but financially processed after that date, or fiber-to-the-home (FTTH) drops. FTTH drops have been an allowable expense in the Arkansas CPF Program following technical closeout yet prior to reporting the project complete to U.S. Treasury. The misclassification of these costs as maintenance appears to stem from an assumption that they were related to the proposed network upgrade, when in actuality, they were not. To avoid ambiguity in future projects, ASBO will formalize procedures clarifying the distinction between technical close-out, formal project completion, and eligible use of remaining funds. Any Treasury-approved scope clarifications or post-close-out adjustments will be formally documented prior to reimbursement to ensure alignment between technical certification and financial reporting. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding Number: 2025-017 State/Educational Agency(s): Arkansas Department of Commerce – Arkansas Economic Development Commission Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 21.029 – Coronavirus Capital Project Funds Federal Awarding Agency: U.S. Department of the Treasury Federal Award Number(s): CPFFN0186 Federal Award Year(s): 2022 Compliance Requirement(s) Affected: Subrecipient Monitoring Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 2 CFR § 200.332(e), a pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. Condition and Context: Arkansas State Broadband Office (ASBO) procedures require subrecipients to maintain an irrevocable standby letter of credit equal to 100% of the grant award amount disbursed. The irrevocable standby letter of credit must be accompanied by an opinion letter from the subrecipient’s legal counsel stating the letter of credit and its proceeds will not be subject to a Chapter 11 bankruptcy proceeding. The letter of credit must remain in place until the project is completed. In lieu of a letter of credit, the subrecipient may furnish a performance bond in an amount equal to the grant award. ALA reviewed 5 of 20 projects to determine if the letter of credit or performance bond for the appropriate amount was properly maintained by the subrecipient. ALA noted that a letter of credit was not maintained for the required amount for 1 of the 5 projects reviewed. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: ASBO management did not adequately monitor subrecipients to ensure compliance with letter of credit requirements. Effect: Failure to properly monitor subrecipients could result in noncompliance with federal laws and regulations. Recommendation: ALA staff recommend the Agency ensure subrecipients maintain a letter of credit in accordance with ASBO requirements. Views of Responsible Officials and Planned Corrective Action: ASBO acknowledges the auditor’s observation that, for one project reviewed, the required irrevocable standby letter of credit was not maintained at the full amount required under ASBO procedures. ASBO recognizes that ongoing monitoring of letter of credit requirements is an important safeguard to ensure subrecipient compliance and protect program funds. No questioned costs were identified in connection with this matter. ASBO has implemented enhanced monitoring procedures to verify and document that required letters of credit or performance bonds are maintained at the appropriate level throughout the project period. This includes periodic verification and documented review to ensure continued compliance with program requirements. Anticipated Completion Date: June 30, 2026 Contact Person: Glen Howie State Broadband Director Arkansas State Broadband Office 1 Commerce Way Little Rock, AR 72202 (501) 683-6000 broadband@arkansas.gov

Finding Number: 2025-018 State/Educational Agency(s): Arkansas Department of Education Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.575 – Child Care and Development Block Grant 93.575 – COVID19: Child Care and Development Block Grant 93.596 – Child Care Mandatory and Matching Funds of the Child Care and Development Fund (CCDF Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 2101ARCDC6; 2402ARCCDF; 2502ARCCDF Federal Award Year(s): 2021, 2024, 2025 Compliance Requirement(s) Affected: Reporting Type of Finding: Material Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 45 CFR § 98.65(g), and as part of the and conditions of the grant award, states are required to complete and submit quarterly financial status reports (ACF-696) in a manner specified by Administration for Children and Families (ACF) for each fiscal year until funds are expended. In addition, in accordance with 2 CFR § 200.302, the auditee must provide an accurate, current, and complete disclosure of the financial results of each federal award or program in accordance with the reporting requirements. Condition and Context: Multiple state agencies administer the CCDF Cluster. The Arkansas Department of Education (ADE) is responsible for more than 99% of cluster activities. ALA staff compared total expenditures reported for SFY 2025 by ADE on the ACF-696 reports with the total expenditures reported by ADE on its portion of the Schedule of Expenditures of Federal Awards (SEFA). The total expenditures reported by ADE on its ACF-696 reports for SFY 2025 was $14,561,147 less than the amount reported by ADE on its portion of the SEFA. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency did not ensure that staffing was adequate to meet the reporting requirements for this grant. Effect: Failure to accurately report grant expenditures could result in undetected noncompliance with program requirements and potential penalties being assessed by the awarding agency. Recommendation: ALA staff recommend the Agency ensure there is adequate staff to achieve full compliance with program reporting requirements. Views of Responsible Officials and Planned Corrective Action: DESE concurs with this finding. Staff turnover resulted in missed reporting on the ACF-696 reports. New procedures have been put into place for cross-training and quarterly reconciliations to prevent future expenditure reporting on the ACF-696 report from being missed. Anticipated Completion Date: Completed. Contact Person: Greg Rogers Chief Fiscal Officer DESE 4 Capitol Mall, Room 204-A Little Rock, AR 72201 (501) 682-4475 Greg.Rogers@ade.arkansas.gov

Finding Number: 2025-019 State/Educational Agency(s): Arkansas Department of Education Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.575 – Child Care and Development Block Grant 93.575 – COVID19: Child Care and Development Block Grant 93.596 – Child Care Mandatory and Matching Funds of the Child Care and Development Fund (CCDF Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 2101ARCDC6; 2402ARCCDF; 2502ARCCDF Federal Award Year(s): 2021, 2024, 2025 Compliance Requirement(s) Affected: Reporting Type of Finding: Noncompliance Repeat Finding: Not applicable Criteria: In accordance with 45 CFR § 98.65(g), and as part of the terms and conditions of the grant award, states are required to complete and submit quarterly financial status reports (ACF-696) in a manner specified by Administration for Children and Families (ACF) for each fiscal year until funds are expended. Those instructions state that those reports are due on the last day of the month following the end of the previous quarter. Condition and Context: ALA staff reviewed the submission dates for each of the quarterly reports with required submission dates during the 2025 state fiscal year as well as the reports due for the quarter ended June 30, 2025. Of the 8 required reports, 2 were not submitted timely. The reports for the quarters ended June 30, 2024, and September 30, 2024, for the 2024 grant were submitted on January 28, 2025, 89 and 181 days past their respective due dates. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency did not ensure that staffing was adequate to meet the reporting requirements for this grant. Effect: Failure to report grant expenditures timely could result in undetected noncompliance with program requirements and potential penalties assessed by the awarding agency. Recommendation: ALA staff recommend the Agency ensure that there is adequate staff to achieve full compliance with program reporting requirements. Views of Responsible Officials and Planned Corrective Action: DESE concurs with this finding. Staff turnover resulted in missing the reporting submission deadlines for the ACF-696 reports. New procedures have been put into place for cross-training and quarterly reconciliations to prevent future expenditure reporting on the ACF-696 report from being missed. Anticipated Completion Date: Completed. Contact Person: Greg Rogers Chief Fiscal Officer DESE 4 Capitol Mall, Room 204-A Little Rock, AR 72201 (501) 682-4475 Greg.Rogers@ade.arkansas.gov

Finding Number: 2025-020 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.658 – Title IV-E Foster Care Federal Awarding Agency: U.S. Department of Human Services Federal Award Number(s): 2401ARFOST; 2501ARFOST Federal Award Year(s): 2024 and 2025 Compliance Requirement(s) Affected: Activities Allowed or Unallowed Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: In accordance with 45 CFR § 75.303, the auditee must establish and maintain internal control over federal programs that provides reasonable assurance that the auditee is managing federal awards in compliance with federal statutes, regulations, and terms and conditions of the federal award. This includes adequate procedures to ensure payments are made only on behalf of eligible children Condition and Context: Beginning April 4, 2020, the Agency developed a reconciliation report between the Children’s Reporting and Information System (CHRIS) and KidCare titled "Child Care IV-E Reconciliation Report." The report is designed to identify payments where the "paid subcategory type" and the "CHRIS claimability Status" columns do not agree to the logic identified as Title IV-E eligible. Payments identified as not claimable for Title IV-E funding on the reconciliation report are reviewed, and a correcting entry is made in AASIS, the State’s accounting system. The Reconciliation Report includes daycare payments made utilizing Title IV-E funding on behalf of 109 foster children who were not eligible at the time for Title IV-E. Our review of the Reconciliation Report included verifying that funding corrections were made for a sample of 11 foster children. The following discrepancies were noted. • Ten children for which daycare payments were identified as incorrectly paid using Title IV-E funds per the Reconciliation Report were not corrected. The total IV-E adjustment not made equaled $9,920. Subsequent to the 2025 state fiscal year, the Agency updated the IV-E Reconciliation Report. The original Reconciliation Report did not include children who had exited foster care, and daycare services continued to be paid using Title IV-E funds. In July 2025 (SFY2026), an update was made to the Reconciliation Report to include daycare payments made for children after exiting care. The updated Reconciliation Report showed approximately $23,700 more in corrections needed for daycare services incorrectly paid using Title IV-E funds for the period July 1, 2024 through June 30, 2025. The Division of Children and Family Services (DCFS) was notified on August 7, 2025, of the additional corrections needed. No adjustments were made by DCFS to correct the noted errors. ALA performed an additional test review a selection of daycare payments from the KidCare database made with Title IV-E foster care funds. The database included payments totaling $3,119,250 made on behalf of 817 foster children using Title IV-E funds. The ALA review included daycare payments made on behalf of 60 foster children. Each child’s eligibility status was verified using CHRIS. The following discrepancies were noted: • Seven children exited foster care, but daycare benefits totaling $5,244 were paid. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: 2501ARFOST – $12,465 2401ARFOST – $ 2,699 (Known questioned costs greater than $25,000 for a type of compliance requirement are required to be reported. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned [likely questioned costs], not just the questioned costs specifically identified. The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program.) Cause: Daycare payments are made with Title IV-E funds after a child has exited care due to a delay in updating eligibility status in CHRIS. When the revised Reconciliation Report (which was updated to include children who had exited care) was provided to DCFS noting additional IV-E overpayments, DCFS staff elected to not make corrections. Effect: Title IV-E foster care funds were used for unallowable activities. Recommendation: ALA staff recommend the Agency strengthen controls to ensure corrections are made for all payments identified on the Reconciliation Report as incorrectly paid with Title IV-E funds. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The reconciliation process will be revised to specify steps to identify clients that are eligible to receive Title IV-E funding and the process to update their IV-E status. The agency could not make the necessary corrections in AASIS when notified of the deficiency due to the expenses being posted in the prior fiscal year. All necessary adjustments will be made on the quarterly report for the period ending on 3/31/26. Anticipated Completion Date: 4/30/26 Contact Person: Tiffany Wright Director, Division of Children and Family Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 396-6477 Tiffany.Wright@dhs.arkansas.gov

Finding Number: 2025-021 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.658 – Title IV-E Foster Care Federal Awarding Agency: U.S. Department of Human Services Federal Award Number(s): 2401ARFOST; 2501ARFOST Federal Award Year(s): 2024 and 2025 Compliance Requirement(s) Affected: Activities Allowed or Unallowed Type of Finding: Significant Deficiency Repeat Finding: Not applicable Criteria: In accordance with 45 CFR § 75.400(a), the non-federal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. In addition, 45 CFR § 75.303(a) requires the State to establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Also, 45 CFR § 75.326 states when procuring property and services under a federal award, a state must follow the same policies and procedures it uses for procurements from its non-federal funds. Lastly, Chapter 604 of the Arkansas Department of Human Services Administrative Procedures Manual states that during the term of the contract, the division/office shall monitor and complete sufficient performance evaluation(s) to determine if the contractor’s performance is satisfactory or unsatisfactory. Condition and Context: The Foster Care Title IV-E program provides federal matching funds for maintenance assistance payments to provide safe and stable out-of-home care to eligible children placed in qualifying foster care settings. The Department has entered into contracts with various vendors to provide many of the foster care settings. Placement contracts represent a direct federal cost of $6,756,399, which represents 16.8% of total Title IV-E expenditures for state fiscal year 2025. These contracts include Therapeutic Foster Care, Private License Placement Agencies (including Specialized), Qualified Residential Treatment, and Supervised Independent Living. These foster care settings include (but are not limited to) the following financial contract deliverables; • Specialized Private License Placement Agency & Private License Placement Agency: The contractor must provide a minimum percentage of the monthly contract payment to the foster parents. • Therapeutic Foster Care: The contractor must provide a minimum percentage of the monthly contract payment to the foster parents. • Qualified Residential Treatment Facility: Foster Care board payments (clothing and personal needs) paid to the contractor for each child shall be used exclusively for that client’s needs, with monthly documentation detailing the use of the funds for each client. • Supervised Independent Living: Contractor must provide young adults a monthly stipend of $400. Discussion with Department staff concerning how the Department monitors the contracts to ensure contractors are performing satisfactorily revealed that while the Department has procedures in place to monitor the compliance of minimum licensing standards and contract deliverables regarding the immediate care of the children in foster care, they do not have adequate procedures in place to monitor the financial deliverables required. The Agency relies on a contractor self-certification of compliance and on complaints to trigger additional monitoring. Statistically Valid Sample: Not applicable Questioned Costs: None Cause: The Department did not establish adequate controls over the monitoring of the financial deliverables/contractor’s performance for the placement contracts. Effect: Failure to establish appropriate procedures for internal controls limits the Agency’s ability to adequately monitor the program for possible improper payments and noncompliance. Contractors’ performance of the contract may be unsatisfactory. Funds received by contractors could be used for unallowed purposes. Additionally, foster parents paid through a placement contract may not receive the full board payment as required by the contract, resulting in a lower number of available homes, and foster children who are entitled to funds as specified in the contract may not be receiving the appropriate amount to prepare them to live independently. Lastly, contractors’ noncompliance with these financial deliverables could lead to adverse publicity and could affect future funding. Recommendation: ALA staff recommend the Agency establish, and document controls related to monitoring the performance of contract deliverables, specifically the financial deliverables. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. DCFS will update its internal controls to require monthly review of contractor financial deliverables. Anticipated Completion Date: 4/30/26 Contact Person: Tiffany Wright Director, Division of Children and Family Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 396-6477 Tiffany.Wright@dhs.arkansas.gov

Finding Number: 2025-022 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.658 – Title IV-E Foster Care Federal Awarding Agency: U.S. Department of Human Services Federal Award Number(s): 2401ARFOST; 2501ARFOST Federal Award Year(s): 2024 and 2025 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: In accordance with 42 USC § 672, foster care maintenance payments may be made only on behalf of a child who is in a licensed foster family home or child-care institution. Licensing requirements are outlined in the Child Welfare Agency Licensing Act (Ark. Code Ann. § 9-28-401 et seq.). The foster family home provider must have satisfactorily met a (1) criminal records check, including (2) fingerprint-based checks of national crime information databases (FBI Check - "Non-State Criminal Record), with respect to prospective foster and adoptive parents (42 USC 671(a)(20)(A)). The State of Arkansas extended these requirements to all adult household members in foster family homes per the Child Welfare Agency Licensing Act (Ark. Code Ann. §§ 9-28-409(b)(1)(E) and 9-28-409(c)(1)(E)). The foster family home provider must satisfactorily have met a child abuse and neglect registry check on prospective foster and adoptive parents and any other adult or child 14 years and older living in any home, as outlined in 42 USC § 671 (a)(20)(B) as well as Ark. Code Ann. §§ 9-28-409(a)(1)(C) and 9-28-409(b)(2). Condition and Context: ALA selected 60 foster children from a population of 2,021 foster children for which as least one Title IV-E board payment was made during the state fiscal year. The 60 children selected were placed in various foster resource homes during the year, which included 81 foster family homes and 7 child-care institutions. The official record of child welfare information is maintained by the Division of Children and Family Services (DCFS) in the Children’s Reporting and Information System (CHRIS), the automated case management tool. ALA’s review of the required background checks for all appropriate household members in the 81 foster family homes and 7 child-care institutions resulted in the following deficiencies: • For one provider home, DCFS documented in CHRIS that a child maltreatment central registry check for both foster parents was run on October 10, 2023. However, per the Central Registry Unit, a Child Maltreatment Central Registry check for the two individuals was never performed. Title IV-E board payments were claimed from April 9, 2024 through December 18, 2024, on three children who were placed in the home. Title IV-E payments made on behalf of the foster care children totaled $16,860. • For one provider home, DCFS documented in CHRIS that a child maltreatment central registry check for both foster parents was run on June 15, 2023. However, per the Central Registry Unit, a Child Maltreatment Central Registry check for the two individuals was never performed. Title IV-E board payments were claimed from January 1, 2024 through November 1, 2024 on three children who were placed in the home. Title IV-E payments made on behalf of the foster care children totaled $17,526. • For one provider home, DCFS documented in CHRIS that a state criminal background check for a provider household member was run on August 22, 2024. However, per the Arkansas State Police system, a state criminal background check was never run for the individual. One foster care child was placed in the home during the time the household was not in compliance. Title IV-E payments made on behalf of the foster care child totaled $1,916. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: 2401ARFOST maintenance – $28,194 2401ARFOST administrative – $658 2501ARFOST maintenance – $7,450 Cause: Staff failed to ensure that all required checks had been completed. Staff also documented in CHRIS, the Agency’s official record, that the required background checks were completed when no check was processed. The CHRIS system allowed erroneous data to be entered without proper support. Effect: Title IV-E foster care funds were paid to foster family home providers that did not meet all requirements to be fully licensed. Recommendation: ALA recommends the Agency follow compliance regulations to ensure background check requirements are met for all individuals residing in the resource home. ALA also recommends the Agency strengthen controls to ensure the information recorded in CHRIS is accurate. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. DCFS will conduct a review to determine if additional controls are needed to ensure that foster homes complete all required checks. All improper Title IV-E payments will be returned on the next CB-496 quarterly report. Anticipated Completion Date: 4/30/2026 Contact Person: Tiffany Wright Director, Division of Children and Family Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 396-6477 Tiffany.Wright@dhs.arkansas.gov

Finding Number: 2025-023 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Application AL Number(s) and Program Title(s): 93.658 – Foster Care Title IV-E Federal Awarding Agency: US Department of Health and Human Services Federal Award Number(s): 2101ARFCGP Federal Award Year(s): 2021 Compliance Requirement(s) Affected: Reporting Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not Applicable Criteria: In accordance with Appendix A of 2 CFR § 170, direct recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. In addition, 45 CFR § 75.303 states that a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition and Context: The Arkansas Division of Children and Family Services entered into a sub-grant agreement with one subrecipient for the period November 18, 2022 through June 30, 2026, with a total award of $2,295,558. ALA staff searched information on the SAM.gov and USASpending.gov websites to determine if the Agency was reporting subawards as required and discovered no subaward information was reported for the one subaward administered for the Foster Care Program. Statistically Valid Sample: Not applicable Questioned Costs: None Cause: The Agency did not have controls in place to ensure that first-tier subawards of $30,000 or more were reported to SAM.gov. Effect: The Agency was not in compliance with Appendix A of 2 CFR § 170. Failure to file Federal Funding Accountability and Transparency Act Subaward reports could result in the reduction or termination of future funding Recommendation: ALA staff recommend the Agency establish and implement control procedures to ensure first-tier subawards are reported as required. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. DCFS will develop procedures and training to identify and report subgrant awards. Anticipated Completion Date: 4/30/2026 Contact Person: Tiffany Wright Director, Division of Children and Family Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 396-6477 Tiffany.Wright@dhs.arkansas.gov

Finding Number: 2025-024 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable ALN Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2405AR5021 Federal Award Year(s): 2024 Compliance Requirement(s) Affected: Activities Allowed or Unallowed – Managed Care (PASSE) Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: The Provider-Led Arkansas Shared Savings Entity (PASSE) program transitioned to a full-risk Managed Care Organization (MCO) model on March 1, 2019. The program covers services for behavioral health (BH) recipients and developmentally disabled (DD) recipients. To receive services through PASSE, an individual must have an independent assessment (IA) performed that designates him or her at the appropriate level of need to participate in the program. The § 1915(c) Home and Community-Based Services Waiver, applicable to the DD population, requires that an IA be performed at least every three years. Appendix K flexibilities were granted by which an additional 12-month extension was allowed for the IAs beginning March 12, 2020. This flexibility ended six months after the end of the public health emergency (PHE). As the PHE ended on May 11, 2023, flexibilities ended on November 11, 2023. Section 1915(i) of the Social Security Act, applicable to the BH population, which provides states the option to offer home and community-based services through the state’s plan, requires that an IA be performed at least every 12 months. In addition, 42 CFR § 441.720(b) states that for reassessments, the IA of need must be conducted at least every 12 months and as needed when the individual’s support needs or circumstances change significantly, in order to revise the service plan. Section 1135 flexibilities were granted by which an additional 12-month extension was allowed for the IAs beginning March 17, 2020. This flexibility ended when the public health emergency ended on May 11, 2023. Condition and Context: ALA selected 40 PASSE recipients (all BH recipients) to determine if the following attributes had been met: • An open eligibility segment for the recipient during the dates of service. • A valid IA on file in effect for the dates of service. • Appropriate amount paid in accordance with the actuarially determined rates. • No disallowed fee-for-service claims paid for a recipient already covered by PASSE. ALA review revealed an exception affecting payments for one BH recipient as detailed below: • Sample item 16: The IA provided was dated November 20, 2023, and no other IA completed prior to that was provided. Payments for this recipient were made for dates of service from September 1, 2023, through October 29, 2023, with no IA. Questioned costs for these dates of service totaled $319. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Federal - $232 State - $87 (Known questioned costs greater than $25,000 for a type of compliance requirement are required to be reported. In evaluating the effect of questioned costs on the opinion on compliance, the auditor considers the best estimate of total costs questioned [likely questions costs], not just the questioned costs specifically identified. The auditor must also report known questioned costs when likely questioned costs are greater than $25,000 for a type of compliance requirement for a major program). Cause: Agency personnel completed a desk review instead of an IA for the dates of service range in question for sample item 16. A desk review would have been allowed in accordance with flexibilities allowed under Medicaid State Plan Amendment 22-0016 if the recipient was a Medicaid recipient. However, this recipient was a CHIP recipient, and there was no such amendment in the CHIP State Plan. Effect: Gaps were revealed in the performance of the required IAs. As a result, payments were made outside the approved/updated dates of service. Recommendation: ALA staff recommend the Agency review and strengthen its independent assessment procedures to ensure they are completed timely, support the services provided, and are in accordance with federal regulations. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. As the Public Health Emergency has concluded, the agency has returned to normal operations which requires independent assessments to be performed every twelve months for PASSE members. Anticipated Completion Date: Complete Contact Person: Paula Stone Director, Office of Substance Abuse and Mental Health Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 686-9849 Paula.stone@dhs.arkansas.gov

Finding Number: 2025-025 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not applicable AL Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2305AR5021 and 05-2405AR5021 Federal Award Year(s): 2023 and 2024 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: In accordance with 45 CFR § 75.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and terms and conditions of the award. The Agency is responsible for determining Children’s Health Insurance Program (CHIP) recipients meet the eligibility criteria as specified in its approved State Plan. Eligibility requirements for the CHIP program are outlined in the Arkansas Medical Services (MS) Manual. The MS Manual contains specific CHIP policies and procedures and is in addition to the approved State Plan. The State’s ARKids First program includes three separate recipient aid categories under which children receive benefits. Placement in these categories is determined based on monthly household income and a Federal Poverty Level (FPL) percentage. 1. ARKids A (MCHIP) is funded through the CHIP grant in accordance with the Affordable Care Act and provides coverage to children aged 6 - 18 with household income over 100% of the FPL up to 142% of the FPL. 2. ARKids B is funded through the CHIP grant and provides coverage to children up to the age of 19 with household incomes from 142% of the FPL up to 211% of the FPL. Once determined eligible, recipients remain eligible for a 12-month period, regardless of changes in household income. 3. CHIPRA (Children’s Health Insurance Program Reauthorization Act) recipients can be enrolled in any recipient aid category if eligibility requirements are met. CHIPRA includes all children up to age 19 (end of birth month) and pregnant women that fall under lawfully residing qualified alien status. Condition and Context: ALA selected 60 CHIP and MCHIP identification numbers to determine whether the State properly followed eligibility rules when determinations/redeterminations of benefits were made. ALA review revealed one instance in which an ARKids B recipient was improperly determined eligible when the maximum allowed household income was exceeded. The recipient’s coverage should have been terminated effective November 1, 2023. Claims payments totaling $2,128 were paid for dates of service from July 1, 2024 through December 31, 2024. The federal and state portions of these payments totaled $1,702 and $426, respectively. Questioned costs paid from each grant award was determined based on date claim status for header and detail claims and date payment issued for financial capitation claims. Statistically Valid Sample: Not a statistically valid sample. Questioned Costs: Federal − $1,702 • $67 – for award 05-2305AR5021 • $1,635 – for award 05-2405AR5021 State - $426 Cause: The caseworker erroneously relied on tax return information from 2020, instead of the recipient’s most recent tax return data, during the annual eligibility redetermination. Effect: Failure to properly determine and close CHIP coverage resulted in improper payments. Recommendation: ALA staff recommend the Agency design and implement internal controls over compliance to ensure recipient files are up to date and eligibility determinations were determined appropriately. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. The error was caused by an eligibility system defect that was corrected in April 2024. Anticipated Completion Date: Complete Contact Person: Mary Franklin Director, Division of County Operations Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 681-8377 Mary.Franklin@dhs.arkansas.gov

Finding Number: 2025-026 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2405AR5021 Federal Award Year(s): 2024 Compliance Requirement(s) Affected: Special Tests and Provisions – Provider Eligibility (Fee for Service) Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: A similar issue was reported in prior-year finding 2024-025. Criteria: According to the Arkansas Medicaid Provider Manual section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has signed and submitted the following forms: • Application. • W-9 tax form. • Medicaid provider contract. • PCP agreement, if applicable. • EPSDT agreement, if applicable. • Change in ownership control or conviction of crime form. • Disclosure of significant business transactions form. • Specific license or certification based on provider type and specialty, if applicable. • Participation in the Medicare program, if applicable. 42 CFR § 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Section 141.100 of the Arkansas Medicaid Provider Manual states that revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. In accordance with 42 CFR § 455.450, screening activities vary depending on the risk category of the provider as follows: • The limited-risk category includes database checks. • The moderate-risk category includes those required for limited-risk plus site visits. • The high-risk category includes those required for moderate-risk plus fingerprint background checks. Condition and Context From a population of 6,525 providers, ALA staff reviewed files of 41 providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. ALA review revealed deficiencies with three of the provider files as follows: Moderate-risk category:  Sample item 27: The provider failed to provide documentation of a site visit that was due January 30, 2025. As a result, amounts paid to the provider with dates of service from January 30 through June 30, 2025, are considered questioned costs. Questioned costs totaled $112 (federal) and $28 (state). Limited-risk category:  Sample item 30: The provider’s revalidation was due by March 23, 2025, but was not completed until March 31, 2025. As a result, amounts paid to the provider with dates of service from March 23-30, 2025, are considered questioned costs. Questioned costs totaled $169 (federal) and $43 (state).  Sample item 35: The provider was terminated on October 25, 2024, after failing to revalidate by their due date of October 2, 2024. The provider re-enrolled on January 23, 2025, with an effective date of October 26, 2024. As a result, amounts paid to the provider with dates of service from October 2-25, 2024, are considered questioned costs. Questioned costs totaled $1,007 (federal) and $255 (state). Statistically Valid Sample: Not statistically valid sample. Questioned Costs: Federal – $1,288 State – $326 Cause: The Agency has asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. Although testing results support that improvements have been made since the new procedures were implemented, deficiencies continued to exist during fiscal year 2025. Effect: Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure that required revalidations are performed timely and required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. For Sample Item 27, a site visit has been completed for the provider. The process used for completion of site visits has been updated to address the cause for the delayed site visit. For Sample Items 30 and 35, DMS is currently developing system upgrades that will establish a revalidation date that is 60 days prior to the revalidation expiration date and auto-terminate providers at the time of their revalidation expiration date if they have not successfully completed the revalidation process. Anticipated Completion Date: 6/30/2026 Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2025-027 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2305AR5021; 05-2405AR5021 Federal Award Year(s): 2023 and 2024 Compliance Requirement(s) Affected: Special Tests and Provisions – Provider Eligibility (Managed Care Organizations) Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable. Criteria: According to the Arkansas Medicaid Provider Manual section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has signed and submitted the following forms: • Application. • W-9 tax form. • Medicaid provider contract. • PCP agreement, if applicable. • EPSDT agreement, if applicable. • Change in ownership control or conviction of crime form. • Disclosure of significant business transactions form. • Specific license or certification based on provider type and specialty, if applicable. • Participation in the Medicare program, if applicable. 42 CFR § 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Section 141.100 of the Arkansas Medicaid Provider Manual states that revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. In accordance with 42 CFR § 455.450, screening activities vary depending on the risk category of the provider as follows: • The limited-risk category includes database checks. • The moderate-risk category includes those required for limited-risk plus site visits. • The high-risk category includes those required for moderate-risk plus fingerprint background checks. Condition and Context: To determine if Managed Care Network providers met all necessary criteria to participate in the CHIP program, ALA selected 40 provider files for review from a population of 2,297. The selected providers participated in the Provider-Led Arkansas Shared Savings Entity, or PASSE, managed care program. ALA review revealed deficiencies with five of the provider files as follows: Moderate-risk category:  Sample item 28: The provider failed to revalidate timely. Revalidation was due by October 14, 2024, but was not completed until November 5, 2024. Ineligible costs totaled $8,204.  Sample item 30: The Agency failed to provide documentation of a site visit that was due August 15, 2024. Ineligible costs totaled $2,609. Finding Number: 2025-027 (Continued) AL Number(s) and Program Title(s): 93.767 – Children’s Health Insurance Program Condition and Context (Continued): Limited-risk category:  Sample item 8: The provider failed to revalidate timely. Revalidation was due by December 17, 2024, but was not completed until January 17, 2025. Ineligible costs totaled $855.  Sample item 11: The provider failed to revalidate timely. Revalidation was due by October 7, 2024, but was not completed until December 6, 2024. Ineligible costs totaled $197.  Sample item 12: The Agency failed to provide W-9 dated prior to October 3, 2024. Ineligible costs totaled $282. Ineligible costs identified above totaled $12,147. NOTE: Because these providers are participating in the managed care portion of CHIP, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients. These monthly payments are actuarially determined based, in part, upon historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: None Cause: The Agency has asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. Although testing results support that improvements have been made since the new procedures were implemented, deficiencies continued to exist during fiscal year 2025. Effect: Claims were processed and paid to providers that did not meet all the required criteria. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure that required revalidations are performed timely and that required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. For Sample Items 8, 11, and 28, DMS is currently developing system upgrades that will establish a revalidation date that is 60 days prior to the revalidation expiration date and auto-terminate providers at the time of their revalidation expiration date if they have not successfully completed the revalidation process. For Sample Item 30, a site visit has been completed for the provider. The process used for completion of site visits has been updated to address the cause for the delayed site visit. For Sample Item 12, DMS has implemented a system change to electronically collect information contained on the W-9 form which will eliminate the need for provider to submit the form. DHS is in the process of promulgating this policy change. Anticipated Completion Date: 6/30/2026 Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2025-028 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: N/A AL Number(s) and Program Title(s): 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2405AR5MAP; 05-2505AR5MAP Federal Award Year(s): 2024 and 2025 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: A similar issue was reported in prior-year finding 2024-027. Criteria: In accordance with 45 CFR § 75.303, a non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statues, regulations, and terms and conditions of the award. In addition, 42 CFR § 435.1009 states that federal financial participation (FFP) is not available for payments made on behalf of individuals who are inmates in public institutions, including eligible juveniles. To be considered an inmate of a public institution, a person must be living in an institution that is the responsibility of a governmental unit or over which a governmental unit exercises administrative control. Finally, under section 1001 of the Substance Use Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT Act), states are (1) prohibited from terminating the Medicaid eligibility of an “eligible juvenile” who becomes an inmate of a public institution, (2) required to process applications submitted by incarcerated youth, and (3) required to re-determine the Medicaid eligibility of eligible juveniles before their release from a public institution. An eligible juvenile is defined as a “juvenile who is an inmate of a public institution and who (A) was determined eligible for medical assistance under the State plan immediately before becoming an inmate of such a public institution; or (B) is determined eligible for such medical assistance while an inmate of a public institution.” In compliance with this requirement, Medical Services Manual section D-380 states that coverage for children entering the custody of the Division of Youth Services (DYS) will be placed in suspension status for up to 12 months from the initial approval or most recent renewal. When a child with suspended Medicaid eligibility receives eligible medical treatment off the grounds of the juvenile detention facility (inpatient services) or is released from custody, the child’s Medicaid case will be reinstated for a fixed eligibility period from the date of hospitalization to the date of hospital discharge. Once the child returns to the DYS state-run facility, the Medicaid case is re-suspended. Condition and Context: ALA selected 60 incarcerated juveniles with Medicaid claims activity to determine whether the State is properly suspending a juvenile’s benefit coverage when the juvenile is held in a public institution and properly reinstating coverage when the juvenile is placed in non-public institutions or released from DYS custody. ALA’s review also included ensuring that benefit payments were not made for dates of service that fell within the juvenile’s incarceration period. ALA review revealed the following deficiencies: • The Agency failed to appropriately suspend and reinstate benefits for 8 incarcerated juveniles. As a result, payments totaling $81,972 were made for dates of service within the incarceration periods for 7 juveniles. The federal and state portions of these payments totaled $58,557 and $23,415, respectively. • The Agency failed to appropriately suspend Medicaid benefits for 7 incarcerated juveniles in DYS custody. As a result, payments totaling $80,655 were made for dates of service within the juveniles’ incarceration periods. The federal and state portions of these payments totaled $57,455 and $23,200, respectively. • Although the Agency appropriately suspended and reinstated benefits for 6 incarcerated juveniles, payments totaling $14,047 were made for dates of service within the juveniles’ incarceration periods. The federal and state portions of these payments totaled $10,023 and $4,024, respectively. Statistically Valid Sample: Not statistically valid sample. Questioned Costs: Federal – $126,035 • $29,254 for award 05-2405AR5MAP • $96,781 for award 05-2505AR5MAP State – $50,639 Cause: The Agency failed to properly monitor Medicaid eligibility for juveniles in DYS custody. Suspensions of benefits were not always entered timely or were not entered into the system when an eligible juvenile was incarcerated. Effect: The Agency improperly received and used funds for payments made on behalf of incarcerated juveniles. Recommendation: ALA staff recommend the Agency design and implement internal controls over compliance to ensure that Medicaid benefits are properly suspended when eligible juveniles are incarcerated and properly reinstated when they are moved to private facilities or released from DYS custody, based on guidance set forth in the Medical Service Policy Manual and in compliance with federal regulations. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. For juveniles with SSI Medicaid, the Social Security Administration (SSA) is responsible for suspending Medicaid coverage. All incarcerations for cases noted in the findings involving SSI Medicaid, which make up 95% of the total questioned costs for this finding, were reported timely to SSA by the agency. All payments noted as questioned costs were capitated payments which will be recouped through an automatic reconciliation process. Anticipated Completion Date: 6/30/26 Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2025-029 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable ALN Number(s) and Program Title(s): 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2405AR5MAP; 05-2505AR5MAP Federal Award Year(s): 2024 and 2025 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: It is the State’s responsibility to ensure that claims and capitation payments are only paid for eligible Medicaid recipients and that any changes to a recipient’s eligibility be updated timely. According to Section I-600 of the Medical Service Policy Manual, DHS is required to act on any change that may alter eligibility within 10 days of receiving the change. Section I-610 of the manual indicates that a recipient loses eligibility upon death. Condition and Context: The Agency has established system controls to identify Medicaid recipients who are no longer eligible for programs due to death. To identify unreported deceased recipients, monthly recipient data is matched to Arkansas Department of Health (ADH) vital records data. Results of recipients matched to death records are uploaded to Arkansas Integrated Eligibility System (ARIES), where an ARIES task is created to alert the Division of County Operations (DCO) that the recipient may be deceased. DCO staff are to complete the task by determining whether the recipient is actually deceased, entering the date of death to the case file, and closing any open aid segments. Once the information is updated in ARIES and flows to the Medicaid Management Information System (MMIS), a retrospective review is performed to identify claims or capitation payments that were paid after the date of death for recoupment. Using data analytics, ALA compared a list of deceased individuals, obtained from ADH, to payment detail to identify recipients who had claims or capitation payments paid or adjusted in state fiscal year 2025 with dates of service after the date of death. To be included in the match results, the recipients’ social security numbers, dates of birth, and last names all had to match. ALA removed any subsequent recoupments reflected in the MMIS system prior to audit work on December 16, 2025, and calculated $404,857 remaining amounts paid on behalf of 891 deceased recipients. Information included in the MMIS system that was utilized in the initial match indicated $23,282 was paid on behalf of 68 recipients where there was a date of death for the recipient in the MMIS system and $381,575 was paid on behalf of 823 recipients where there was not a date of death in the MMIS system. Of the 68 recipients with a date of death in the MMIS system, 57 had a date of death that did not match the date of death per the ADH listing. Of the $404,857 paid on behalf of deceased recipients, $402,599 was related to financial capitation payments. Further review of the financial capitation payments revealed that $305,454 (76%) was applicable to the ARHome program, $60,635 (15%) was applicable to the Provider-Led Arkansas Shared Savings Entity (PASSE) program, and $36,510 (9%) was related to various other programs but primarily attributed to the Non-Emergency Transportation (NET) program and Dental Managed Care. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Federal – $346,165 • $21,188 for award 05-2405AR5MAP • $324,977 for award 05-2505AR5MAP State – $58,692 Cause: The Agency indicated in a response, dated November 30, 2025, that it was performing additional research related to the recipients included in the match results. Per the Agency, reasons a date of death was not included in the MMIS system for deceased recipients at the time the match was performed include the following: • ARIES did not receive the ADH date of death. • ARIES received the ADH date of death, but it was not added to ARIES when the worker competed the task. • ARIES received the ADH date of death, but the case was already closed. • Some SSI cases are either currently open or remained open after the ADH date of death. • Some beneficiaries’ eligibility was closed in the legacy eligibility systems but remained open in MMIS. Although the Agency has designed internal control procedures to ensure recipient files are updated upon the death of a recipient, certain areas still require continued communication between and training of the appropriate Agency personnel. Effect: Claims and capitation payments were made on behalf of deceased recipients who were not eligible for those payments. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure recipient files are updated timely when a recipient dies so that claims and financial capitation payments for dates of service after the date of death are not paid. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. For cases that included a date of death in MMIS, most deficiencies can be attributed to case worker error which is being addressed through continued worker education and training. A small number of deficiencies can be attributed to a variety of system errors which are in the process of being corrected. Recoupments of overpayments are also being processed. For cases with no date of death in MMIS, almost half were the result of the eligibility system not receiving the date of death via the monthly match to the Arkansas Department of Health (ADH) vital records data. DHS will work with ADH to identity date of death for those cases and identify any corrective action needed to the match process. The remaining deficiencies can be attributed to a variety of system errors which are in the process of being corrected and worker errors which is being addressed through worker education and training. Recoupments will be processed through both automatic reconciliation and manual processes. Anticipated Completion Date: 6/30/2026 Contact Person: Mary Franklin Director, Division of County Operations Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 681-8377 Mary.Franklin@dhs.arkansas.gov

Finding Number: 2025-030 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable ALN Number(s) and Program Title(s): 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2405AR5MAP; 05-2505AR5MAP Federal Award Year(s): 2024 and 2025 Compliance Requirement(s) Affected: Eligibility Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: The Agency is responsible for determining Medicaid recipients meet the eligibility criteria as specified in its approved State Plan. Eligibility requirements for Medicaid are outlined in the Arkansas Medical Services Manual. The Manual contains specific Medicaid policies and procedures that exist in addition to the approved State Plan. According to Section E-100 of the Manual, individuals receiving Medicaid Benefits must have a financial eligibility determination made, which includes an income test. Section G-111 of the Manual states that income is an eligibility factor that requires verification. It is the State’s responsibility to ensure that payments are only made for eligible Medicaid recipients and that any changes to a recipient’s eligibility, including those related to income, be updated timely. According to Section I-I00 of the Manual, individuals are required to report certain changes, including those related to income, within 10 days of the date the change occurred. Eligibility is redetermined when a change is reported. Condition and Context: The Agency notified ALA that they were performing an internal review of their employees receiving Medicaid benefits and, although the review was still on-going, had identified some individuals who were not eligible. As a result, ALA chose to perform a review of all State employees. Using data analytics, ALA compared a list obtained from the Arkansas Administrative Statewide Information System (AASIS) of Arkansas state employees who were employed throughout state fiscal year 2025 to Medicaid payment detail to identify recipients who had claims or capitation payments paid or adjusted in state fiscal year 2025. To be included in the match results the recipients’ social security numbers, dates of birth and last names all had to match. Using a risk-based approach, ALA selected 54 individuals from the matches for further review to determine the following: • The state employee properly reported his or her state income timely. • The state employee was income eligible based upon his or her state salary, household size, and eligibility segment to which payments were coded. • If the state employee was an employee of the Department of Human Services, he or she was included in the Agency's review of its employees receiving benefits. Of the 54 individuals tested, ALA identified deficiencies for 46 state employees, with overall questioned costs of $221,912 related to 40 individuals determined ineligible, as follows: • Although five individuals properly reported their income timely, these individuals were income ineligible. The questioned costs for ineligible dates of service for these five individuals totaled $40,322 ($32,991 federal and $7,331 State). All cases have since been closed. • There were 35 individuals who did not report their income or did not report their income timely, and all were income ineligible. The questioned costs for ineligible dates of service for these 35 individuals totaled $181,590 ($156,134 federal and $25,456 State). Twenty-eight cases were closed as of the date of fieldwork, and six cases were scheduled to be closed as of January 31, 2026. • Six individuals tested ultimately were income eligible but did not report their income or did not report their income timely. • Of the 13 individuals tested who were DHS employees, the Agency had reviewed 11 of these individuals but failed to include two of them in its internal review of employees as of the date of fieldwork. The Agency intends to review the two omitted individuals. For the 40 recipients deemed income ineligible noted above, 20 with a questioned cost amount of $57,075 ($40,771 federal and $16,304 State) were related to the Parent, Caretaker, Relative eligibility category and 20 with a questioned cost amount of $164,837 ($148,354 federal and $16,483 State) were related to the Adult Expansion eligibility category. Statistically Valid Sample: Not a statistically valid sample Questioned Costs: Federal − $189,125 • $52,616 for award 05-2405AR5MAP • $136,509 for award 05-2505AR5MAP State − $32,787 Cause: The Agency indicated that for the five individuals who properly reported their income but were income ineligible, one was the result of a system error, and the remaining four were related to worker error. In addition, for the 35 individuals who were income ineligible and had either not reported their income or did not report their income timely, two were related to worker error, and the Agency is researching why the income verification notification did not deploy in the system for the remaining 33. Effect: Payments were made on behalf of recipients who were not eligible for those payments. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure that system controls are properly functioning and workers are adequately trained to ensure that payments are not made on behalf of ineligible recipients. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. DCO will continue periodic matching and review of state employees with public assistance programs administered by the agency. Appropriate disciplinary action will continue to be taken by the agency on its own employees based on the outcome of case reviews. The agency will explore the addition of systematic data matching to ensure that salaries of state employees are properly reflected in the eligibility determination and benefit calculation for public assistance benefits. For additional controls, the agency has incorporated a notice into the hiring process regarding reporting all changes in household circumstance and annual communications to all staff regarding their reporting obligations. Anticipated Completion Date: 6/30/26 Contact Person: Mary Franklin Director, Division of County Operations Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 681-8377 Mary.Franklin@dhs.arkansas.gov

Finding Number: 2025-031 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2405AR5MAP; 05-2505AR5MAP Federal Award Year(s): 2024 and 2025 Compliance Requirement(s) Affected: Special Tests and Provisions – Provider Eligibility (Fee for Service) Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: A similar issue was reported in prior-year finding 2024-031. Criteria: According to the Arkansas Medicaid Provider Manual section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Enrollment is considered complete when a provider has signed and submitted the following forms: • Application. • W-9 tax form. • Medicaid provider contract. • PCP agreement, if applicable. • EPSDT agreement, if applicable. • Change in ownership control or conviction of crime form. • Disclosure of significant business transactions form. • Specific license or certification based on provider type and specialty, if applicable. • Participation in the Medicare program, if applicable. 42 CFR § 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Section 141.100 of the Arkansas Medicaid Provider Manual states that revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. In accordance with 42 CFR § 455.450, screening activities vary depending on the risk category of the provider as follows: • The limited-risk category includes database checks. • The moderate-risk category includes those required for limited-risk plus site visits. • The high-risk category includes those required for moderate-risk plus fingerprint background checks. Condition and Context: From a population of 11,634, ALA staff reviewed files of 41 providers to ensure sufficient, appropriate evidence was provided to support the determination of eligibility, including compliance with revalidation requirements. ALA’s review revealed deficiencies with four of the provider files as follows: Limited-risk category:  Sample item 13: The provider’s revalidation was due by October 14, 2024, but was not completed until October 15, 2024. As a result, amounts paid to the provider with a date of service of October 14, 2024, are considered questioned costs. Questioned costs totaled $2,550 (federal) and $1,035 (state).  Sample item 31: The provider’s revalidation was due by November 15, 2024, but was not completed. As a result, amounts paid to the provider with dates of service from November 15, 2024 through June 30, 2025, are considered questioned costs. Questioned costs totaled $1,928,915 (federal) and $782,520 (state). Condition and Context (Continued): Limited-risk category (Continued):  Sample item 35: The provider’s revalidation was due by June 24, 2024, but was not completed. As a result, amounts paid to the provider with dates of service from June 24, 2024 through June 30, 2025, are considered questioned costs. Questioned costs totaled $35,714 (federal) and $14,373 (state).  Sample item 40: The provider’s revalidation was due by November 14, 2024, but was not completed until December 4, 2024. In addition, the Agency failed to provide documentation of provider’s certification covering July 7, 2024 through November 14, 2024. As a result, amounts paid to the provider with dates of service from July 7, 2024 through December 3, 2024, are considered questioned costs. Questioned costs totaled $17,932 (federal) and $7,110 (state). Statistically Valid Sample: Not statistically valid sample Questioned Costs: Federal – $1,985,111 • $16,674 for award 05-2405AR5MAP • $1,968,437 for award 05-2505AR5MAP State – $805,038 Cause: The Agency asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. Although testing results support that improvements have been made since the new procedures were implemented, deficiencies continued to exist during fiscal year 2025. In addition, the Agency implemented a system update, effective June 27, 2023, that no longer required revalidation for providers of Early Intervention Day Treatment and Adult Developmental Day Treatment services but was unable to provide any authoritative guidance to support the update. This system update resulted in the deficiency reported for sample item 31 above. Effect: Claims were processed and paid to providers that did not meet all the required elements and, therefore, were ineligible. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure that required revalidations are performed timely and required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. For Sample Item 13, DMS is currently developing system upgrades that will establish a revalidation date that is 60 days prior to the revalidation expiration date and auto-terminate providers at the time of their revalidation expiration date if they have not successfully completed the revalidation process. For Sample Items 31, 35, and 40, DMS is currently developing a system change to reinstitute revalidation requirements for Early Intervention Day Treatment and Adult Developmental Day Treatment providers. Anticipated Completion Date: 6/30/2026 Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2025-032 State/Educational Agency(s): Arkansas Department of Human Services Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 93.778 – Medical Assistance Program (Medicaid Cluster) Federal Awarding Agency: U.S. Department of Health and Human Services Federal Award Number(s): 05-2405AR5MAP; 05-2505AR5MAP Federal Award Year(s): 2024 and 2025 Compliance Requirement(s) Affected: Special Tests and Provisions – Provider Eligibility (Managed Care Organizations) Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: A similar issue was reported in prior-year finding 2024-032. Criteria: According to the Arkansas Medicaid Provider Manual section 140.000, Provider Participation, any provider of health services must be enrolled in the Arkansas Medicaid Program prior to reimbursement for any services provided to Arkansas Medicaid beneficiaries. Managed Care Network providers must also be enrolled in the Arkansas Medicaid Program. Enrollment is considered complete when a provider has signed and submitted the following forms: • Application. • W-9 tax form. • Medicaid provider contract. • PCP agreement, if applicable. • EPSDT agreement, if applicable. • Change in ownership control or conviction of crime form. • Disclosure of significant business transactions form. • Specific license or certification based on provider type and specialty, if applicable. • Participation in the Medicare program, if applicable. 42 CFR § 455.414 (effective March 25, 2011, with an extended deadline of September 25, 2016, for full compliance) states that the State Medicaid Agency must revalidate the enrollment of all providers at least every five years. Section 141.100 of the Arkansas Medicaid Provider Manual states that revalidation includes a new application; satisfactory completion of screening activities; and if applicable, fee payment. In accordance with 42 CFR § 455.450, screening activities vary depending on the risk category of the provider as follows: • The limited-risk category includes database checks. • The moderate-risk category includes those required for limited-risk plus site visits. • The high-risk category includes those required for moderate-risk plus fingerprint background checks. Condition and Context: To determine if Managed Care Network providers met all necessary criteria to participate in the Medicaid program, ALA selected 40 provider files for review from a population of 5,605. The selected providers participated in the Provider-Led Arkansas Shared Savings Entity, or PASSE, managed care program. ALA review revealed deficiencies with seven of the provider files as follows: Moderate-risk category:  Sample item 16: The provider failed to revalidate timely. Revalidation was due by November 5, 2024, but was not completed until December 20, 2024. In addition, a site visit, also due by November 5, 2024, was not performed or verified until December 20, 2024. Ineligible costs totaled $1,559.  Sample item 37: The provider failed to revalidate timely. Revalidation was due by November 21, 2024, but was not completed until December 10, 2024. Ineligible costs totaled $1,845. Limited-risk category:  Sample item 3: The provider failed to revalidate timely. Revalidation was due by July 22, 2024, but was not completed until August 5, 2024. Ineligible costs totaled $129.  Sample item 5: The provider was terminated on October 25, 2024, after failing to revalidate by the due date of September 25, 2016. The provider re-enrolled on March 31, 2025. Ineligible costs totaled $182.  Sample item 24: The provider failed to revalidate timely. Revalidation was due by November 12, 2023, but was not performed. Ineligible costs totaled $272,174.  Sample item 30: The provider failed to revalidate timely. Revalidation was due by January 7, 2025, but was not completed until March 24, 2025. Ineligible costs totaled $11,356.  Sample item 40: The provider failed to revalidate timely. Revalidation was due by April 9, 2025, but was not completed until April 22, 2025. Ineligible costs totaled $641,247. Ineligible costs identified above totaled $928,492. NOTE: Because these providers are participating in the managed care portion of Medicaid, providers are reimbursed by the managed care organizations, not the Agency. The managed care organizations receive a predetermined monthly payment from the Agency in exchange for assuming the risk for the covered recipients. These monthly payments are actuarially determined based, in part, upon historical costs data. Accordingly, the failure to remove unallowable cost data from the amounts utilized by the actuary would lead to overinflated future rates, which will be directly paid by the Agency. Statistically Valid Sample: Not statistically valid sample Questioned Costs: None Cause: The Agency asserted that, effective May 31, 2019, it established and implemented new procedures to improve the following areas of provider enrollment: maintenance of provider enrollment application documents, provider revalidation, site visits, and fingerprint background requirements. Although testing results support that improvements have been made since the new procedures were implemented, deficiencies continued to exist during fiscal year 2025. In addition, the Agency implemented a system update, effective June 27, 2023, that no longer required revalidation for providers of Early Intervention Day Treatment and Adult Developmental Day Treatment services but was unable to provide any authoritative guidance to support the update. This system update resulted in the deficiency reported for sample item 24 above. Effect: Claims were processed and paid to providers that did not meet all the required criteria. Recommendation: ALA staff recommend the Agency review and strengthen controls to ensure that required revalidations are performed timely and required enrollment documentation is maintained to support provider eligibility. Views of Responsible Officials and Planned Corrective Action: DHS concurs with this finding. For Sample Items 3, 5, 30, 37, and 40, DMS is currently developing system upgrades that will establish a revalidation date that is 60 days prior to the revalidation expiration date and auto-terminate providers at the time of their revalidation expiration date if they have not successfully completed the revalidation process. For Sample Item 24, DMS is currently developing a system change to reinstitute revalidation requirements for Early Intervention Day Treatment and Adult Developmental Day Treatment providers. Anticipated Completion Date: 6/30/2026 Contact Person: Elizabeth Pitman Director, Division of Medical Services Department of Human Services 700 Main Street Little Rock, AR 72201 (501) 244-3944 Elizabeth.Pitman@dhs.arkansas.gov

Finding Number: 2025-033 State/Educational Agency(s): Arkansas Department of Public Safety – Division of Emergency Management Pass-Through Entity: Not Applicable AL Number(s) and Program Title(s): 97.036 – Disaster Grants (Public Assistance) Federal Awarding Agency: U.S. Department of Homeland Security – Federal Emergency Management Agency Federal Award Number(s): Various Federal Award Year(s): 2025 Compliance Requirement(s) Affected: Reporting Type of Finding: Noncompliance and Significant Deficiency Repeat Finding: Not applicable Criteria: In accordance with Appendix A of 2 CFR § 170, direct recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. In addition, 2 CFR § 200.303 requires that a recipient must establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Condition and Context: ALA staff searched information on the USAspending.gov website to determine whether the Agency is reporting subawards as required and discovered no subaward/contractor information is reported for Disaster Grants (Public Assistance) by the Arkansas Division of Emergency Management (ADEM). ADEM staff confirmed that no awards had been reported to FFATA system. Statistically Valid Sample: Not applicable Questioned Costs: None Cause: The Agency did not follow internal policies and procedures to ensure that first-tier subawards of $30,000 or more are reported to the FSRS or the System for Award Management (SAM). Effect: The Agency is not in compliance with Appendix A of 2 CFR § 170 and did not report first-tier subawards. Failure to file Federal Funding Accountability and Transparency Act (FFATA) subaward reports could result in the reduction or termination of future funding. Recommendation: ALA staff recommend the Agency strengthen controls by providing training on FFATA reporting requirements to ensure first-tier subawards are reported as required. Views of Responsible Officials and Planned Corrective Action: Arkansas Division of Emergency Management (ADEM) Public Assistance (PA) staff will receive training on FFATA reporting requirements and will follow established Department of Public Safety guidelines to ensure first-tier subawards are reported as required. ADEM PA staff will also establish internal Standard Operating Procedures to ensure that consistent FFATA reporting is accomplished as required. Anticipated Completion Date: 4/30/26 Contact Person: Jodi Lee Deputy Director, Recovery and Mitigation Arkansas Division of Emergency Management Building 9501 Camp Joseph T Robinson North Little Rock, AR 72199 (501) 683-6700 Jodi.Lee@adem.arkansas.gov