Audit 398893

State Agency: Illinois Governor’s Office of Management and Budget (GOMB) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Justice (DOJ), U.S. Department of Labor (DOL), U.S. Department of Transportation (DOT), U.S. Department of the Treasury (TREAS), U.S. Department of Education (USDE), U.S. Department of Health and Human Services (USDHHS), U.S. Department of Homeland Security (USDHS) Program Name: WIC Special Supplemental Nutrition Program for Women, Infants and Children, Cild and Adult Care Food Program (CACFP), Crime Victims Assistance Program (CVA), WIOA Cluster (WIOA), Highway Planning and Construction (Highway Planning), Coronavirus State and Local Fiscal Recovery Funds (SLFRF),Title I Grants to Local Educational Agencies (Title I), Special Education Cluster (IDEA), Twenty-First Century Community Learning Centers (Twenty-First Century), Supporting Effective Instruction State Grants (SEISG) Education Stabilization Fund (ESF), Aging Cluster, Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families (TANF), Child Support Services, Low-Income Home Energy Assistance (LIHEAP), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), Homeland Security Grant Program (Homeland Security) ALN and Program Expenditures: 10.557 ($181,526,312), 10.558 ($170,354,298), 16.575 ($53,095,634), 17.258/17.259/17.278 ($142,310,788), 20.205 ($2,192,857,212), 21.027 ($230,448,761), 84.010A ($696,900,040), 84.027/84.173 ($639,950,722), 84.287C ($61,131,992), 84.367A ($79,837,486), 84.425 ($2,176,294,000), 93.044/93.045/93.053 ($68,210,944), 93.323 ($94,269,102), 93.558 ($583,126,272), 93.563 ($135,029,923), 93.568 ($205,171,791), 93.575/93.596 ($747,612,292), 93.667 ($55,634,435), 93.959 ($114,897,412), 97.067 ($78,892,342) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-002: Inadequate Monitoring of Subrecipient Single Audit Reviews Condition Found: The State of Illinois did not establish adequate controls to monitor the completion and documentation of the review of single audit reports for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Child and Adult Care Food Program (CACFP), Crime Victims Assistance Program (CVA), WIOA Cluster (WIOA), Highway and Planning Construction (Highway), Coronavirus State and Local Fiscal Recovery Funds (SLFRF), Title I Grants to Local Education Agencies (Title I), Special Education Cluster (IDEA), Twenty-First Century Community Learning Centers (Twenty-First Century), Supporting Effective Instruction State Grants (SEISG), Education Stabilization Funds (ESF), Aging Cluster (Aging), Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families (TANF), Child Support Services (CSS), Low-Income Home Energy Assistance (LIHEAP), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), and Homeland Security Grant (Homeland Security) programs in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of GATA on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State and working with program personnel to issue management decisions on findings. The State utilizes a contractor to perform the centralized functions of obtaining the single audit report, verifying the report meets the requirements, and assigning findings to the applicable State agency. During our testing of subrecipient single audit desk review files for our 2024 major programs, we noted instances where single audit desk reviews were still in process and had not been finalized within GATA ARRMS as of the date of our testing (July 10, 2025). Upon further review of data contained within GATA ARRMS, we identified 637 single audit reviews were identified as incomplete in GATA ARRMS for grantees who: (1) reported expenditures under fiscal year 2024 major programs, (2) had an audit report with a Federal Audit Clearinghouse acceptance date between January 2, 2023 and January 2, 2024 (requiring the report to be reviewed during fiscal year 2024) and (3) were not sanctioned (placed on the Illinois Stop Payment List) by the State for noncompliance with reporting requirements. These 637 reviews were in varying stages of completion with the majority (587 audits) pending documentation supporting the issuance of a final completion letter by the cognizant agency. The remaining 50 audits (7.8%) were pending receipt of documentation, pending a review, or had another error requiring follow-up. These 637 audits included 295 audits (46.3%) with one or more findings potentially requiring a management decision to be issued. We noted the cognizant agencies for the 637 incomplete single audit reviews in GATA ARRMS were as follows: "See Table in the Audit Report" The 637 incomplete single audit reviews in GATA ARRMS pertained to subrecipients of the following major programs: "See Table in the Audit Report" While in many instances there was evidence the State agencies had completed the necessary procedures outside of GATA ARRMS, the purpose of GATA ARRMS is to reduce the duplication of effort across State agencies and to provide a single submission point for the State’s subrecipients. The lack of monitoring controls around this centralized process may result in noncompliance with subrecipient single audit desk review requirements. The State’s subrecipient expenditures under the federal programs for the year ended June 30, 2024 were as follows: "See Table in the Audit Report" Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure the federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. Further, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on audit findings within six months of acceptance of the audit report by the FAC and ensure that the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include implementing procedures to monitor whether single audit reports are reviewed, management decision letters are issued, and single audit desk review files are closed out in GATA ARRMS in a timely manner. Cause: In discussing these conditions with GOMB officials, management stated that the incompleteness of the State’s audit reviews in GATA ARRMS was due to oversight. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in GATA ARRMS in a timely manner may result in noncompliance with the State’s obligation as a pass-through entity to appropriately monitor its subrecipients. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-002. (Finding Code 2024-002, 2023-002) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend GOMB establish procedures to monitor the completion and documentation of single audit report reviews in GATA ARRMS to ensure the State complies with its obligation as a pass-through entity. Views of GOMB Officials: GOMB agrees with the finding.

State Agency: Illinois Governor’s Office of Management and Budget (GOMB) Federal Agency: U.S. Department of the Treasury (TREAS) Program Name: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN and Program Expenditures: 21.027 ($230,448,761) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-003: Failure to Accurately Prepare Performance Reports for the COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Program Condition Found: GOMB did not prepare accurate federal project and expenditure reports (Paperwork Reduction Act (PRA) 1505-0271) for the COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program. The State was required to prepare quarterly federal project and expenditure reports (PRA 1505-0271) for the CSLFRF program. To assist the State agencies, GOMB prepared these reports. According to the U.S. Treasury’s SLFRF Compliance and Reporting Guidance, expenditures may be reported on a cash or accrual basis, as long as the methodology is disclosed and consistently applied. During our testing of two quarterly PRA 1505-0271 reports submitted during State fiscal year ended June 30, 2024, we noted that GOMB did not consistently apply cash or accrual basis for reporting and noted the following errors on the cash basis: "See Table in the Audit Report" Supervisory review procedures of the PRA 1505-0271 reports have not been designed to operate at an appropriate level of precision to ensure the financial reports are accurately prepared. Criteria or Requirement: 2 CFR 200.328 requires grantees to submit PRA 1505-0271 reports with the frequency required by the terms and conditions of the federal award. The State and Local Fiscal Recovery Funds: Project and Expenditure Report User Guide requires grantees to submit quarterly reports with current financial information, including current period and cumulative obligations and expenditures. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure financial information reported in required financial reports is complete and accurate prior to submission. Cause: In discussing these conditions with GOMB officials, management stated the reporting errors were a result of inaccurate information submitted to GOMB by other State agencies which were not detected. Possible Asserted Effect: Failure to prepare complete and accurate financial reports prevents the U.S. Treasury from effectively monitoring the CSLFRF program. Repeat Finding: A similar finding was reported in the prior year audit as finding code 2023-003. (Finding Code 2024-003, 2023-003) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend GOMB implement more precise review procedures to ensure the reports submitted to the U.S. Treasury are complete, accurate, and agree or reconcile to its financial records. Views of GOMB Officials: GOMB agrees with the recommendation. GOMB will continue to work with the State agencies to produce accurate financial reporting for the CSLFRF program.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of the Treasury (TREAS) Program Name: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds ALN and Program Expenditures: 21.027 ($230,448,761) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-004: Inadequate Monitoring of Subrecipients of the CSLFRF Program Condition Found: Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) program during the year ended June 30, 2024. Multiple State agencies are involved in awarding, expending, and administering funding under the CSLFRF program in Illinois. As a result, each State agency is responsible for monitoring the subrecipients they award CSLFRF funding. As a pass-through entity of the CLSFRF program, IDHS was responsible for: • Identifying the awards and applicable requirements, • Evaluating each subrecipient’s risks of noncompliance for purposes of determining the appropriate monitoring procedures related to the subaward, • Monitoring the activities of each subrecipient as necessary to ensure the subaward is used for authorized purposes, the subrecipients comply with the terms and conditions of the subawards, and the subrecipients achieve performance goals, and • Issuing a management decision for audit findings pertaining to the federal award provided to each subrecipient, if applicable. IDHS requires CSLFRF subrecipients to provide periodic performance reports which contain performance measures and program accomplishments to permit IDHS to monitor CSLFRF program results. During our testing of documentation provided by IDHS for 28 CSLFRF grantees (with expenditures of $23,703,366), IDHS could not provide evidence periodic performance reports were obtained or reviewed during the audit period by IDHS for 26 of the subrecipients tested. Because the CSLFRF program funds a variety of State programs operated by various program areas and bureaus within IDHS, we noted a variety of report templates were received and methods were used to document reviews. Accordingly, we noted the date certain periodic performance reports were received and reviewed by IDHS could not be validated as they were documented electronically in a spreadsheet which can be modified. Amounts passed through by IDHS to CSLFRF subrecipients totaled $28,591,405 during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(c), a pass-through entity must evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. 2 CFR 200.332(e)(3) requires pass-through entities to issue management decisions for applicable audit findings pertaining to the federal awards provided to the subrecipient and 2 CFR 200.332(e)(4) requires pass through entities to resolve audit findings through corrective action plans (CAP). In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include performing monitoring procedures in accordance with Uniform Guidance and program requirements. Cause: In discussing these conditions with IDHS officials, management stated IDHS was unable to produce all requested Periodic Performance Reports (PPR) and evidence of review due to inconsistency in applied procedures, staffing changes, and the lack of a central repository. Possible Asserted Effect: Failure to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Repeat Finding: 2024-004, 2023-018) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS implement subrecipient monitoring procedures in accordance with federal regulations. Views of IDHS Officials: The Department accepts the recommendation. IDHS recognizes the importance of performance monitoring and will implement additional controls to ensure evidence is maintained to support that PPRs are obtained from subrecipients and are appropriately reviewed by IDHS.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA) Program Name: Food Distribution Cluster ALN and Program Expenditures: 10.565/10.568/10.569 ($67,875,839) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Accountability for USDA Foods Finding 2024-005: Inadequate Review of Recipient Agencies of the Food Distribution Cluster Program Condition Found: IDHS did not adequately review the recipient agencies of the Food Distribution Cluster (FDC) program. IDHS has entered into agreements with seven subrecipients (recipient agencies) that operate the FDC program locally across the State of Illinois. The USDA purchases and provides food and administrative funds to IDHS, which in turn provides the USDA foods and a portion of the administrative funds to the recipient agencies. IDHS has implemented procedures where FDC program staff perform annual reviews of the storage facilities operated by the recipient agencies. These annual reviews include inspecting the annual inventory records of USDA foods maintained by the recipient agency. During State fiscal year 2024, we noted IDHS did not perform annual reviews for five recipient agencies (with food commodities of $61,824,064), including the two largest recipients of USDA food commodities in the State (with food commodities of $40,050,222). Additionally, during our testing of the annual reviews for two recipient agencies (with food commodity expenditures of $5,786,867), we noted IDHS’ review procedures did not include a reconciliation of the annual inventory count performed by the recipient agency to USDA food records as required by program regulations. IDHS passed through $67,620,931 to the seven recipient agencies during the year ended June 30, 2024. Criteria or Requirement: In accordance with 7 CFR 247.28(b), a physical inventory of all USDA Foods must be conducted annually at each storage and distribution site where USDA Foods are stored. Results of the physical inventory must be reconciled with inventory records and maintained on file by the State or local agency. In addition, 7 CFR 250.12 states on an annual basis the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subdistributing agency), and must reconcile physical and book inventories of donated foods.2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to reconcile recipient agency food inventory records to USDA food records and ensure all recipient agencies are reviewed annually. Cause: In discussing these conditions with IDHS officials, management stated that IDHS was unaware of an annual requirement to obtain year-end inventory counts performed by recipient agencies and to reconcile the counts to USDA food records. IDHS was obtaining and reconciling inventory records during the on-site Quality Assurance Reviews. Possible Asserted Effect: Failure to obtain and reconcile physical inventory records for all recipient agencies could result in food commodities not being used in accordance with program requirements and results in noncompliance with federal program requirements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-005) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS update procedures and controls to ensure the annual review of recipient agencies includes reconciling the inventory records of the recipient agency to USDA food records or establish a separate process to obtain and reconcile physical inventory records. Views of IDHS Officials: The Department accepts the recommendation. IDHS employees responsible for The Emergency Food Assistance Program (TEFAP) will update the current procedure manual to require annual inventory counts and reconciliation of inventory records be submitted for all recipient agencies at the end of each state fiscal year. IDHS will implement procedures to ensure that the records obtained from recipient agencies are reconciled to USDA Food records annually.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.558 ($583,126,272), 93.575/93.596 ($747,612,292) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Activities Allowed/Unallowed, Allowable Costs/Cost Principles Finding 2024-006: Inadequate Process for Monitoring Interagency Program Expenditures Condition Found: IDHS does not have an adequate process for monitoring interagency expenditures claimed under or used to meet maintenance of effort (MOE) requirements of the Temporary Assistance for Needy Families (TANF) and CCDF Cluster (CCDF) programs. Federal and State expenditures under the TANF and CCDF Cluster programs are comprised of programs operated by various State agencies. As the State agency responsible for administering these programs, IDHS has executed interagency agreements with each of the State agencies expending federal and/or State program funds. The interagency agreements require periodic reporting of a summary of the agency’s “allowable” expenditures to IDHS for preparation of the financial reports required for each program. As the State agencies expending program funds do not determine under which program IDHS reports their expenditures, IDHS is responsible for establishing procedures to ensure the expenditures reported by the expending State agencies meet the specific requirements applicable to the federal program. During the year ended June 30, 2024, IDHS reported expenditures from other agencies that were claimed for reimbursement or used to meet MOE requirements as follows: "See Table in the Audit Report" IDHS’ procedures to monitor other State agencies expending program funds reported by IDHS include the following: • Interagency agreements were reviewed and updated (where necessary) to include all State programs claimed under or used to meet MOE requirements of the TANF and CCDF Cluster programs in its interagency agreement. • Program questionnaires were updated where necessary and distributed to each of the State agencies to assist in documenting the nature of the expenditures provided to IDHS and the internal controls established to ensure compliance with the applicable federal regulations. • Quarterly certification reports were collected from each of the State agencies to support amounts reported in the federal reports required for each federal program. • Expenditure details were obtained from each of the State agencies and were reconciled to the quarterly certifications. However, during our test work over the documentation of the monitoring procedures discussed above, we noted the following deficiencies: • Program questionnaires describing internal control procedures for the CCDF program were not obtained by IDHS from the Illinois Student Assistance Commission, Illinois Board of Higher Education, and Illinois Community College Board. Rather, a more limited questionnaire was obtained in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS) which is used to complete risk assessments procedures for the State’s subrecipients. • Quarterly certification reports were not prepared during the period for the CCDF program by the Illinois Student Assistance Commission, Illinois Board of Higher Education, and Illinois Community College Board. IDHS did not perform a detailed review of costs claimed from expenditures reported by any of the other State agencies to ensure they met the specific program requirements. The other State agencies do not necessarily know which federal program or maintenance of effort requirement the costs they are providing to IDHS will be claimed or used and are not able to assess whether the costs are allowable. Further, IDHS did not assess whether the expenditures reported by other State agencies were paid during State fiscal year 2024 to ensure the amounts reported to the Illinois Office of Comptroller (IOC) and used to prepare the schedule of expenditures of federal awards (SEFA) were cash basis expenditures. • During our detailed testing over CCDF funds expended by the Illinois Student Assistance Commission and Illinois Community College Board, we noted the amounts passed through to ISAC that were initially reported on the final expenditure questionnaire received for audit did not reconcile to the amount of expenditures on a cash basis for SEFA reporting. Further, we noted the amounts were reported as subrecipient expenditures, however, ultimately were reclassified as beneficiary payments, resulting in a SEFA error. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statement which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with IDHS officials, management stated the current monitoring process was not adequate to ensure interagency expenditures and MOE of federal monies from other State agencies met applicable program regulations as they relate to TANF and CCDF. Possible Asserted Effect: Failure to properly monitor interagency expenditures may result in claiming of expenditures that are inconsistent with the objectives of the federal program and federal funds being expended for unallowable purposes. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-017. (Finding Code 2024-006, 2023-017) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for identifying and reporting interagency expenditures and implement monitoring procedures to ensure that federal and state expenditures expended by other State agencies meet the applicable program regulations. Views of IDHS Officials: IDHS accepts the recommendation. IDHS will establish additional controls to ensure expenditures related to federal grants (including those made by other agencies and those made to subrecipients) are accurately reported. IDHS will implement additional monitoring procedures over interagency expenditures to include sampling and review of supporting documentation to ensure the expenditures meet federal program requirements.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.558 ($583,126,272), 93.575/93.596 ($747,612,292), 93.667 ($55,634,435), 93.959 ($114,897,412) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Subrecipient Monitoring Finding 2024-007: Failure to Follow Established Program Subrecipient Monitoring Procedures Condition Found: IDHS did not follow its established program monitoring policies and procedures for subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care Development Fund Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. IDHS has implemented procedures whereby program staff perform periodic program on-site and desk reviews of IDHS subrecipient compliance with regulations applicable to the federal programs administered by IDHS. IDHS also has implemented procedures whereby staff perform periodic on-site and desk reviews of IDHS subrecipient compliance with fiscal and administrative requirements applicable to multiple State and federal programs. Generally, these reviews are formally documented and include the issuance of a report of the review results to the subrecipient summarizing the procedures performed, results of the procedures, and any findings or observations for improvement noted. IDHS’s policies require the subrecipient to respond to each finding by providing a written corrective action plan. Additionally, IDHS program staff perform reviews of expenditure reports submitted by subrecipients. IDHS subrecipient monitoring procedures are subject to the review and approval of a supervisor. During our test work over program on-site review procedures performed for 82 subrecipients of the TANF, CCDF, SSBG, and SAPT programs, we noted IDHS did not follow its established program monitoring procedures as follows: We tested the program on-site review procedures and fiscal administrative review procedures performed by IDHS during the year ended June 30, 2024 for a sample of subrecipients of the TANF, CCDF, SSBG, and SAPT programs comprised of the following: "See Table in the Audit Report" We noted the following exceptions in our testing of program on-site reviews performed during the year ended June 30, 2024: ● IDHS did not perform on-site monitoring reviews of subrecipients in fiscal year 2024 in accordance with IDHS’ planned monitoring schedule and/or could not provide support for the review. Specifically, we noted the following exceptions: "See Table in the Audit Report" ● IDHS did not provide timely notification (within 60 days) of the results of the programmatic on-site reviews. We noted the following exceptions: "See Table in the Audit Report" ● IDHS did not complete their quality review on a timely basis (within 60 days). We noted the following exceptions: "See Table in the Audit Report" ● IDHS did not receive a corrective action plan from the subrecipient after findings were identified during the review. We noted the following exceptions: "See Table in the Audit Report" During our testing of 31 fiscal and administrative reviews performed for subrecipients of all IDHS’ federal and State programs, we noted IDHS did not provide timely notification (within 180 days) of the results of the fiscal and administrative reviews. Specifically, we noted the delays in the reporting of results to two subrecipients tested ranged from 32 days to 50 days. IDHS could not provide documentation evidencing communication or follow up being performed for these subrecipients during the extended review period. In addition, we noted the SAPT program requires subrecipients to submit periodic reports to allow IDHS to monitor certain programmatic performance metrics. These reports are reviewed quarterly by IDHS program personnel. Any subrecipients who meet less than 80% of the performance metrics reported are also required to submit a corrective action plan to IDHS. During our testing, we noted IDHS was unable to provide documentation evidencing monitoring of the quarterly program reports for our sample of 25 subrecipients (with expenditures of $52,116,654 during the year ended June 30, 2024). Further, IDHS did not have adequate policies or procedures to ensure fiscal and administrative reviews were completed timely to detect potential non-compliance. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. According to 2 CFR 200.332(b), a pass-through entity must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring on-site program procedures and expenditure reviews are performed in a timely manner and adequate documentation is maintained. Cause: In discussing these conditions with IDHS officials, management stated that the deficiencies noted are due to a combination of factors including operational constraints due to staffing, oversight, system transitions, and a need to strengthen governance over timeliness, monitoring and documentation controls. Possible Asserted Effect: Failure to adequately perform and document program on-site monitoring reviews of subrecipients and notify subrecipients of findings in a timely manner may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Failure to properly review subrecipient expenditures may result in inaccurate payments or unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-010. (Finding Code 2024-007, 2023-010, 2022-008, 2021-017, 2020-015, 2019-013, 2018-012, 2017-013, 2016-012, 2015-011, 2014-008, 2013-009, 12-07, 11-09) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS ensure programmatic on-site and expenditure report reviews are performed and documented for subrecipients in accordance with established policies and procedures. In addition, we recommend IDHS review its process for reporting and following up on program findings relative to subrecipient on-site reviews to ensure timely corrective action is taken. Views of IDHS Officials: The Department accepts the recommendation. IDHS will work to ensure programmatic on-site and expenditure report reviews are completed and documented in accordance with policies and procedures and review its process for reporting and follow up on program findings resulting from on-site reviews. IDHS will continue to work to fill vacancies, administer training programs, increase oversight, develop automated processes, and revise procedures to improve internal controls over these functions.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Social Services Block Grant ALN and Program Expenditures: 93.667 ($55,634,435) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-008: Inadequate Procedures to Determine Accuracy of the Post Expenditure Report Condition Found: IDHS failed to provide supporting documentation for the post-expenditure report including a key line item, the number of eligible individuals who received services paid for in part or in whole with federal funds under the Social Services Block Grant (Title XX) program. During our testing of the 2023 post-expenditure report, we noted the total individuals served was reported as 216,991. This line item represents services provided by various departments and third parties. In reviewing the summary schedule used to support these line items, we noted supporting documentation was not available to identify the individuals served for certain line items or did not match the individuals reported on the summary schedule. As a result, testing a sample of individuals to verify the individual was eligible for the service received could not be performed. We noted the following exceptions in our testing of the 2023 post-expenditure report: "See Table in the Audit Report" Internal controls have not been established to ensure required supporting documentation is maintained. Criteria or Requirement: 42 USC 1397e requires states to submit to the federal administering agency an annual post-expenditure report. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include retaining support for the post-expenditure report and a formalized methodology to ensure the reporting is consistent and accurate. Cause: In discussing these conditions with IDHS officials, management stated uniform procedures were still being implemented to track client listings and retain documentation supporting the annual report. Possible Asserted Effect: Failure to completely and accurately report SSBG individuals served could result in incomplete and/or inaccurate data being submitted to the federal administering agency. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-006. (Finding Code 2024-008, 2023-006) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to maintain documentation supporting the post-expenditure report. IDHS should also establish supervisory review procedures to ensure the report is complete, accurate, and properly supported. Views of IDHS Officials: The Department accepts the recommendation. IDHS will work to establish uniform procedures to ensure the maintenance of documentation supporting the post-expenditure report. Additionally, IDHS will establish a supervisory review process to ensure the report is complete, accurate, and properly supported.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA) U.S. Department of Health and Human Services (USDHHS) Program Name: SNAP Cluster, Temporary Assistance for Needy Families, Children’s Health Insurance Program, Medicaid Cluster ALN and Program Expenditures: 10.551/10.561 ($4,687,993,367), 93.558 ($583,126,272), 93.767 ($510,412,808), 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Eligibility, Special Tests and Provisions – Penalty for Refusal to Work, Special Tests and Provisions – ADP System for SNAP Finding 2024-009: Missing Documentation in Beneficiary Files Condition Found: IDHS could not locate case file documentation supporting certain eligibility and special test requirements for beneficiaries of the Temporary Assistance for Needy Families (TANF) program and Children’s Health Insurance Program (CHIP). During our test work, we selected 50 TANF and 80 CHIP eligibility files to review for compliance with eligibility requirements and for the allowability of the related benefits provided. We also selected 40 Penalty for Refusal to Work (Refusal to Work) beneficiaries to review for compliance with the respective special test and provision requirements. We noted the following exceptions: • In one of 50 TANF cases (with a payment sampled of $255), IDHS could not provide the completed and signed redetermination by the beneficiary covering the payment date. Total TANF cash assistance paid to this beneficiary during the year ended June 30, 2024 totaled $590. • In six of 40 TANF Refusal to Work special test cases, IDHS could not provide evidence that a Responsibility Service Plan (RSP) was obtained and signed by the beneficiary. TANF cash assistance paid to these beneficiaries during the year ended June 30, 2024 totaled $30,309. • In one of 80 CHIP cases (with a sampled medical expenditure of $7,483), the case was classified as eligible due to the beneficiary having a disability; however, the case record did not include documentation supporting the determination of a disability. Total payments made on behalf of this beneficiary under the CHIP program were $14,229 during the year ended June 30, 2024. Details of the beneficiary payments selected in our samples for the TANF program are as follows: "See Table in the Audit Report" We also noted IDHS does not have adequate resources to perform and document eligibility determinations. Additionally, IDHS has not established appropriate monitoring procedures to ensure eligibility determinations are properly documented in accordance with program requirements. Because the State uses a single application and eligibility determination process for the Supplemental Nutrition Assistance Program Cluster (SNAP), TANF, Medicaid Cluster, and State Children’s Health Insurance Program (CHIP) programs, the TANF and CHIP eligibility compliance exceptions and the inadequate internal control matters discussed above also impact the SNAP Cluster and Medicaid Cluster programs. "See Table in the Audit Report" Criteria or Requirement: According to 42 USC 602(a)(1)(B)(iii) (the State Plan for TANF), IDHS is required to determine client eligibility in accordance with eligibility requirements defined in the approved State Plans. The TANF State Plan amended December 2022, Section L Personal Responsibility, requires all adults and minor parents applying for or receiving assistance be required to sign a RSP and follow through with its provisions. The TANF State Plan also required an application to be completed to apply for assistance. For refusal to work, the State must reduce or terminate the assistance payable to the family if an individual in a family receiving assistance refuses to work, subject to any good cause or other exemptions established by the State (42 USC 609(a)(14); 45 CFR sections 261.14, 261.16, and 261.54). In accordance with 42 CFR 435.948 through 435.956 and the OMB Compliance Supplement, dated May 2024, the State is required to verify financial and nonfinancial factors of eligibility in accordance with eligibility requirements defined in the approved State Plans for the CHIP and Medicaid programs. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include maintaining adequate controls over beneficiary case files to ensure all required documentation is obtained, and appropriate sanctions applied. Cause: In discussing these conditions with IDHS officials, IDHS management stated the exceptions noted were due to completing the TANF Responsibility and Service Plans (RSP’s) by telephone. The current process is to send a manual RSP signature page and manually track it for return. Possible Asserted Effect: Failure to maintain RSPs, applications, or other eligibility documentation may result in inadequate documentation of a recipient’s eligibility and in federal funds being paid to ineligible beneficiaries. Repeat Finding: A similar finding was reported in prior year audit as finding number 2023-007. (Finding Code 2024-009, 2023-007, 2022-005, 2021-011, 2020-010, 2019-005, 2018-004, 2017-004, 2016-004, 2015-004, 2014-004, 2013-004, 12-04, 11-04, 10-06, 09-06, 08-08, 07-19, 06-16, 05-30, 04-18, 03-20, 02-26, 01-15) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for collecting and maintaining TANF/CHIP eligibility support and documentation to support the appropriate TANF application of sanctions. Views of IDHS Officials: IDHS accepts the recommendation and will work to ensure support for all eligibility items is properly retained in the record.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families ALN and Program Expenditures: 93.558 ($583,126,272) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $78,162 Compliance Requirement: Eligibility Finding 2024-010: Improper TANF Beneficiary Payments Condition Found: IDHS made improper payments to beneficiaries of the Temporary Assistance for Needy Families (TANF) program. During our testing of 50 TANF program beneficiary payments (with total payments sampled of $19,049), we noted one beneficiary (with a sampled payment of $262) received supplemental payments that were improperly calculated using amounts inconsistent with information contained in the beneficiary’s case file. As a result of the calculation error, the beneficiary was not eligible to receive the monthly supplemental payment. Total supplemental payments made to this beneficiary under the TANF program totaled $2,358 during the year ended June 30, 2024. We also noted two TANF beneficiary payments sampled (totaling $581) that were improperly calculated due to a diverted income system error. Diverted income occurs in dependent eligible only TANF cases where an ineligible working adult in the household has income which is allocated to the eligible members of the household to determine the overall TANF program benefit payment. The State’s benefit system was erroneously excluding the ineligible working adult in the diverted income calculation potentially resulting in an overpayment of TANF benefits on cases with diverted income. As a result of this error, the monthly payments made to these two beneficiaries were overstated by $244. Total payments made to these two beneficiaries under the TANF program were $5,130 for the year ended June 30, 2024. In response to the error identified in our testing, IDHS identified benefit payments paid during the year ended June 30, 2024 for 1,956 beneficiaries (totaling $7,238,104) were calculated using diverted income. The system calculation error related to these benefit payments resulted in total TANF overpayments of $75,804 during the year ended June 30, 2024. The payment errors identified above had not been corrected by IDHS or refunded to USDHHS (if required) as of the date we communicated our findings to IDHS (December 22, 2025). We further noted IDHS did not establish control procedures at an adequate level of precision to ensure TANF program benefits were accurately calculated based on the beneficiary’s case file supporting documentation. Payments made to beneficiaries of the TANF cash assistance program totaled $45,021,831 during the year ended June 30, 2024. Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that each expenditure must be necessary, reasonable, and supported by adequate documentation.In accordance with the OMB Compliance Supplement, dated May 2024, IDHS is required to determine eligibility in accordance with eligibility requirements defined in the approved State Plan. The current State Plan requires payments to be made to eligible beneficiaries in accordance with payment levels established within the State Plan. Further, the State Plan requires an excluded or ineligible individual’s income to be considered in the calculation of the payment level of the TANF unit. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing internal control at an appropriate level of precision to identify benefit payment errors in a timely manner. Cause: In discussing these conditions with IDHS officials, management stated the exceptions noted were due to an oversight to secure or upload supporting documentation adequately and case actions not being thoroughly reviewed. Possible Asserted Effect: Failure to properly calculate benefit payments may result in unallowable costs being charged to the TANF program. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-016. (Finding Code 2024-010, 2023-016) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for calculating beneficiary payments and consider changes necessary to ensure payments are properly calculated and paid. Views of IDHS Officials: The Department accepts the recommendation. IDHS will review its current process for calculating beneficiary payments and make changes to ensure payments are properly calculated and paid.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.558 ($583,126,272), 93.575/93.596 ($747,612,292) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $1,317 (TANF Federal), $1,527 (TANF MOE), $1,174 (CCDF Federal), $372 (CCDF MOE) Compliance Requirement: Activities Allowed/Unallowed, Allowable Costs/Cost Principles Finding 2024-011: Unallowable Costs Charged to the TANF and CCDF Cluster Programs Condition Found: IDHS could not provide documentation to support payments made on behalf of beneficiaries of the Temporary Assistance for Needy Families (TANF) and Child Care and Development Fund (CCDF) Cluster programs. The State of Illinois operates the Child Care Assistance Program (CCAP) which provides eligible families child care services at approved, licensed providers. Payments are made by IDHS directly to the child care provider on behalf of an eligible family. Providers submit billings to IDHS detailing the name of the recipient of the services and the number of days for which services were received. IDHS performs monitoring reviews of childcare providers on a rotational basis. During these monitoring reviews, IDHS reviews provider records to ensure services billed are adequately documented. During our testing of CCAP beneficiary payments claimed under the TANF program (40 payments totaling $8,555 in federal claim and $34,968 in MOE claim) and CCDF (40 payments totaling $108,666 in federal claim and $3,882 in MOE claim), we noted four TANF payments and three CCDF payments for which IDHS could not provide documentation supporting the services provided to eligible beneficiaries which are unallowable costs. These unallowable expenditures were reported and claimed to federal programs as follows: "See Table in the Audit Report" Additionally, we noted IDHS has not performed a monitoring review in 2024 or either of the previous two fiscal years to ensure billing information provided by the child care providers is accurate for 50 of the 62 unique providers sampled. As a result, IDHS does not have adequate controls in place to ensure information provided by providers is accurate and the related child care payments made were appropriate. Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that each expenditure must be necessary, reasonable, and supported by adequate documentation. Additionally, 45 CFR 98.67 requires lead agencies to expend and account for CCDF funds in accordance with their own laws and procedures, and for fiscal control and accounting procedures to be sufficient to permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of those laws and procedures. IDHS CCAP Policy Memo 07.10.01 requires the agency to perform monitoring reviews over all Child Care Resource and Referrals (CCR&Rs), site administered, and non-contracted child care providers who participate in the IDHS Child Care Assistance Program. These reviews are conducted to ensure that services billed to the Department are adequately documented and contractual obligations are fulfilled. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should be designed to ensure that supporting documentation for CCAP payments is obtained and maintained. Additionally, effective internal controls should be designed to ensure that billing information provided by providers is complete and accurate. Cause: In discussing these conditions with IDHS officials, management stated that submission of billing certificates to IDHS or its contracted agencies is not a condition of payment. Additionally, CCAP payments cited were entered by the providers through the IDHS Child Care Telephone Billing System - Integrated Voice Response (IVR) and IDHS did not have established procedures for monitoring these recipients. Possible Asserted Effect: Failure to maintain documentation that supports payments to TANF and CCDF beneficiaries of the Child Care Assistance Program and adequately monitor these beneficiaries results in noncompliance and unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-014. (Finding Code 2024-011, 2023-014) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review the process and procedures in place for collecting and maintaining documentation to support amounts paid to beneficiaries of the CCAP. Further, we recommend IDHS ensure monitoring reviews are performed for CCAP beneficiaries under the CCDF and TANF programs in accordance with established policies and procedures. Views of IDHS Officials: The Department accepts the recommendation. IDHS will review the processes and develop procedures for collecting and maintaining documentation supporting payments to CCAP beneficiaries. Additionally, IDHS will establish, review, and revise policies and procedures to ensure monitoring reviews are conducted with appropriate management oversight.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.959 ($114,897,412) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $472,620 Compliance Requirement: Level of Effort Finding 2024-012: Failure to Meet the SAPT MOE Requirement Condition Found: IDHS did not maintain the required aggregate State expenditures for the maintenance of effort (MOE) requirements for the Block Grants for Prevention and Treatment of Substance Abuse (SAPT) program. As a condition of receiving federal funding under the SAPT program, USDHHS requires the State to maintain the level of State and locally funded expenditures for substance abuse prevention and treatment activities at an amount that is at least equal to the average level of these same amounts for the prior two years. During the current fiscal year, we noted IDHS did not maintain the necessary aggregate expenditures to meet the SAPT MOE requirement. The table below illustrates the shortfall: "See Table in the Audit Report" In addition, IDHS has not established internal control procedures to monitor whether maintenance of effort requirements are met. Criteria or Requirement: According to 45 CFR 96.30(a), the fiscal control and accounting procedures of the State must be sufficient to permit tracing funds to a level of expenditure adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of the statute authorizing the block grant. Further, 45 CFR 96.134(a) states with respect to the principal agency of a State for carrying out authorized activities, the agency shall for each fiscal year maintain aggregate State expenditures by the principal agency for authorized activities at a level that is not less than the average level of such expenditures maintained by the State for the two-year period preceding the fiscal year for which the State is applying for the grant. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing procedures to ensure MOE requirements are achieved with allowable expenditures. Cause: In discussing these conditions with IDHS officials, management stated that the review of the MOE to date was not occurring on a regular basis until reporting to the federal entity was complete. A revised methodology for calculating MOE was submitted and approved by SAMHSA in December 2023 and required updates to the MOE calculations were made between 2020 through 2024. Possible Asserted Effect: Failure to maintain required State expenditure levels for MOE results in noncompliance with program requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-008. (Finding Code 2024-012, 2023-008, 2022-006, 2021-012, 2020-012, 2019-009, 2018-007, 2017-008, 2016-008, 2015-009, 2014-010) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its process for identifying expenditures to achieve the SAPT MOE and implement controls to appropriately monitor whether the MOE requirement has been met. Views of IDHS Officials: The Department accepts the recommendation. Moving forward with the new methodology that was approved by SAMHSA, IDHS will be able to correctly calculate and meet the MOE in the coming fiscal years.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 93.558 ($583,126,272), 93.575/93.596 ($747,612,292), 93.667 ($55,634,435), 93.959 ($114,897,412) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-013: Failure to Report Subaward Information Required by FFATA Condition Found: IDHS failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs.The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that IDHS did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testing of 57 subawards and 25 amendments, we noted the following exceptions: "See Table in the Audit Report" Additionally, during our testing of 25 subawards (totaling $53,372,381) for the SAPT program, we noted FFATA reporting was not completed for any of the subawards. IDHS’s subrecipient expenditures under the federal programs for the year ended June 30, 2024 were as follows: "See Table in Audit Report" Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDHS officials, management stated that FFATA reports cannot be submitted until the federal agency publishes the award and the award information is transmitted to FSRS/SAM.gov. The reporting of incorrect signature dates is due to a periodic delay between the day the contract is signed and the day the contract is recorded in the State’s financial records. A lack of appropriate oversight resulted in the SAPT subawards not being reported. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-009. (Finding Code 2024-013, 2023-009, 2022-007, 2021-014, 2021-015) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with the FFATA. Views of IDHS Officials: The Department partially agrees with the findings. The late reporting of IDHS’s subaward contracts is due to a timing difference between the state fiscal year (July 1 to June 30), when subaward contracts are obligated, and the federal fiscal year (October 1 to September 30), when new federal awards are obligated. FFATA reports cannot be submitted until the federal agency publishes the award and the award information is transmitted to FSRS/SAM.gov. IDHS will revise its procedures to address the timely recording of contract signature dates in SAP and the reporting of new federal awards in FSRS/SAM.gov. Procedures will be reviewed to ensure the timely completion of FFATA reporting. Auditors' Comment: The State is required to report subcontracts no later than the last day of the month following the month in which the subaward was made or modified. The exceptions noted in our testing were not reported within required timeframes.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Health and Human Services (USDHHS) Program Name: Supplemental Nutrition Assistance Program Cluster, Special Supplemental Nutrition Program for Women, Infants, and Children, Food Distribution Cluster, Rehabilitation Services – Vocational Rehabilitation, Temporary Assistance for Needy Families Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse, Disability Insurance/SSI Cluster ALN and Program Expenditures: 10.551/10.561 ($4,687,993,367), 10.557 ($181,526,312), 10.565/10.568/10.569 ($67,875,839), 84.126A ($138,992,957), 93.558 ($583,126,272), 93.575/93.596 ($747,612,292), 93.667 ($55,634,435), 93.959 ($114,897,412), 96.001/96.006 ($75,260,007) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: None Finding 2024-014: Inaccurate Reporting of Federal Expenditures Condition Found: IDHS did not accurately report Federal expenditures, including amounts provided to subrecipients, under the Supplemental Nutrition Assistance (SNAP) Cluster, Supplemental Nutrition for Women, Infants, and Children (WIC) programs, Food Distribution Cluster (FDC), Vocational Rehabilitation (VR), Temporary Assistance for Needy Families (TANF), Child Care Development Funds (CCDF) Cluster, Social Services Block Grants (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), and Disability Insurance/SSI (SSDI) Cluster.Federal expenditures, including amounts provided to subrecipients, reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA) did not agree to IDHS’ financial records provided for audit. Specifically, we noted the following differences between amounts provided for audit by IDHS and the SEFA amounts reported to the IOC for each program for the year ended June 30, 2024: "See Table in the Audit Report" The following differences were also identified relative to amounts provided to subrecipients for the following major programs: "See Table in the Audit Report" Additionally, we noted the cash basis expenditures provided by IDHS for our audit procedures included accrued (not paid) expenditures. We also noted these same amounts were reported to the IOC and were used to prepare the SEFA. Specifically, we noted expenditures that were not paid as of June 30, 2024, were erroneously reported as cash basis expenditures for the year ended June 30, 2024: "See Table in the Audit Report" We also noted the interagency expenditures provided by IDHS for our audit procedures included out of period expenditures. These same amounts were reported to the IOC and were used to prepare the SEFA. Specifically, we noted TANF Emergency Assistance (EA) payments which were claimed in fiscal year 2024 but reported in fiscal year 2023 totaling $14,275,633, and we noted EA payments which were claimed in fiscal year 2025 but were reported in fiscal year 2024 totaling $14,742,262. The net impact is an overstatement of TANF expenditures of $466,629 for the year ended June 30, 2024. Finally, we noted IDHS’ controls over reporting federal expenditures were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statement which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with IDHS officials, management stated that the differences in the amounts of federal expenditures in IDHS’ records compared to the IDHS SEFA were due to inclusion of accrued expenditures in IDHS’ records and some slight differences related to vouchers in transit at the end of the fiscal year. Differences in the amounts passed through to subrecipients were also related to vouchers in transit at the end of the fiscal year, and IDHS’ records for one federal grant program did not initially include non-cash expenditures which had been included on the IDHS SEFA. Possible Asserted Effect: Failure to accurately report federal expenditures hinders the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal fund Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-012. (Finding Code 2024-014, 2023-012, 2022-010) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to accurately report federal expenditures (including subrecipient expenditures) used to prepare the SEFA to the IOC. Views of IDHS Officials: The Department accepts the recommendation. IDHS will establish additional procedures to ensure federal expenditures (including subrecipient expenditures) are accurately reported.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-015: Failure to Report Drug Rebates on the Medicaid CMS-64 Report in a Timely Manner Condition Found: DHFS did not accurately report certain Medicaid Cluster program drug rebates on quarterly federal financial (CMS-64) reports. DHFS is the State Medicaid agency and is responsible for calculating drug rebates, billing pharmaceutical companies for drug rebates, and reporting drug rebates on the quarterly CMS-64 reports. pharmaceutical companies which were reported on quarterly CMS-64 reports submitted to USDHHS. Specifically, DHFS determined the data used to calculate drug rebates beginning in the quarter ended September 30, 2019 through June 30, 2024 erroneously included Medicare Part D drug data which did not pertain to beneficiaries of the Medicaid Cluster program. The data error resulted in drug rebates billed to and paid by pharmaceutical companies reported on the quarterly CMS-64 reports being overstated. Consequently, Medicaid Cluster expenditures were understated on both the quarterly CMS-64 reports and on the State’s Schedule of Expenditures of Federal Awards (SEFA) for fiscal year 2024.DHFS management estimated the federal portion of the drug rebate error to be $815,984,264, of which $98,623,995 pertained to amounts reported in fiscal year 2024. The estimated impact of the drug rebate error on CMS-64 reports filed in or related to quarters within fiscal year 2024 are as follows: "See Table in the Audit Report" DHFS was unable to process and report drug rebates beginning in the quarter ended March 31, 2024 due to a cyberattack impacting a third party servicer for drug rebates. As a result, no drug rebates were reported for the quarter ended March 31, 2024 and limited drug rebates were reported for the quarter ended June 30, 2024. The State revised the Medicaid Cluster expenditures reported on the 2024 SEFA to increase the reported expenditures by the estimated drug rebate error related to the year ended June 30, 2024. A revised SEFA was provided in July 2025 to correct for this matter.We also noted adequate internal controls have not been established to ensure the data used to calculate drug rebates reported on the quarterly CMS-64 reports are complete and accurate. Specifically, the supervisory reviews and analytical procedures performed over the quarterly CMS-64 reports were not designed at an appropriate level of precision to detect the drug rebates errors. Criteria or Requirement: 42 CFR 430.30(c) requires States to submit Form CMS-64 (Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program) to the central office not later than 30 days after the end of each quarter. This report is the State’s accounting of actual recorded expenditures. According to the Center for Medicaid and CHIP Services Information Bulletin dated July 24, 2014, CMS requires drug rebates to be reported in the quarter in which the State incurs the expenditure. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure information used in calculating drug rebates is complete and accurate and required financial reports are accurately prepared. Cause: In discussing these conditions with DHFS officials, they noted DHFS began receiving the impacted managed care encounter data files in 2019. IT programming to allow for the identification and exclusion of Medicare Part D drug claims from rebate invoices was not included. As a result, Medicare Part D drug claims that were not eligible for rebates were included in invoices DHFS sent to pharmaceutical manufacturers. Possible Asserted Effect: Failure to accurately report drug rebate amounts and program expenditures on the CMS-64 inhibits USDHHS’ ability to monitor the Medicaid Cluster program. Additionally, failure to accurately report federal expenditures in a timely manner inhibits the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-019. (Finding Code 2024-015, 2023-019) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate its process for calculating drug rebates reported on the CMS-64 and implement the necessary procedures to ensure amounts reported in the quarterly CMS-64 reports are complete and accurate. Views of DHFS Officials: DHFS accepts the recommendation. DHFS identified and implemented the programming necessary to omit the Medicare Part D drugs in August 2024. DHFS continues to monitor quarterly variances within the drug rebates included in CMS-64. The Drug Rebate Unit verifies Form CMS-64.9R – Medicaid Drug Rebate Schedule (64.9R) using data from separately ran reports such as the Invoice Activity Summary Report, Rebate Summary Report, and Check Apply Summary Report to verify that amounts included in the 64.9R are accurate.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program ALN and Program Expenditures: 93.767 ($510,412,808) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $88,490,404 Compliance Requirement: Eligibility Finding 2024-016: Failure to Discontinue CHIP Benefits for Ineligible Individuals Condition Found: DHFS improperly continued providing benefits under the Children’s Health Insurance Program (CHIP) program to individuals who were over the age of 18. The CHIP program provides benefits to children under the age of 19 at an enhanced federal participation (FFP) rate. CHIP benefits should be discontinued when a beneficiary turns 19; however, if they meet all other eligibility criteria, these beneficiaries are allowed to transition to benefits under the Medicaid Cluster program. During our testing of 80 payments (totaling $145,446) made on behalf of CHIP beneficiaries during the year ended June 30, 2024, we identified nine individuals receiving CHIP benefits who were over the age of 18. DHFS performed a review of all medical payments made under the CHIP program during the year ended June 30, 2024 and identified 52,557 CHIP beneficiaries over the age of 18 for whom medical payments totaling $88,490,404 were made during the year ended June 30, 2024.In addition, we noted DHFS has not established adequate controls to identify and remove individuals over the age of 18 from the CHIP program and to determine if they are eligible for benefits under the Medicaid Cluster program.Medical payments made on behalf of CHIP beneficiaries during the year ended June 30, 2024 totaled $504,533,794. Criteria or Requirement: In accordance with 42 CFR 435.10 and the OMB Compliance Supplement, dated May 2024, the State is required to determine client eligibility in accordance with eligibility requirements defined in the approved State Plans for the CHIP program. Specifically, 42 CFR 457.320(a) requires the State CHIP agency to provide benefits for groups of children up to, but not including, the age 19 in addition to other eligibility criteria. State Plan Amendment IL-14-0009 includes general eligibility considerations which allows benefits to be provided for children up to the age of 19 which is consistent with 42 CFR 457.320(a). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing and maintaining adequate controls over processes to perform and document beneficiary eligibility determinations. Cause: In discussing these conditions with IDHS officials, management stated they failed to identify and redetermine eligibility for 19-year-olds. Possible Asserted Effect: Failure to properly perform eligibility determinations in accordance with State Plans may result in federal funds being awarded to ineligible beneficiaries, which are unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-022. (Finding Code 2024-016, 2023-022, 2022-016) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS review its current process for performing eligibility decisions and consider changes necessary to ensure benefits are discontinued when individuals reach the age of 18 in accordance with program regulations and guidelines set forth by the State Plan. Views of DHFS Officials: DHFS agrees with the finding.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program Cluster, Medicaid Cluster ALN and Program Expenditures: 93.767 ($510,412,808), 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Eligibility Finding 2024-017: Inadequate Procedures to Determine and Document Beneficiary Eligibility Condition Found: DHFS does not have adequate procedures to determine and document eligibility for beneficiaries of the Children’s Health Insurance Program (CHIP) and the Medicaid Cluster programs. The CHIP and Medicaid programs provide medical benefits to individuals who meet certain eligibility criteria for each respective program. During our testing of 120 Medicaid and 80 CHIP beneficiaries, we identified the following exceptions: • One Medicaid beneficiary (with a sampled medical expenditure of $7,601) had their eligibility cancelled within the Integrated Eligibility System (IES) in 2019 but the individual was still receiving Medicaid payments through the Medicaid Management Information System (MMIS) due to human error inputting the incorrect eligibility end date within the transmission from IES to MMIS. Total payments made on behalf of this beneficiary under the Medicaid program were $14,453 during the year ended June 30, 2024. • One Medicaid beneficiary (with a sampled medical expenditure of $52) received benefits, but supporting documentation was not included in IES case record to support the eligibility determination was properly performed. Total payments made on behalf of this beneficiary under the Medicaid program were $99 during the year ended June 30, 2024. Details of the beneficiary payments selected in our samples for the CHIP and Medicaid programs are as follows: "See Table in the Audit Report" We also noted DHFS does not have adequate resources to perform and document eligibility determinations. Additionally, DHFS has not established appropriate monitoring procedures to ensure eligibility determinations are properly documented in accordance with program requirements. Medical payments made on behalf of CHIP and Medicaid beneficiaries during the year ended June 30, 2024 totaled $504,533,794 and $19,742,854,768, respectively. Criteria or Requirement: In accordance with 42 CFR 435.948 through 435.956 and the OMB Compliance Supplement, dated May 2024, the State is required to verify financial and nonfinancial factors of eligibility in accordance with eligibility requirements defined in the approved State Plans for the CHIP and Medicaid programs.In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing and maintaining adequate controls over processes to perform and document beneficiary eligibility determinations. Cause: In discussing these conditions with DHFS officials, management stated exceptions were the result of the inability of the system to reject claims when there is no match on full Medicaid coverage coding. Additionally, there was a lack of knowledge of the program staff at the waiver agency about being able to identify those codes that indicate no full Medicaid coverage. Possible Asserted Effect: Failure to properly perform eligibility determinations in accordance with State Plans may result in federal funds being awarded to ineligible beneficiaries, which are unallowable costs. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-017) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS review its current process for performing eligibility determinations and consider changes necessary to ensure all initial determinations and subsequent redeterminations are performed in accordance with guidelines set forth in the State Plan. Views of DHFS Officials: The Department accepts the recommendation. DHFS has reviewed its current process for performing eligibility determinations and setting controls to ensure they meet the guidelines set forth in all federal and state mandates. The corrective actions described within (system edits, monthly systematic reports and training) will assist with minimizing and identifying these case anomalies.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Names: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: $24,347,998 Compliance Requirement: Activities Allowed/Unallowed, Allowable Costs/Cost Principles, and Matching Finding 2024-018: Improper Calculation of Qualified Incentive Payments Claimed under the Medicaid Cluster Condition Found: DHFS incorrectly calculated qualified incentive payments charged to the Medicaid Cluster program using the enhanced federal medical assistance percentage (FMAP) rate applicable to payments under the Affordable Care Act (ACA) rather than its regular FMAP rate. Qualified incentive payments are financial incentive payments to healthcare providers to encourage improvements to the quality of and access to medical care. During our testing of over 40 payments to managed care organizations (totaling $349,112,247) charged to the Medicaid Cluster program, we identified one sampled expenditure (totaling $437,018) for a qualified incentive payment that was calculated using the enhanced ACA FMAP rate of 90% instead of the standard FMAP rate of 51.09% (Federal fiscal year 2024). In response to the exception noted in our testing, DHFS reviewed the population of qualified incentive payments calculated during the year ended June 30, 2024 (totaling $57,387,135) and determined a spreadsheet error caused the incorrect FMAP rate to be used to calculate the federal portion of qualified incentive payments claimed for certain quarters during State fiscal year 2024. As a result, DHFS overclaimed $24,347,998 of qualified incentive payments under the Medicaid Cluster as follows: "See Table in the Audit Report" Additionally, we noted the supervisory review procedures related to the calculation of the qualified incentive payments were not designed to and did not operate at a level of precision to identify an error of this nature. Criteria or Requirement: 2 CFR 200.400(b) sets forth the general allowable costs standards stating that recipients of federal awards are responsible for administering Federal funds in a manner consistent with Federal statutes, regulations and the terms and conditions of the Federal award. Additionally, 42 CFR 433.10(a) states sections 1903(a)(1), 1903(g), 1905(b), 1905(y), and 1905(z) provide for payments to States on the basis of a FMAP, for part of their expenditures for services under an approved State plan. FMAP percentages are published in the Federal Register each federal fiscal year. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing adequate supervisory review procedures to ensure the quarterly calculations of qualified incentive payments claimed under the Medicaid Cluster program are accurate. Cause: In discussing these conditions with DHFS officials, they stated the cause of this error was an oversight made when creating a new calculation spreadsheet for the Quality Incentive Payment add-on (QIP). The percentage for the ACA and FMAP were switched when adding to the spreadsheet causing calculated cells to be incorrect. The cause of this error was an oversight made when creating a new calculation spreadsheet for the Quality Incentive Payment add-on (QIP). The percentage for the ACA and FMAP were switched when adding to the spreadsheet causing calculated cells to be incorrect. Possible Asserted Effect: Failure to ensure payments to providers are properly calculated using the correct FMAP rate may result in noncompliance and unallowable costs being charged to the Medicaid Cluster program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-018) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate the level of precision of the supervisory review procedures over qualified incentive payments to ensure the payments are properly calculated using the correct FMAP rate. Views of DHFS Officials: The Department accepts the finding. DHFS has reviewed the process and implemented safeguards to ensure the calculations are accurate.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program, Medicaid Cluster ALN and Program Expenditures: 93.767 ($510,412,808), 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Managed Care Financial Audit Finding 2024-019: Failure to Ensure Managed Care Organizations Properly Prepare Financial Reports Condition Found: DHFS did not ensure the annual financial audits prepared during the year ended June 30, 2024 for Managed Care Organizations (MCOs) of the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs met the requirements of the MCO contracts and federal regulations. DHFS did not obtain audited annual financial reports for MCOs that meet the requirements of the federal Medicaid regulations as reported in the State’s single audit reports for fiscal years 2021, 2022, and 2023. While we noted DHFS obtained audited MCO financial reports during State fiscal year 2024 from each of the six Illinois MCOs, the auditors issued adverse opinions on the annual MCO financial reports for three of four MCOs sampled in our procedures. Accordingly, these MCO financial reports were not prepared in accordance with generally accepted accounting principles (GAAP) as required by program regulations and the provisions of the MCO contracts. The auditors’ reports noted the MCO annual financial reports were prepared on a statutory basis of accounting which is assumed to be materially different than GAAP. We also noted DHFS did not perform follow up procedures during fiscal year 2024 related to the MCO audit reports with adverse opinions. Accordingly, we noted DHFS has not established internal control procedures to ensure the financial reports are prepared in accordance with GAAP. Criteria or Requirement: According to 42 CFR 438.3(m), the State requires that contracts with MCOs must submit audited GAAP financial reports specific to the Medicaid contract on an annual basis. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to perform periodic audits of encounter and financial data submitted by, or on behalf of each of its MCOs. Cause: In discussing these conditions with DHFS officials, they stated the Department required the MCOs to submit GAAP reports in calendar year 2024. This was the Department’s initial experience with these reports and the review process was lengthy due to the effort to analyze and assess the information provided by each plan in comparison to the reported requirements Possible Asserted Effect: Failure to ensure the annual financial audits prepared for MCOs meet the requirements of the MCO contracts and federal regulations results in noncompliance with program requirements and may result in inaccurate capitation rate setting for the respective MCOs. Repeat Finding: While not considered a repeat of a prior year finding, a related finding was reported in the prior year audit as finding number 2023-020. (Finding Code 2024-019, 2023-020) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate its procedures for reviewing financial audit reports to ensure the reports comply with the stated requirements and implement the necessary procedures to ensure the financial reports are prepared in accordance with program regulations and contract requirements. Views of DHFS Officials: DHFS accepts the recommendation. Upon determination that calendar year 2024 MCO GAAP report submissions did not comply with the 42 CFR 438.3(m) reporting requirements, the Department issued a compliance reporting notice to the MCOs in January 2025. This notice identified the reporting noncompliance and provided confirmation of reporting expectations for calendar year 2025 GAAP reporting. In follow-up to that communication, all calendar year 2025 GAAP reports have been submitted by each MCO, reviewed by the Department's Financial Team, and all reports have been deemed to meet the filing requirements required by 42 CFR 438.3(m). In addition, in calendar year 2025, one MCO did not fully comply with the calendar year 2025 GAAP reporting submission due date. The Department issued sanctions to the MCO for lack of compliance with the reporting timeframes. The Department also conducted discussions with the MCO to identify the cause of the non-compliance and worked with the MCO to secure compliance with reporting requirements. The Department confirms it is actively receiving GAAP reports from all MCOs on an annual basis, MCO reports comply with reporting requirements, and the same process that was established for calendar year 2025 GAAP reporting will be followed for calendar year 2026 reporting. Should MCOs fail to comply with calendar year 2026 GAAP reporting, the Department will consider and apply corrective action and/or sanction penalties as permitted under Contract.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program (CHIP), Medicaid Cluster ALN and Program Expenditures: 93.767 ($510,412,808), 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Provider Eligibility (Screening and Enrollment) Finding 2024-020: Inadequate Procedures to Determine Provider Eligibility Condition Found: DHFS did not adequately screen providers of the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs to ensure Medicaid providers were not on the USDHHS Office of the Inspector General’s (OIG) List of Excluded Individuals/Entities (LEIE) at the time the services were performed. The Illinois Medicaid Program Advanced Cloud Technology (IMPACT) system is used by DHFS for the enrollment and screening of CHIP and Medicaid providers. On a monthly basis, IMPACT automatically checks providers enrolled within IMPACT to the LEIE to verify the provider is not on the LEIE. During our testing of 60 CHIP and 60 Medicaid beneficiary payments (totaling $188,646 and $264,110, respectively) to ensure the providers were not on the LEIE on the date of service performed, we identified 3 CHIP payments (totaling $39,136) and 2 Medicaid payments (totaling $10,824) to providers for services where the providers were not checked against the LEIE to verify they were not on the LEIE for the month when services were performed. Payments made to providers on behalf of beneficiaries of the CHIP and Medicaid Cluster programs totaled approximately $504,533,794 and $19,742,854,768, respectively, during the year ended June 30, 2024. Criteria or Requirement: 42 CFR 455.436(a) requires the State Medicaid agency to confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of a provider through routine checks of federal databases. Additionally, 42 CFR 455.436(b) requires the State Medicaid agency to check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System, the LEIE, the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. 42 CFR 455.436(c) requires the State Medicaid agency to consult the appropriate databases to confirm identity upon enrollment and reenrollment and check the LEIE and EPLS no less frequently than monthly. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing adequate procedures to screen providers of the CHIP and Medicaid Cluster programs, specifically, to ensure the providers were not on the LEIE for the month when the voucher was paid or the month when services were provided. Cause: In discussing these conditions with DHFS officials, they stated DHFS management stated the issues with the identified monthly batch screenings was due to a system defect. Possible Asserted Effect: Failure to adequately screen CHIP and Medicaid Cluster program providers may result in federal funds being paid to providers that should have been denied, which are unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-021. (Finding Code 2024-020, 2023-021, 2022-015, 2021-006) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS address the IMPACT processing error for screening CHIP and Medicaid Cluster program providers, specifically, the process to check, on a monthly basis, that providers are not on the LEIE. Views of DHFS Officials: DHFS agrees with this finding.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($20,707,079,599) Award Numbers: Various – see schedule of award numbers Federal Award Year: Various – see schedule of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Utilization Control Finding 2024-021: Failure to Perform Reviews over Home and Community Based Waiver Services (HCBS) Condition Found: DHFS failed to conduct utilization reviews over HCBS services for five of the nine waivers contracted out to their vendor during fiscal year 2024. DHFS is required to follow the state plan’s methods and procedures to safeguard against unnecessary utilization of care and services. HCBS services are furnished to beneficiaries who would otherwise need inpatient care that is furnished in a hospital, nursing facility or other institutional setting which are reimbursable for Medicaid claims under the state plan. One of these requirements is to perform reviews over HCBS waiver services. There are nine total HCBS waivers and five of them are contracted out through a vendor. These five waivers are: Persons with Disabilities, People with HIV or AIDS, Persons with Brain Injury, Adults with Developmental Disabilities, and Persons who are Elderly. During our audit procedures and based on inquiries with DHFS officials, the vendor contract came to an end on February 28, 2023, and a new contract was not in place to cover July 1, 2023 through June 30, 2024 (fiscal year 2024). As a result, we identified no reviews performed during fiscal year 2024. The agency continued to provide reviews and monitoring over the other four HCBS waivers: Residential Waiver for Children and Young Adults with Developmental Disabilities, the Support Waiver for Children and Young Adults with Developmental Disabilities, the Medically Fragile/Technology Dependent Children waiver, and the Supportive Living Facility waiver. The failure to perform reviews from July 1, 2023 through June 30, 2024 resulted in $2,754,254,430 in Medicaid claims that were not subject to contractor reviews during fiscal year 2024. Payments made on behalf of beneficiaries of the Medicaid Cluster program totaled $19,742,854,768 during the year ended June 30, 2024. Criteria or Requirement: 42 CFR 456 discusses the entire utilization control program to help ensure appropriate care is being provided for Medicaid services. Specifically, 42 CFR 456.22 requires the State Medicaid agency to have a sampling plan in place to perform reviews over the quality of Medicaid services. Additionally, 42 CFR 456.4 discusses the responsibilities of the state Medicaid agency to monitor these requirements even if they are outsourced to a third-party to perform these reviews. Cause: In discussing these conditions with DHFS management, they stated the contract with the third-party servicer expired as of February 28, 2023. The intention was to have the contract extended to continue working on the HCBS waiver reviews, but there were issues extending the contract. DHFS posted a request for quote in attempt to hire another contractor but did not receive any responses. As a result, there were no reviews performed after the expiration of the contract. Possible Asserted Effect: Failure to properly review and monitor Medicaid services could result in inadequate services being provided and poor quality of care at the facilities. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-025 (Finding Code 2024-021, 2023-025). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS obtain a contractor for fiscal year 2025 or have a plan in place to perform reviews themselves if there are no contractors willing and able to perform these reviews. Views of DHFS Officials: DHFS agrees with the finding. An Invitation for Bid has been posted to procure a contractor to resume record reviews. The opening of bids occurred in January 2026. Contract execution is anticipated prior to June 30, 2026.

State Agency: Illinois Department of Children and Family Services (DCFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Foster Care – Title IV-E ALN and Program Expenditures: 93.658 ($157,279,978) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Activities Allowed/Unallowed and Allowable Costs/Cost Principles Finding 2024-022: Inadequate Process for Foster Care Daycare Maintenance Assistance Payments Condition Found: DCFS does not have an adequate process in place to ensure Foster Care daycare maintenance assistance payments are accurately paid based on its approved rate schedule. The foster care program provides funds to States for maintenance assistance payments to deliver substitute care for children who are under the jurisdiction of a Title IV-E agency and who need temporary placement or care outside their homes. Maintenance payments are made on behalf of eligible Title IV-E beneficiaries to individuals serving as foster family homes, to childcare institutions, or public or private child-placement or child-care agencies in accordance with the Title IV-E agency’s maintenance rate schedule. During our testing of foster care maintenance assistance payments, we reviewed 50 case files and related beneficiary payments (totaling $55,816) charged to the Foster Care program during the year ended June 30, 2024 for compliance with eligibility requirements and allowability of related benefits. We noted in our testing DCFS has not established adequate internal controls to ensure the daycare rates paid for Foster Care maintenance payments are consistent with the approved rate schedule. Specifically, we identified two day care maintenance assistance payments sampled (totaling $1,668) were not calculated using rates consistent with the approved DCFS day care rate schedule. The daily provider rates used to calculate the sampled payments were $40 and $44 respectively; whereas the rate that should have been used for both of these payments according to the approved DCFS day care rate schedule was $46. Accordingly, the payments calculated by DCFS were $172 less than what the payments should have been using the approved rate schedule. In response to the errors identified in our testing, we requested DCFS evaluate the population of daycare maintenance assistance payments made during the year ended June 30, 2024 to determine the cause of the errors in the payment rates used. Rather than evaluating the full population of daycare maintenance assistance payments, DCFS sampled 59 payments and identified 10 additional payments which were paid rates inconsistent with the approved rate schedule, but were not able to determine the extent of errors in the population. Accordingly, we were not able to quantify the magnitude of any noncompliance in the population to determine if material noncompliance occurred during the year ended June 30, 2024. Daycare maintenance assistance payments made on behalf of Foster Care beneficiaries totaled $2,055,171 during the year ended June 30, 2024. Payments made on behalf of beneficiaries of the Foster Care program totaled $33,332,268 during the year ended June 30, 2024. Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that the expenditure be adequately documented. According to 42 USC 671(a)(11), which is implemented by 45 CFR 1356.21, the amount of payments made as foster care maintenance payments must be periodically reviewed to assure their appropriateness. Funds may be expended for foster care maintenance payments on behalf of eligible children, in accordance with the Title IV-E agency’s foster care maintenance payment rate schedule and in accordance with 45 CFR section 1356.21, to individuals serving as foster family homes, to childcare institutions, or public or private child-placement or child-care agencies. Such payments may include the cost of (and the cost of providing, including certain associated administrative and operating costs of a child care institution) food, clothing, shelter, daily supervision, school supplies, personal incidentals, liability insurance with respect to a child, and reasonable travel to the child’s home for visitation, as well as reasonable travel for the child to remain in the same school he or she was attending before placement in foster care (42 USC 672(b)(1) and (2), (c)(2), and 675(4)). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure payments are made at the approved rates. Cause: In discussing these conditions with DCFS officials, they stated the issue was due to the certification rate forms that were filled out by childcare providers. Providers would sometimes fill out the forms using lower rates than they were entitled to charge. Possible Asserted Effect: Failure to ensure payment calculations are properly performed and approved provider rates are accurately entered in the system may result in unallowable costs. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding code 2024-022) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCFS implement procedures to ensure foster care maintenance payments are properly calculated and consistent with the approved DCFS payment rate schedules. Views of DCFS Officials: The Department agrees and has implemented corrective action. In July 2025, the daycare eligibility program discontinued the use of certification rate forms. As a result, all childcare providers now receive the State established reimbursement rate, regardless of the rate they charge private-paying families. This change ensures that all childcare providers receive the funding that they are entitled to.

State Agency: Illinois Department of Children and Family Services (DCFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Foster Care – Title IV-E Adoption Assistance, Temporary Assistance for Needy Families ALN and Program Expenditures: 93.658 ($157,279,978) 93.659 ($103,674,138), 93.558 ($583,126,272) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Activities Allowed/Unallowed and Allowable Costs/Cost Principles Finding 2024-023: Failure to Provide Supporting Documentation for Payroll and Related Costs Condition Found: DCFS could not provide adequate supporting documentation to substantiate payroll and related costs claimed for federal reimbursement under the Foster Care – Title IV-E (Foster Care), Adoption Assistance, and Temporary Assistance for Needy Families (TANF) programs. On a weekly basis, DCFS employees complete and sign timesheets to report and certify their time. These timesheets are then reviewed and approved by the employee’s immediate supervisor. The supervisor approves the timesheets based on their knowledge of the employee’s hours worked during the pay period. Timesheets are scanned for archiving once a month by the payroll department. Timesheets are manually entered into the time reporting system (Employee Monthly Time Report) which is used to accumulate the costs related to each cost center. Cost pool data from the time reporting system is used to identify personal service expenditures attributable to DCFS’s State and federal programs and to calculate and allocate the related fringe benefit charges and indirect costs. During our testing of 25 direct payroll expenditures charged to the cost pools allocated to the Foster Care, Adoption Assistance, and TANF programs (totaling $127,344) during the year ended June 30, 2024, we noted the following: • The timesheet for one employee (supporting cost pool payroll expenditures sampled of $3,735) could not be provided for testing. DCFS personnel stated they were unable to locate the timesheet for this employee for the sampled period. Upon further review, DCFS personnel noted timesheets were unable to be located for this employee and all employees within the same department (totaling four additional employees) for the entire fiscal year, resulting in approximately 120 missing timesheets (related to payroll, fringe benefits, and indirect costs included in the cost pool totaling $497,277, $399,834, and $194,253, respectively). As a result, the personal service (payroll and fringe benefit) expenditures, as well as related indirect costs, were not appropriately supported in accordance with the requirements of the applicable cost principles. Accordingly, the personal service expenditures and indirect costs were not allowable. • The hours reported for three employees (with sampled personal services expenditures from the cost pool of $15,727) in the timekeeping system used to allocate personal services expenditures to Foster Care, Adoption Assistance, TANF, and other programs operated by the agency exceeded the hours reported on manual timesheets prepared by the employees and approved by supervisors. The unsupported hours reported in the timekeeping system ranged from half an hour to 13.2 hours resulting in unsupported personal service expenditures from the cost pool of $783. Additionally, we noted the controls to ensure required documentation is obtained to support payroll and related costs and maintained to evidence management approval of payroll information were not operating effectively. We also noted adequate internal controls have not been established to ensure the data included in the timekeeping system and used to allocate personal services expenditures to Foster Care, Adoption Assistance, TANF, and other programs operated by DCFS is consistent with the hours reported on manual timesheets prepared by the employees and approved by supervisor. Personal service (payroll and fringe benefit) expenditures and related indirect costs charged to the Foster Care, Adoption Assistance, and TANF programs for the year ended June 30, 2024, were as follows: "See Table in the Audit Report" Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that the expenditure be adequately documented. According to 2 CFR 200.430(g), charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be, among other things, supported by a system of internal control, comply with the established accounting policies and practices of the non-Federal entity, and support the distribution of the employee’s salary or wages amount across specific activities or cost objectives if the employee works on more than one federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure required documentation is obtained to support payroll and related costs and to maintain documentation evidencing management approval of payroll information. Cause: In discussing these conditions with DCFS officials, they stated these exceptions were due to human error and the limitations of keeping a complete file record for the paper-based overtime approval and timesheet process. Possible Asserted Effect: Failure to accurately document and maintain required timesheets results in noncompliance with federal regulations and unallowable costs. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding code 2024-023) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCFS review its current procedures and consider any changes necessary to ensure supporting documentation for payroll and related costs is maintained and accurately reflects work performed in accordance with the applicable federal regulations. Views of DCFS Officials: The Department has improved communication with and the training of its timekeepers to ensure accurate and consistent timekeeping standards. The Department has also instituted new quality control procedures to identify and correct errors. All timesheets are digitally archived to ensure proper record retention. The Department is also actively pursuing modernization efforts for both payroll and timekeeping, whether it is e-Time and CMS Payroll or the statewide ERP solutions.

State Agency: Illinois Department of Public Health (IDPH) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: COVID-19 – Immunization Cooperative Agreements (ICA), COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) ALN and Program Expenditures: 93.268 ($162,117,529), 93.323 ($94,269,102) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-024: Failure to Maintain Documentation to Evidence Timely Reporting of Subaward Information Required by Federally Funded Accountability and Transparency Act (FFATA) Condition Found: IDPH did not maintain documentation to evidence information required to reported by the Federal Funding Accountability and Transparency Act (FFATA) was submitted within required timeframes for awards granted to subrecipients of the Immunization Cooperative Agreements (ICA) and Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) programs. The State is required to report certain key elements related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing of two and three subrecipients of the ICA and ELC programs (with expenditures of $250,000 and $440,000, respectively), we noted IDPH did not maintain evidence supporting information required by FFATA was submitted within required timeframes. Upon further review, we noted that the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) was decommissioned and replaced with a new reporting system (SAM.gov) effective March 8, 2025. As a result of this system change and the limited historical data transferred between these federal reporting systems, we noted evidence supporting the date information required by FFATA was submitted was not available for FFATA reporting required during the year ended June 30, 2024 for any of IDPH’s subrecipients of the ICA and ELC programs. Additionally, we noted IDPH did not have adequate internal controls in place over FFATA reporting to retain evidence all subawards were reported within required time frames. IDPH’s subrecipient expenditures under its federal programs for the year ended June 30, 2024, were as follows: "See Table in the Audit Report" Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro‑purchase threshold and publish the required information on a public‑facing, OMB‑designated, governmentwide website. Agencies must follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Regulation (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. In addition, the OMB Compliance Supplement, dated May 2024, requires the auditor to compare the award information in FSRS to the subaward documents maintained by the recipient to assess if the key data elements were accurately reported and the action was reported in FSRS no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made. Further, 2 CFR 200.303 requires non‑Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to maintain adequate documentation to substantiate information required by FFATA was reported within required timeframes. Cause: In discussing these conditions with IDPH officials, they stated IDPH did not retain documentation from the FSRS system prior to the system being decommissioned. Possible Asserted Effect: Failure to maintain adequate documentation to evidence information required to be reported by FFATA was submitted within required timeframes inhibits the ability of the auditor to perform required compliance testing. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-032. (Finding Code 2024-024, 2023-032, 2022-020, 2021-021). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDPH establish procedures to maintain documentation to evidence information required by FFATA is reported within required timeframes. Views of IDPH Officials: IDPH agrees the decommission of FSRS.gov and FFATA reporting being transitioned to SAM.gov resulted in evidence of FFATA reporting submission dates being lost.

State Agency: Illinois State Board of Education (ISBE) Federal Agency: U.S. Department of Education (USDE) Program Name: Twenty-First Century Community Learning Centers (21st Century) ALN and Program Expenditures: 84.287 ($61,131,992) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-025: Inadequate Monitoring of 21st Century Subrecipients Condition Found: ISBE did not adequately monitor and document program monitoring procedures performed over subrecipients of the 21st Century Community Learning Centers (21st Century) program. The 21st Century program operates to provide State educational agencies and local educational agencies (LEAs) with funding specific to rural and inner-city public schools. To monitor the 21st Century program activities performed by Illinois elementary and secondary schools, ISBE has established Tier I, Tier II, and Tier III monitoring activities which are applied to each subrecipient (LEA or school district) depending upon the annual risk score determined by ISBE. ISBE’s 21st Century program subrecipient monitoring manual outlines the risk assessment procedures to determine the tier of monitoring required, the methods used for tier determination, and documentation required for each tier of monitoring. Because the size and scope of each subrecipient can vary greatly, ISBE has further subdivided subrecipients into cohorts and sites (individual schools) for purposes of applying certain monitoring procedures. Tier I subrecipient monitoring procedures apply to all subrecipients, with no consideration of the risk assessment score they have received and consist of a twice-a-year call in which ISBE personnel discuss enrollment and registration statistics, progression towards goals specific to the district, and budgetary changes. A notification email is sent twice a year, alerting the subrecipient that a call is required to be scheduled. Once the call is scheduled, a call form detailing the responses to the discussion points is completed by ISBE personnel during the call to evidence the call was conducted and any matters for follow up. documentation provided by the subrecipient to address each portion of review. ISBE documents the completion of its desk review procedures with a letter to the subrecipient communicating any noncompliance and requesting corrective action, if applicable. Any required corrective action plans are reviewed and formally accepted by ISBE in a letter to the subrecipient. Tier III applies to specific subrecipient sites who receive a high-risk assessment score and consists of an on-site review including interviews with the project director and site coordinators, and observations of the academics and academic enrichment taking place at each site. ISBE personnel complete monitoring checklists to evidence the completion of its on-site procedures and a summary checklist is completed after the on-site visit to summarize all areas of noncompliance. A letter is sent to the subrecipient communicating the completion of the on-site review, any noncompliance, and requesting corrective action, if applicable. Any required corrective action plans are reviewed and formally accepted by ISBE in a letter to the subrecipient. During the year ended June 30, 2024, ISBE identified 33 Tier III high-risk subrecipients (with expenditures totaling $36,676,176) which included 47 total subrecipient sites required to have on-site reviews performed. During our testing of seven high risk subrecipient sites selected for testing (related to seven subrecipients with expenditures totaling $15,207,297), we noted ISBE was unable to provide documentation evidencing on-site reviews were performed for five of the subrecipient sites samples. We also noted documentation was not available to evidence the reviews of the other two subrecipient sites sampled were completed as ISBE could not locate documentation of the procedures performed, conclusions reached, or communication of the review results to the subrecipient sites. In addition, we noted ISBE’s internal controls over subrecipient on-site monitoring are not designed at an appropriate level of precision to ensure monitoring of subrecipients is completed, documented, and retained as required by ISBE policies and procedures. ISBE passed through approximately $59,630,722 to 78 subrecipients of the 21st Century program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. According to 2 CFR200.332(b), a pass-through entity must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing supervisory procedures at an appropriate level of precision to ensure adequate monitoring is performed and documentation is maintained. Cause: In discussing these conditions with ISBE officials, they stated the inability to provide required documentation is attributable to staff turnover as those responsible for these monitoring activities have since left ISBE. Possible Asserted Effect: Failure to perform required monitoring procedures and maintain documentation may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and grant agreements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-045. (Finding Code 2024-025, 2023-045) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation:We recommend ISBE establish policies and procedures to ensure programmatic monitoring is performed and appropriately documented. Views of ISBE Officials: Management agrees with the finding and has developed processes and structures to correct it.

State Agency: Illinois State Board of Education (ISBE) Federal Agency: U.S. Department of Education (USDE) Program Name: Education and Stabilization Fund (ESF) ALN and Program Expenditures: 84.425 ($2,176,294,000) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-026: Untimely Review of Subrecipient Performance Reports Condition Found: ISBE did not review subrecipient performance reports in a timely manner according to its program monitoring policies and procedures for subrecipients of the Education and Stabilization Fund - Elementary and Secondary Education (ESF) program for fiscal year 2024. The ESF program operates to provide State educational agencies and local educational agencies with emergency relief funds to address the impact that COVID-19 has had, and continues to have, on elementary and secondary schools across the nation. To monitor the ESF program activities performed by Illinois elementary and secondary schools, ISBE requires a performance report to be prepared on a semi-annual basis. The semi-annual performance report includes information on the accomplishment of deliverables described in the grant, the status of performance measures, and the alignment of accomplishments with spending to date. ISBE’s monitoring policies and procedures require these reports to be reviewed within 14 days of receipt to ensure program activities and program results are consistent with program requirements. During our testing of ESF program performance reports submitted by 41 subrecipients with expenditures of $824,985,617 during the year ended June 30, 2024, we noted performance reports submitted by 19 subrecipients (with expenditures of $777,031,717) were not reviewed by program personnel within 14 days of receipt in accordance with ISBE’s policies. Delayed review of the reports ranged from 1 to 112 past the requirement. "See Table in the Audit Report" ISBE passed through approximately $2,126,841,390 to subrecipients of the ESF program during the year ended June 30, 2024. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring program procedures and reviews are performed in a timely manner. Cause: In discussing these conditions with ISBE officials, they stated the delays in performing these reviews are attributable to the limited capacity of ISBE monitoring personnel as the responsibilities of existing program monitoring staff were not expanded to accommodate the additional programs. Possible Asserted Effect: Failure to timely review subrecipient semi-annual performance reports may result in untimely identification of subrecipients not properly administering federal program requirements in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-046. (Finding Code 2024-026, 2023-046). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ISBE ensure proper review procedures are performed in a timely manner in accordance with its program monitoring policies and procedures. Views of ISBE Officials: We agree with the finding. To ensure proper review procedures are performed in a timely manner in accordance with its program monitoring policies and procedures, the Fiscal department is sending weekly lists of submitted, past due and disapproved Grant Periodic Reports (GPRS) to each applicable department. Program analyzes the GPRS reports and prioritizes reviews based on submission dates. Title Grants Administration department has also trained additional team members to assist with the review process.

State Agency: Illinois State Board of Education (ISBE) Federal Agency: U.S. Department of Education (USDE) Program Name: Education and Stabilization Fund (ESF) ALN and Program Expenditures: 84.425 ($2,176,294,000) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-027: Failure to Report Subaward Information Required by Federally Funded Accountability and Transparency Act (FFATA) Condition Found: ISBE failed to report subaward information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Education Stabilization Fund (ESF) program. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testwork over FFATA reporting, we noted ISBE was required to report information for 73 new subawards issued during the year ended June 30, 2024. In preparing documentation for our audit procedures, ISBE identified FFATA reporting was not completed for seven subawards. Additionally, we noted ISBE did not have adequate internal controls in place over FFATA reporting to ensure all subawards were reported as required. ISBE passed through approximately $2,126,841,390 to subrecipients of the ESF program during the year ended June 30, 2024. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support FFATA implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure all FFATA reports are accurately and timely prepared and submitted in accordance with federal regulations. Cause: In discussing these conditions with ISBE officials, they stated the omission of FFATA reporting was attributable to upload errors in the FFATA Subaward Reporting System (FSRS). ISBE officials also stated that ESF FFATA reporting presented an additional challenge and required additional review and reconciliation compared to the standard FFATA reports submitted for ordinary and customary grants since ESF grants lasted longer than its financial systems were accustomed to. ISBE acknowledged improper data reconciliation of new and old State fiscal year 2024 projects in its financial records. Possible Asserted Effect: Failure to report subaward information in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-027) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ISBE establish additional procedures and internal controls to ensure all new subawards and amendments subject to FFATA reporting requirements are properly reported in accordance with FFATA. Views of ISBE Officials: ISBE agrees with the finding. When a grant runs longer than its financial systems are accustomed to (two state fiscal years), management in the Department of Funding and Disbursements will maintain and present a list of grants previously approved and reported to FFATA to the principal consultant responsible for FFATA reporting, ensuring the principal consultant has the necessary tools to properly reconcile grants that have previously been reported and those that have not. Then, management will review the list of subrecipient projects prepared by the principal consultant for submission to ensure accuracy prior to the data being reported in SAM.gov, which has replaced FSRS.

State Agency: Illinois Student Assistance Commission (ISAC) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.575/93.596 ($747,612,292) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: None Finding 2024-028: Inaccurate Reporting of Federal Expenditures Condition Found: ISAC did not accurately report Federal expenditures, including amounts passed-through to subrecipients, under the CCDF Cluster. Federal expenditures, including amounts provided to subrecipients, reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA), did not agree to ISAC’s financial records provided for audit. Specifically, we noted the following differences between amounts provided for audit by ISAC and the amounts passed through to subrecipients of the CCDF Cluster program reported to the IOC for the SEFA for the year ended June 30, 2024: "See Table in the Audit Report" Finally, we noted ISAC’s controls over reporting federal expenditures, including amounts passed-through to subrecipients, were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statements which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program.Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures, including amounts passed-through to subrecipients, are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with ISAC management, they stated they presented these beneficiary payments as amounts passed through to subrecipients in accordance with guidance provided by parties responsible for the State’s financial reporting process. Possible Asserted Effect: Failure to accurately report federal expenditures impedes the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-028) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ISAC establish procedures to accurately report federal expenditures (including subrecipient expenditures) used to prepare the SEFA to the IOC. Views of ISAC Officials: ISAC accepts the finding. During the year ended June 30, 2024, payments totaling $79,103,694 were made to educational institutions for the direct benefit of eligible beneficiaries, as reflected in ISAC’s internal accounting records for the same fiscal year. ISAC believes federal expenditures were appropriately made to beneficiaries who were determined to have qualified under the program and that the amount of the total expenditures was correct. The classification of these amounts on the SEFA for the year ended June 30, 2024, was done using the same methodology applied in the prior fiscal year based on reporting guidance received for that fiscal year. ISAC maintained the established reporting framework, in preparing the SEFA for the fiscal year ended June 30, 2024. ISAC agrees that the amounts should not have been reported as payments to subrecipients on the SEFA for the fiscal year ended June 30, 2024. ISAC continues to maintain adequate internal controls designed to ensure federal expenditures are accurately recorded in its accounting records and are properly presented in accordance with the applicable guidance within 2 CFR 200.

State Agency: Illinois Community College Board (ICCB) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.575/93.596 ($747,612,292) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-029: Failure to Report Subaward Information Required by FFATA Condition Found: ICCB failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the CCDF Cluster (CCDF). The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, six subaward amendments (totaling $4,487,676) we noted FFATA reporting was not completed for any of the subawards sampled. Upon additional review, we noted ICCB did not complete FFATA reporting for any of its CCDF subawards during the year ended June 30, 2024. We also noted ICCB did not establish adequate control procedures to ensure FFATA reports were properly completed for all subawards as required by federal regulations. ICCB’s subrecipient expenditures under the CCDF Cluster for the year ended June 30, 2024 were $19,843,035. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, government-wide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures designed to ensure FFATA reporting is completed in accordance with federal requirements. Cause: In discussing these conditions with ICCB officials, they noted FFATA reporting responsibilities were not clearly assigned within the agency during the fiscal year. As a result, subaward amendments were executed without corresponding FFATA reporting submissions in the designated reporting system. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-029) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICCB establish procedures to identify awards subject to FFATA reporting requirements and establish internal controls to report required subaward information. Views of ICCB Officials: ICCB concurs with the finding.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,329,354,603) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $2,335,092 Compliance Requirement: Eligibility Finding 2024-030: Unemployment Benefit Payments to Ineligible Claimants Condition Found: IDES failed to follow established policies when making eligibility determinations for claimants of the Unemployment Insurance (UI) program. The UI program administered by IDES provides benefits to eligible individuals that are unemployed and able and available to work. IDES utilizes the Illinois Benefits Information System (IBIS) to perform and document claimant eligibility determinations, to process claims for unemployment insurance benefits, and to assist IDES in complying with the requirements of the Illinois UI Act, rules, policies, and procedures applicable to unemployment benefits. UI program eligibility requirements include, among other criteria, the following: • The individual is unemployed through no fault of their own • The individual must register with IDES employment service system IllinoisJobLink.com • The individual has been paid $1,600 or more in wages during a recent 12-month period • The individual has earned at least $400 outside of the base period quarter in which his/her earnings were the highest • The individual must be actively seeking employment and be available to work • The individual must not refuse an offer of suitable work To be eligible to receive UI benefits, a claimant completes an application either online, in-person, or over the phone. Claimant applications are processed by the IBIS system which includes a number of edit checks which must be passed in order for a claimant to be eligible to receive UI benefits. However, because of the volume of claims and suspension of certain requirements during the pandemic public health emergency, we noted IDES had disabled certain edit checks in IBIS to allow claims to process and failed to re-establish the edit checks with the conclusion of the public health emergency provisions. As a result, certain ineligible claimants were identified during our assessment of eligibility. Specifically, we noted the following exceptions: • 135 claimants were inappropriately determined to be eligible for UI benefits when the individuals should have been flagged as ineligible as the claimants were terminated from previous employment with cause, which is a disqualifying requirement. UI benefits paid to this group of claimants were $821,715. • 73 claimants were inappropriately determined to be eligible for UI benefits when the individuals should have been flagged as ineligible as the claimants voluntarily left work without cause, which is a disqualifying requirement. UI benefits paid to this group of claimants were $259,485. • 248 claimants were inappropriately determined to be eligible for UI benefits when the individuals should have been flagged as ineligible as the claimants were offered suitable work, but refused employment, which is a disqualifying requirement. UI benefits paid to this group of claimants were $1,253,892. Additionally, we noted adequate internal controls have not been established to ensure necessary changes resulting from the conclusion of pandemic related provisions are made to UI eligibility procedures in a timely manner. Benefits paid to UI claimants totaled $2,149,469,000 during the year ended June 30, 2024. Criteria or Requirement: According to the State of Illinois Unemployment Insurance Law Handbook, an individual who is discharged for misconduct with his work is ineligible for benefits for the week in which he was discharged for misconduct and thereafter until the individual has become re-employed and has had earnings equal to or in excess of their weekly benefit amount in each of four calendar weeks. Further, an individual will be ineligible for benefits if the individual has failed, without good cause, to accept suitable work when offered by the Department of Employment Security or an employing unit (i.e. business). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure eligibility determinations are made in accordance with the UI Act. Cause: In discussing these conditions with IDES officials, they stated these conditions occurred as the result of competing priorities with limited resources. Possible Asserted Effect: Failure to follow established policies to determine beneficiary eligibility may result in noncompliance with program regulations and payments to ineligible recipients. Repeat Finding: A similar finding was reported in the prior year as finding number 2023-038. (Finding Code 2024-030, 2023-038) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES review its current procedures and consider any changes necessary to ensure eligibility determinations are made in accordance with internal policy and federal regulations. Views of IDES Officials: IDES accepts the recommendation and has reviewed and updated procedures and training to improve controls over eligibility determinations relative to this finding.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,329,354,603) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-031: Inadequate Process for Preparing ETA 9130 Financial Reports Condition Found: IDES does not have an adequate process in place to ensure that the ETA 9130 financial reports prepared for the Unemployment Insurance (UI) program are complete and accurate. On a quarterly basis, IDES is required to report program and administrative expenditure information for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects, on the ETA 9130, Financial Status Report, UI Programs. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. During our test work of 60 ETA 9130 reports covering the September 2023 and March 2024 quarters, we noted certain grant awards had inaccurate amounts reported for key line items for the September 30, 2023, and March 31, 2024 reporting quarters. Specifically, we noted IDES inaccurately reported the following line items: "See Table in the Audit Report" We also noted IDES does not perform analytical or other procedures over previously reported information or expectations relative to current program activities. Additionally, supervisory review procedures are not designed to operate at a level of precision to identify errors of this nature. Criteria or Requirement: According to OMB Number 1205-0461, IDES is responsible for submitting a quarterly ETA 9130 report at the completion of each quarter. Each quarter should correspond to the following calendar quarter dates: March 31, June 30, September 30, and December 31. Additionally, the primary contact person, the designated authorized official in the recipient’s organization, is responsible for certifying the accuracy of the data reported to the USDOL. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal control should include procedures to ensure the completeness and accuracy of information reported in required financial reports. Cause: In discussing these conditions with IDES officials, they stated the incorrect amounts submitted for the September 30, 2023 and March 31, 2024 quarterly reports were due to data entry errors. Possible Asserted Effect: Failure to prepare accurate ETA 9130 reports may inhibit the USDOL from effectively monitoring the UI program. Repeat Finding: A similar finding was reported in prior year audit as finding 2023-040. (Finding Code 2024-031, 2023-040, 2022-026) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES review its procedures for preparing ETA 9130 financial reports required for the UI program and implement analytical and any other procedures considered necessary to ensure the reports are complete and accurate prior to submission to the USDOL. Views of IDES Officials: IDES accepts the audit finding and will work to ensure the ETA 9130 financial reports are complete and accurate by prioritizing the hiring of additional staff, reviewing procedures, looking for ways to strengthen internal controls and continuing conversation with DoIT about improving and/or modernizing reporting tools.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,329,654,603) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-032: Inadequate Process for Preparing ETA 2208A Special Report Condition Found: IDES does not have an adequate process in place to ensure the ETA 2208A special reports prepared for the Unemployment Insurance (UI) program are complete and accurate. On a quarterly basis, IDES is required to report information on staff years worked and paid by program category on the ETA 2208A – Quarterly UI Above-Base (ETA 2208A) report. The information required to be reported includes UI program staff year usage (Section A), regular contingency entitlement certification (Section B), trade above-base entitlement certification (Section C), and additional benefits above-base entitlement certification (Section D). Key line items required for testing include items one through seven in Section A. IDES has implemented procedures whereby IDES program staff prepare the quarterly reports and a supervisor reviews and approves the report prior to submission to the USDOL. During our testwork of two quarterly ETA 2208A reports, we noted IDES was unable to provide evidence a supervisor reviewed and approved the December 31, 2023 and the March 31, 2024 reports prior to submission to the USDOL. As a result, we were unable to determine if a supervisory review was performed and whether the duties of preparing and reviewing the report were appropriately segregated. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal control should include procedures to ensure supervisory reviews of required special reports are completed and documented prior to submission to the USDOL. Cause: In discussing these conditions with IDES officials, they stated the lack of evidence of review and errors were due to IDES personnel not properly documenting approval of the special reports prior to submission to the USDOL. This issue was exacerbated by staff turnover and hiring delays. Possible Asserted Effect: Failure to follow established reporting controls may result in inaccurate reports which prevents the USDOL from effectively monitoring the UI program. Repeat Finding: A similar finding was reported in prior year audit as finding number 2023-041. (Finding Code 2024-032, 2023-041, 2022-028, 2021-032) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES ensure supervisory reviews of special reports prior to submission to the USDOL are documented in accordance with its established policies and procedures. Views of IDES Officials: IDES accepts the finding. It has been reviewed and corrected.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,329,354,603) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: None Finding 2024-033: Inaccurate Reporting of Federal Expenditures Condition Found: IDES did not accurately report Federal expenditures under the Unemployment Insurance (UI) program. Federal expenditures reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA) did not agree to IDES’s financial records provided for audit. Specifically, we noted the following difference between amounts provided for audit by IDES and the SEFA amounts reported to the IOC for the Unemployment Insurance program for the year ended June 30, 2024: "See Table in the Audit Report" Finally, we noted IDES’s controls over reporting federal expenditures were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statements which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA. Cause: In discussing these conditions with IDES officials, they stated the cause of the difference was the result of a large audit adjustment related to return of debit cards from a third party bank who sopped serving the program in December 2021. Possible Asserted Effect: Failure to accurately report federal expenditures inhibits the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was reported in prior year audit as finding number 2023-042. (Finding Code 2024-033, 2023-042) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDES establish procedures to accurately report federal expenditure used to prepare the SEFA to the IOC. Views of IDES Officials: The Agency accepts the recommendation and will adjust for returned debit cards in accordance with the final resolution determined in consultation with the Comptroller and financial statement auditors for State fiscal year 2024 if this situation should arise again.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low-Income Home Energy Assistance (LIHEAP) ALN and Program Expenditures: 93.568 ($205,171,791) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2024-034: Failure to Re-certify to the Accuracy of the Clearance Pattern Condition Found: DCEO did not properly review or re-certify the accuracy of the clearance pattern specified in the Treasury-State Agreement related to cash draws for the Low-Income Home Energy Assistance Program (LIHEAP). Annually, the State of Illinois negotiates the Treasury-State Agreement (TSA) with the U.S. Department of the Treasury (the Treasury) which details the funding techniques used for the draw down of federal funds. Certain approved finding techniques utilized by the State require the use of a clearance pattern that identifies the average number of days disbursements (warrants) take to clear the State Treasurer’s account. The established clearance pattern is then used to determine the date the State should request federal funds from the U.S. Treasury in order to minimize the time elapsing between the receipt of federal funds and the State Treasurer’s clearance of funds. The clearance pattern must be recertified at least every five years. During our testwork over cash management requirements, we noted the clearance pattern included in the TSA in place for the year ended June 30, 2024 had not been recertified since 2016 (more than 5 years since previous recertification). Additionally, we noted internal controls have not been established to ensure clearance patterns are calculated and recertified in accordance with Treasury regulations. Criteria or Requirement: 31 CFR 205.20 requires a State to ensure that a clearance pattern accurately represents the flow of Federal funds under the Federal assistance programs to which it is applied, and that a clearance pattern reflects seasonal or other periodic variations in clearance activity. A State shall also ensure that a clearance pattern is auditable. 31 CFR 205.22 states an authorized State official shall recertify that a clearance pattern corresponds to a program’s clearance activity and shall recertify the accuracy of the clearance pattern at least every five years. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure clearance patterns are recertified in accordance with federal regulations. Cause: In discussing these conditions with DCEO officials, they stated they did not have procedures in place to re-certify the clearance pattern every 5 years as required due to unfamiliarity with the requirements. Possible Asserted Effect: Failure to evaluate and recertify a program’s clearance pattern violates the requirement of 31 CFR 205.9 and could result in the inaccurate recalculation of DCEO’s interest obligation to the Treasury. Repeat Finding: A similar finding was reported in the prior year audit and finding number 2023-027. (Finding Code 2024-034, 2023-027) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO establish procedures and controls to ensure clearance patterns are recertified within required timeframes. Views of DCEO Officials: DCEO agrees with this finding.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low-Income Home Energy Assistance (LIHEAP) ALN and Program Expenditures: 93.568 ($205,171,791) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2024-035: Failure to Perform Cash Draws in Accordance with the Treasury State Agreement Condition Found: DCEO did not perform its cash draws in accordance with the funding technique prescribed in the Treasury State Agreement (TSA). On an annual basis, the State of Illinois negotiates the TSA with the U.S. Department of the Treasury (the Treasury), which details, among other things, the funding techniques to be used for requesting federal funds. The TSA funding technique prescribed for the Low Income Home Energy Assistance Program (LIHEAP) program is interest neutral and requires DCEO to request funds from the awarding federal agency so that the funds are deposited by ACH on the dollar weighted average day of clearance for disbursements. According to the 2024 TSA, the average day of clearance for program costs is three days. As such, under this funding technique, DCEO should request federal funds two days after issuing warrants (payments) for program expenditures. During our testwork over 15 cash draws (totaling $67,855,621) for program (subrecipient) expenditures of the LIHEAP program during the year ended June 30, 2024, we noted the expenditures supporting the cash draws were not disbursed in accordance with the timeframe required by the prescribed funding technique. During our testing of 40 subrecipient payments (totaling $9,991,994), we noted federal funds were requested 1 to 5 days earlier than permitted by the funding technique (totaling $1,859,216). Additionally, we noted internal controls have not been established to ensure cash draws are calculated and recertified in accordance with Treasury regulations and the funding technique prescribed by the TSA. Criteria or Requirement: According to 31 CFR part 205.6(a), a TSA documents the accepted funding techniques and methods for calculating interest agreed upon by the U.S. Treasury and the State for each Federal program governed by subpart A of the Treasury regulations. Section 6.3.2 of the 2024 Treasury State Agreement (effective July 1, 2023 to June 30, 2024) states that the Low-Income Home Energy Assistance program is required to use the Average Clearance funding technique. Section 6.2.1 of the 2024 Treasury State Agreement describes the Average Clearance funding technique as being interest neutral and requiring the State to request funds such that they are deposited by ACH on the dollar-weighted average day of clearance for the disbursement. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure that Federal cash draws are performed in accordance with the TSA. Cause: In discussing these conditions with DCEO officials, DCEO did not have the correct funding technique listed within the Treasury-State Agreement for the Low-Income Home Energy Assistance Program. Possible Asserted Effect: Failure to draw funds in accordance with the TSA results in noncompliance with U.S. Treasury regulations. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-028. (Finding Code 2024-035, 2023-028) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO implement procedures to ensure cash draws are performed in accordance with the TSA or work with the US Treasury to amend the TSA to reflect DCEO cash draw request practices. Views of DCEO Officials: DCEO agrees with this finding.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Labor (USDOL) U.S. Department of Health and Human Services (USDHHS) Program Name: WIOA Cluster, Low-Income Home Energy Assistance (LIHEAP) ALN and Program Expenditures: 17.258/17.259/17.278 ($142,310,788), 93.568 ($205,171,791) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-036: Failure to Maintain Updated Procedures to File Subaward Information Required by FFATA Condition Found: DCEO failed to maintain updated procedures which resulted in filing inaccurate Federal Funding Accountability and Transparency Act (FFATA) reports. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During State fiscal year 2024, DCEO did not have updated procedures in place to identify and report the following key data elements, for each of the programs: "See Table in the Audit Report" Additionally, we noted DCEO did not have adequate internal controls in place over FFATA reporting to ensure all subawards were reported as required. DCEO passed through approximately $198,786,849 and $124,406,438 to subrecipients of the LIHEAP and WIOA programs, respectively, during the year ended June 30, 2024. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure all FFATA reports are accurately and timely prepared and submitted in accordance with federal regulations. Cause: In discussing these conditions with DCEO officials, they stated the department’s procedures did not reflect a requirement to re-file a FFATA report after a sub-award agreement had its dollar amount modified. In addition, because the department’s procedures presumed that the obligation date of a subaward was interchangeable with the award date for a subaward, FFATA reports were filed based on when a sub-award was obligated. Possible Asserted Effect: Failure to maintain updated reporting procedures in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-029. (Finding Code 2024-036, 2023-029) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO update procedures and controls to identify awards and amendments subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of DCEO Officials: DCEO agrees with the finding and recommendations.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low-Income Home Energy Assistance (LIHEAP) ALN and Program Expenditures: 93.568 ($205,171,791) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-037: Inaccurate Special Report Condition Found: DCEO did not prepare accurate special reports for the Low-Income Home Energy Assistance Program (LIHEAP). DCEO is required to prepare Quarterly Performance and Management Reports for LIHEAP. During our testwork over two Quarterly Performance and Management Reports submitted during the fiscal year ended June 30, 2024, we noted for the quarterly report for the period ending June 30, 2024, the amount of funds obligated was reported as $110,510,629. The actual amount of funds obligated was $109,882,656, resulting in an overstatement of $627,973. Additionally, we noted DCEO has not established appropriate internal controls to ensure its quarterly reports submitted to USDHHS are accurate in accordance with federal requirements. We also noted supervisory review procedures have not been designed to operate at a level of precision to identify errors of the size and nature noted above. Criteria or Requirement:According to the Administration for Children and Families Action Transmittal LIHEAP-AT-2024-02, the Quarterly Performance and Management Report is conducted in accordance with the LIHEAP statute (Title XXVI of P.L. 97-35). The information received from the report provides data to the Administration for Children and Families and Congress in its oversight of recipients’ performance in administering the LIHEAP program. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include controls to ensure amounts reported in the Quarterly Performance and Management Report are accurate. Cause: In discussing these conditions with DCEO officials, they stated the incorrect amounts submitted for the June 30, 2024 quarterly report was due to a data entry error not detected by supervisory review procedures Possible Asserted Effect: Failure to accurately prepare the quarterly performance and management reports inhibits the completion of the audit and may prevent USDHHS from obtaining accurate program data for monitoring the LIHEAP program. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-031. (Finding Code 2024-037, 2023-031) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO review the process and procedures in place to prepare special reports required for the LIHEAP program and implement procedures necessary to ensure the reports submitted to USDHHS are accurate. Views of DCEO Officials: DCEO agrees with the finding and recommendation. Due to the timing of field work of the 2023 audit, the quarterly report identified in this finding was submitted prior to the identification of the prior year finding.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation (USDOT) Program Name: Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP) ALN and Program Expenditures: 20.106 ($86,526,057) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Special Tests and Provisions – Wage Rate Requirements Finding 2024-038: Failure to Follow Established Control Procedures for Obtaining Certified Payrolls for the Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP) Condition Found: IDOT did not document approval of certified payrolls in accordance with its established internal control procedures for the Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP). Non-federal entities are required to comply with the requirements of the Davis-Bacon Act and the Department of Labor regulations applicable to contracts governing federally financed and assisted construction. These regulations require, in part, that all laborers and mechanics employed by contractors or subcontractors who work on construction contracts in excess of $2,000 financed by Federal assistance funds must be paid prevailing wage rates established for the locality of the project. Each subcontractor subject to the Wage Rate Requirement (formally known as the Davis-Bacon Act) must submit payrolls on a weekly basis and include a signed certification that they have complied with the prevailing wage rates. The resident engineer on the construction site is required to keep a log of contractors and monitor payroll submission. These logs are reviewed by the resident engineer, which indicates that the certified payrolls for that period have been received and meet IDOT’s program requirements. During our testwork of 51 AIP contractor payments for construction projects managed by subrecipients (totaling $18,632,822), we noted that the certified payrolls for 3 AIP contractor payments on construction projects managed by subrecipients (totaling $440,232) did not contain documentation of approval by an IDOT resident engineer. Payments made to subrecipients for construction contracts under the Airport Improvement Program were $38,125,279 during the year ended June 30, 2024. Total payments made to subrecipients under the Airport Improvement Program were $86,237,740 during the year ended June 30, 2024. Criteria or Requirement: 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures in place to ensure certified payrolls are reviewed with proper documentation of resident engineer approval. Cause: In discussing these conditions with IDOT officials, IDOT stated continued staffing turnover, staffing shortages, and shifts in responsibility for oversight between relevant sections/bureaus as such contributed to this finding. Possible Asserted Effect: Failure to approve certified payrolls in line with IDOT’s established control procedures could result in contractors not paying the prevailing wage rate to employees. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code: 2024-038) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOT review its current process and consider any changes necessary to ensure weekly payroll certifications are reviewed and approved in accordance with federal requirements and IDOT’s procedures. Views of IDOT Officials: IDOT agrees with the finding and recommendation. IDOT would like to note that even though the full program title includes “COVID-19 Airport Programs”, this specific issue does not relate to any of the COVID-19 funding sources. COVID-19 funding was not largely utilized by airports for capital projects and the issue noted in this finding relates to capital projects.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP) ALN and Program Expenditures: 20.106 ($86,526,057) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-039: Failure to Report Subaward Information Required by FFATA Condition Found: IDOT failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP). The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers IDOT passed through approximately $86,237,740 to subrecipients of the AIP during the year ended June 30, 2024. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Regulation (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDOT officials, IDOT stated missing FFATA reporting was due to staffing transition combined with a lack of appropriate staffing resources. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subaward in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-043. (Finding Code 2024-039, 2023-043, 2022-029, 2021-036). Recommendation: We recommend IDOT establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of IDOT Officials: IDOT agrees with this finding.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP) ALN and Program Expenditures: 20.106 ($86,526,057) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-040: Inaccurate Information Included in the Financial Reports Condition Found: IDOT did not prepare accurate federal financial status reports for the Airport Improvement Program, COVID-19 Airports Programs, and Infrastructure Investment and Jobs Act Programs (AIP). IDOT is required to prepare a federal financial status report (SF-425) submitted annually for each open grant, due 90 days after the end of each Federal Aviation Administration’s (FAA) fiscal year, by sponsors to monitor outlays and program income on a cash or accrual basis. In addition, this report must be submitted as a final financial report during grant closeout. Further, IDOT is required to submit an Outlay Report and Request for Reimbursement for Construction Program (SF-271) for each construction project, due 90 days after the end of the FAA’s fiscal year, by sponsors to summarize requests for reimbursements. This report must also be submitted as a final financial report during closeout. During our testwork over the annual SF-425 and related SF-271 reports submitted for the federal fiscal year ended September 30, 2023, we noted the following errors: "See Table in the Audit Report" We further noted the supervisory review procedures performed for this report were not at an appropriate level of precision to identify the errors identified in our testing. Additionally, IDOT does not perform analytical procedures to identify potential errors or unusual fluctuations in reported amounts. Criteria or Requirement: According to the SF-425 report Box 13 for certification, recipients of AIP grants must submit true, complete, and accurate information on the SF-425 reports. Further, according to the SF-271 report Box 12 for certification, recipients of AIP grants must certify that the billed costs or disbursements reported are in accordance with the terms of the project and that the reimbursement represents the Federal share due which has not been previously requested and that all work is in accordance with the terms of the award. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure information reported in required financial reports is accurate. Cause: In discussing these conditions with IDOT officials, IDOT stated the preparation of the reports is a manual process and the difference was due to human error. Possible Asserted Effect: Failure to accurately prepare financial reports prevents USDOT from effectively monitoring the Airport Improvement Program. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-044. (Finding Code 2024-040, 2023-044) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOT review the process and procedures in place to prepare financial status reports required for the Airport Improvement Program and implement the additional procedures necessary to ensure the reports are complete, accurate, and agree or reconcile to its financial records. Views of IDOT Officials: IDOT agrees with this finding.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: Highway Planning and Construction (HPC) Program ALN and Program Expenditures: 20.205 ($2,192,857,212) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-041: Failure to Communicate Award Information to Subrecipients Condition Found: IDOT did not follow its established policies and procedures for monitoring subrecipients of the Highway Planning and Construction program. During our testwork of the award communications for our sample of subrecipients, we selected the contracts under which funds were disbursed during fiscal year 2024 to review for compliance with federal award communication requirements. During our review of the award communication files for a sample of 30 awards (related to subrecipient expenditures of $46,016,588), we noted the following information was not communicated in the subrecipient award agreement for three subrecipients sampled (with payments totaling $742,559): • Federal Award Identification Number (FAIN) • Assistance Listing Number (ALN) • Subaward Period of Performance Start and End Date • Subrecipient’s Unique Entity Identifier Amounts passed through to subrecipients under the Highway Planning and Construction program totaled $94,970,638 during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(a), a pass-through entity is required to identify Federal awards made to the subrecipient by informing each subrecipient of required information. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include controls to ensure required information is properly communicated. Cause: In discussing these conditions with IDOT officials, they stated there are two separate causes for this finding. For two of the agreements, the FAIN and ALN were overlooked when drafting the agreement. In these instances, it was employee oversight. For the final agreement noted, elements were missing from the template at that time, and IDOT was unaware of any requirements to have the CFDA# (ALN), DUNS number (UEI), or single audit included in the agreement as it was executed in 2002. Possible Asserted Effect: Failure to communicate required award information may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-041) Recommendation: We recommend IDOT implement additional procedures to ensure award information communicated to subrecipients is reviewed for completeness and accuracy. Views of IDOT Officials: IDOT agrees with the finding.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-042: Failure to Adequately Monitor Subrecipients Condition Found: ICJIA did not follow its established program monitoring policies and procedures for subrecipients of the Crime Victim Assistance (CVA) program during fiscal year 2024. ICJIA selects subrecipients of the CVA program to perform programmatic monitoring procedures using a risk-based approach. Among other things, ICJIA has identified subrecipients receiving CVA funding under shorter term programs (12 months or less in duration) as higher risk and requires an on-site review to be performed once during the period of performance. Additionally, longer term programs (12 to 36 months in duration) require an on-site review in the first twelve months of the period of performance and a second on-site review during the remaining period of performance. In scheduling the timing of its on-site reviews, ICJIA considers whether there are any additional subrecipient specific risk factors that warrant an earlier review time. Based upon ICJIA’s monitoring criteria, we noted ICJIA should have conducted site visits for 51 subrecipients (with expenditures totaling $26,561,276) from longer term programs during the year ended June 30, 2024. During our review of the subrecipient site visits conducted during State fiscal year 2024, we noted 14 of the 51 subrecipients from longer term programs (with expenditures of $4,215,392 during the year ended June 30, 2024) were not subjected to site visits. Additionally, we noted three of the 51 reviews required to be performed during the year ended June 30, 2024 were not performed within the required time period. Specifically, we noted reviews for three subrecipients (with expenditures of $659,442) were performed 19 to 21 days late. ICJIA passed through $50,412,108 to subrecipients of the CVA program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. ICJIA’s Site Visits policy requires Grant Specialists to conduct two site visits within thirty-six months of the start of a grant with the first site visit taking place within the first twelve months, unless the grantee’s Program Risk Assessment requires that a site visit be completed within a shorter time period. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring on-site program monitoring procedures are performed in a timely manner. Cause: In discussing these conditions with ICJIA officials, they stated due to staffing shortages within the federal and state grants unit, all of the required visits were not completed. Possible Asserted Effect: Failure to adequately perform on-site monitoring reviews of subrecipients may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-033. (Finding Code 2024-042, 2023-033) Recommendation: We recommend ICJIA ensure programmatic on-site reviews are performed and documented for subrecipients in accordance with established policies and procedures. Views of ICJIA Officials: ICJIA acknowledges that these gaps in documentation and consistency contributed to the finding and has taken corrective actions to strengthen monitoring procedures, enhance documentation standards, and ensure timely follow-up with subrecipients.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-043: Inadequate Review of Subrecipient Single Audit Reports Condition Found: ICJIA did not adequately review single audit reports received from its subrecipients for the Crime Victim Assistance Program (CVA) program on a timely basis. The State of Illinois established the Grant Accountability and Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal and State programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State. As a State agency, ICJIA is responsible for reviewing the reports assigned to them by GATU and determining whether Federal funds reported in the consolidated year-end financial report (CYEFR) reconcile to ICJIA records. Additionally, as the cognizant State agency, ICJIA is responsible for issuing management decisions on findings reported and applying sanctions to subrecipients who do not comply with reporting requirements (i.e. stop pay process). During our testing of a sample of single audit desk review files for 14 subrecipients (with expenditures of $37,884,972 in the fiscal year), we noted the following: • For five subrecipients (with expenditures totaling $19,501,158), ICJIA did not issue a management decision letter in a timely manner. The delays in issuing management decision letters ranged from 61 to 128 days beyond the required timeframe. • For 11 subrecipients (with expenditures totaling $24,680,412), ICJIA did not reconcile the CYEFR to ICJIA’s records as required. As of the date we communicated our findings to ICJIA (January 27, 2026), ICJIA had still not reconciled the CYEFR to ICJIA’s records for 10 subrecipients (with expenditures totaling $24,097,663). • For one subrecipient (with expenditures of $295,572), the subrecipient single audit reporting package was not submitted within the required timeframe, and ICJIA did not follow up with the subrecipient or invoke the stop pay process. ICJIA has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure single audit reporting requirements, including obtaining and reviewing single audit reporting packages, issuing management decision letters, reconciling CYEFRs to agency records, and invoking stop payment actions, are performed within required timeframes. ICJIA passed through $50,412,108 to subrecipients of the CVA program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statues, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(e)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure Single Audit reports are reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with ICJIA officials, they stated this GATA responsibility has not been performed as consistently as other responsibilities due to competing priorities and staff shortages. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-034. (Finding Code 2024-043, 2023-034) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Additionally, ICJIA should implement procedures to ensure timely reconciliation of funds, issuance of management decision letters, and initiation of the stop pay process. Views of ICJIA Officials: ICJIA agrees with the finding and the cause. Staffing continues to be a priority for resolving the single audit review process.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-044: Inadequate Fiscal Monitoring of Subrecipients Condition Found: ICJIA did not follow its established policies and procedures for monitoring subrecipients of the Crime Victim Assistance (CVA) program. ICJIA selects subrecipients of the CVA program over which to perform fiscal monitoring procedures using a risk-based approach. Specifically, a risk assessment is performed annually over the subrecipient, which includes calculating a risk score based upon criteria established by ICJIA. ICJIA’s risk assessment criteria include the total award amount, the subgrantee’s experience with ICJIA grant awards, results of financial monitoring, the percentage of grant expended to date, the quality of financial submissions, the timeliness of financial submissions, and the payment type. Based upon the risk score, each subrecipient is designated as needing high, moderate, or low oversight. The oversight category assigned determines the frequency and type of financial monitoring (i.e. desk review or fiscal audit). During our audit procedures, we noted three CVA subrecipients (with expenditures of $582,277) were designated for high oversight and did not have a fiscal audit performed over their CVA program grants. Agency personnel indicated additional risk assessment criteria were considered to reduce the number of high oversight subrecipients; however, these additional criteria are not documented in the fiscal monitoring policy or risk score documentation. ICJIA passed through approximately $50,412,108 to subrecipients of the CVA program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity must evaluate each subrecipient's risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. 2 CFR 200.332(e)(3) requires pass-through entities to issue management decisions for applicable audit findings pertaining to the federal awards provided to the subrecipient and 2 CFR 200.332(e)(4) requires pass through entities to resolve audit findings through corrective action plans (CAP). In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing and performing monitoring procedures in accordance with Uniform Guidance and program requirements. Cause: In discussing these conditions with ICJIA officials, they stated ICJIA utilizes both a formal, documented policy to determine a risk score for over 600 active grantees and a more subjective, unwritten assessment to determine which higher and medium risk grantees actually will be scheduled to receive active fiscal monitoring procedures. The subjective analysis is used by ICJIA to adjust the potential volume of monitoring effort to the anticipated number of resources available in a given period. Due to the scarcity of resources, the agency prioritized reviews for subrecipients of other ICJIA programs. Possible Asserted Effect: Failure to fully document required risk assessments and to adequately monitor subrecipients may result in the subrecipient not properly administering the federal program in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-035. (Finding Code 2024-044, 2023-035) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review their fiscal subrecipient monitoring procedures and implement additional procedures as necessary to ensure proper monitoring procedures are performed and documentation of monitoring activities are adequately maintained. Views of ICJIA Officials: ICJIA agrees with the findings as we have additional risk assessment criteria that are established but not documented.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-045: Inadequate Controls Over the Communication of Subrecipient Monitoring Results Condition Found: ICJIA did not consistently document supervisory reviews of the communication of on-site monitoring review results of its subrecipients for the Crime Victim Assistance (CVA) program in accordance with ICJIA’s control procedures. ICJIA internal control procedures require supervisory review and approval of program site visit reports prior to providing the results to subrecipients. During our testing of eight on-site reviews (for subrecipients with expenditures of $3,609,155), we noted the results of seven on-site reviews (for subrecipients with expenditures of $3,167,249) were communicated to the subrecipients prior to supervisory review and approval. ICJIA passed through approximately $50,412,108 to subrecipients of the Crime Victim Assistance (CVA) program during the year ended June 30, 2024. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring supervisory reviews of on-site monitoring results and communications are performed. Cause: In discussing these conditions with ICJIA officials, they stated the exceptions noted are due to inadequate policies and procedures. Possible Asserted Effect: Failure to properly review and approve monitoring reports may result in inaccurate monitoring information and results being communicated to subrecipients. Repeat Finding: A similar finding was reported in the prior year audit as number 2023-036. (Finding Code 2024-045, 2023-036, 2022-024) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review its current process for ensuring on-site monitoring results and communications are properly reviewed and approved before they are sent to subrecipients. Views of ICJIA Officials: ICJIA agrees with the finding and generally agrees with the identified cause. The issue stemmed from weaknesses in internal review and documentation processes, which limited the effectiveness of oversight during the reporting period. ICJIA has since implemented corrective actions to address these control gaps and prevent recurrence.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-046: Inadequate Controls over the Review of Subaward Information Required to be Reported for FFATA Condition Found: ICJIA did not perform supervisory reviews over subaward information required to be reported by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Crime Victim Assistance (CVA) program. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing of 11 subawards (to subrecipients with expenditures totaling $30,433,708), we noted ICJIA could not provide evidence supervisory review procedures were performed to ensure the subaward information required to be reported by FFATA was complete and accurate. ICJIA passed through $50,412,108 to subrecipients of the CVA program during the year ended June 30, 2024. Criteria or Requirement: In accordance with 2 CFR 200.303, non-Federal entities are required to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include implementing procedures to review subaward information prior to submission to ensure all FFATA reports are accurately and timely prepared and submitted in accordance with federal regulations. Cause: In discussing these conditions with ICJIA officials, they stated ICJIA had not implemented formal supervisory review procedures. Possible Asserted Effect: Failure to perform supervisory reviews of subaward information required to be reported by FFATA could result in inaccurate reporting and noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2023-037. (Finding Code 2024-046, 2023-037, 2022-022, 2021-028) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA establish supervisory review procedures of subaward information required to be reported by FFATA. Views of ICJIA Officials: ICJIA agrees to the finding. During State fiscal year 2024, ICJIA was under FFATA policy from October 26, 2022.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-047: Failure to Accurately Prepare Financial Reports for the Crime Victim Assistance Program Condition Found: ICJIA did not prepare accurate federal financial status reports for the Crime Victim Assistance (CVA) program. ICJIA was required to prepare quarterly federal financial status reports (SF-425) for each open grant of the CVA program. During our testing over the quarterly SF-425 reports submitted during state fiscal year 2024, we noted the following error in the Victim of Crime Act (VOCA) 18 grant (#2018-V2-GX-0070) SF-425 report for the quarter ended September 30, 2023."See Table in the Audit Report" We further noted the supervisory review procedures performed for this report were not designed to operate at an appropriate level of precision to ensure financial reports are accurately prepared. Additionally, ICJIA does not perform analytical procedures to identify potential errors or unusual fluctuations in reported amounts. Criteria or Requirement: According to the USDOJ Grants Financial Guide 2024 section 3.15, the SF-425 must show the actual funds that have been spent (expenditures) and any bills that will be paid (unliquidated obligations incurred) at the recipient/subrecipient level for each award. Additionally, recipients are required to report on a quarterly basis the cumulative information on expenditures on line 10e, 10f, 10j, 10m, and 10n of the SF-425. According to the SF-425, Federal Financial Report box 13 for certification, non-Federal recipients of Federal grant awards must submit true, complete, and accurate information on the SF-425 reports. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure information reported in required financial reports is accurate. Cause: In discussing these conditions with ICJIA officials, they stated grants impacted by the COVID-19 pandemic were subject to various alterations to the established match requirements and procedures, which led to some confusion amongst program staff responsible for preparing financial reports. Possible Asserted Effect: Failure to accurately prepare financial reports prevents USDOJ from effectively monitoring the CVA program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-047) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review the process and procedures in place to prepare financial status reports required for the CVA program and implement the additional procedures necessary to ensure the reports are complete, accurate, and agree or reconcile to its financial records. Views of ICJIA Officials: ICJIA agrees to the finding and the cause cited.

State Agency: Illinois Criminal Justice Information Authority (ICJIA) Federal Agency: U.S. Department of Justice (USDOJ) Program Name: Crime Victim Assistance ALN and Program Expenditures: 16.575 ($53,095,634) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2024-048: Inadequate Review of Cash Draw Calculations Condition Found: ICJIA did not adequately document their review of cash draw calculations for the Crime Victim Assistance program. During testing performed over 10 cash draws (totaling $18,381,243), we noted ICJIA could not provide evidence of supervisory review of the calculations supporting the cash draw request prior to submission for reimbursement. Upon further review, there were an additional 37 cash draws (totaling $29,408,246) where ICJIA could not provide evidence of supervisory review of the calculations supporting the cash draws. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure supervisory reviews of cash draw calculations are properly documented. Cause: In discussing these conditions with ICJIA officials, they stated that a change to the formatting of the required Form C-64 in July 2023 removed the requirement for the agency to provide signature approval of each draw. ICJIA stopped documenting their review of cash draw calculations because of this update. Possible Asserted Effect: Failure to adequately perform and document supervisory reviews of cash draw calculations prior to request submission for reimbursement may result in the submission of inaccurate cash draw requests for reimbursement, which could result in the reimbursement of unallowable expenditures. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-048) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICJIA review their process to ensure supervisory reviews of cash draw calculations are properly documented. Views of ICJIA Officials: ICJIA agrees to the finding and the cause cited.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($68,210,944) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2024-049: Inadequate Review of Subrecipient Single Audit Reports Condition Found: IDOA did not adequately document review of single audit reports received from its subrecipients for the Aging Cluster program on a timely basis. The State of Illinois established the Grant Accountability and Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal and State programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning to the applicable state agency any findings attributable to amounts passed through to the subrecipient(s) by the State. IDOA staff are responsible for reviewing the reports assigned to them by GATU and determining whether: (1) federal funds reported in the schedule of expenditures of federal awards reconcile to IDOA records; (2) issuing management decisions on findings reported within required timeframes; and (3) applying sanctions to subrecipients who do not comply with reporting requirements (i.e. stop pay process). During our testing of a sample of single audit desk review files for seven subrecipients (with expenditures of $40,522,841 in the fiscal year), we noted the following: • For five subrecipients (with expenditures totaling $23,626,549), IDOA did not issue a management decision letter. • For one subrecipient (with expenditures totaling $2,117,589), IDOA did not issue a management decision letter over the subrecipient’s single audit that was received during state fiscal year 2024. In addition, the subrecipient did not file a single audit for the prior year with the Federal Audit Clearinghouse. While IDOA received a copy of the unfiled single audit report, a review was not performed and funding was not suspended in accordance with the State’s established policies. IDOA has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure single audit reporting requirements, including obtaining and reviewing single audit reporting packages, issuing management decision letters, and invoking stop payment actions are performed within required timeframes. IDOA passed through $66,724,826 to subrecipients of the Aging Cluster program during the year ended June 30, 2024. Criteria or Requirement: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statues, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal award audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure Single Audit reports are reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with IDOA officials, they stated competing priorities and limited resources have impacted the Department’s ability to comply with this requirement. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Additionally, failure to issue management decision letters within six months of acceptance of the single audit report by the FAC results in noncompliance with federal regulations. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-049) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOA establish procedures to ensure (1) subrecipient single audit report reviewed within established deadlines, (2) management decision letters are issued for all findings affecting its federal programs in accordance with the Uniform Guidance, and (3) follow up procedures are performed to ensure subrecipients have taken timely and appropriate corrective action. Views of IDOA Officials: The Department agrees with this finding. Although the Department shows that all the Area Agency on Aging single audits were received in the audit report review management system (ARRMS), there is one pending approval by the Audit Clearinghouse. The Department did not get the audits reconciled during state fiscal year 2024. The Department did not issue any management decision letters for those audits.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($68,210,944) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-050: Failure to Accurately Prepare Financial Reports for the Aging Cluster Condition Found: IDOA did not prepare accurate federal financial status reports for the Aging Cluster (Aging) program. IDOA is required to prepare semi-annual federal financial status reports (SF-425) for each open grant of the Aging program. During our testing of seven SF-425 reports submitted during state fiscal year 2024, we noted the following errors in the Older Americans Act Title III FFY21 grant (#2101ILOACM) SF-425 report for the semi-annual period ended September 30, 2023: "See Table in the Audit Report" We further noted the supervisory review procedures performed for this report were not designed to operate at an appropriate level of precision to ensure financial reports are accurately prepared. Additionally, IDOA does not perform analytical procedures to identify potential errors or unusual fluctuations in reported amounts. Criteria or Requirement: According to 2 CFR 200.328, Aging Cluster program grantees are required to submit SF-425 and Administration on Aging (AoA) Title III supplemental forms on a semi-annual basis. Reports are due within 30 days for the periods ending March 31 and September 30 and are based on the accrual basis. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure information reported in required financial reports is accurate. Cause: In discussing these conditions with IDOA officials, they stated IDOA’s records were not updated for an error identified during the preparation and supervisory review of the report. Possible Asserted Effect: Failure to accurately prepare financial reports prevents the USDHHS from effectively monitoring the Aging program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-050) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOA review the process and procedures in place to prepare financial status reports required for the Aging program and implement the additional procedures necessary to ensure the reports are complete, accurate, and agree or reconcile to its financial records. Views of IDOA Officials: The Department agrees with this finding. The SF-425 reports are prepared by Department staff, reviewed by an outside contractor, entered into the payment management system, submitted and reviewed again before being certified. Although the adjustment has now been made and staff have been reminded to promptly enter and save adjustments or corrections in the working files at the time of the auditors’ review the spreadsheet was incorrect.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($68,210,944) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2024-051: Failure to Report Subaward Information Required by FFATA Condition Found: IDOA failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Aging Cluster program. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that IDOA did not prepare or submit FFATA reports as required by federal regulations for any subawards made for the Aging Cluster program for the period July 1, 2023 through June 30, 2024. Additionally, we noted IDOA did not establish adequate internal controls over FFATA reporting to ensure all subawards were reported as required. 2024. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDOA officials, they stated with the departure of experienced staff, delay in hiring the new staff and the system change where the FFATA information is to be entered this requirement was overlooked and missed getting completed. Possible Asserted Effect: Failure to identify and report subawards subject to FFATA results in noncompliance with federal regulations. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2024-051) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOA establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with FFATA. Views of IDOA Officials: The Department agrees with this finding.