Audit 404775

FINDING 2025-062 Child and Adult Care Food Program, ALN 10.558 2025-062: U.S. Department of Agriculture Child and Adult Care Food Program, 10.558 Subrecipient Monitoring Material Weakness in Internal Control over Compliance and Material Noncompliance Grant Award Number/Year: Affects grant award #252MI06N1199 (10/1/2024 - 9/30/2025) under assistance listing 10.558. Criteria: Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.332 requires that: • Pass-through entities establish policies for subrecipient monitoring that have a risk-based approach to determine the appropriate monitoring. • Pass-through entities evaluate the risk of noncompliance with a subaward to determine the appropriate monitoring. • Pass-through entities monitor the activities of a subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: Monitoring activities over subrecipient compliance were not performed consistently or documented adequately. Specifically: • On-site reviews were not performed based on the established two-to-three-year review rotation. • The "Review Master Spreadsheet" used to track the risk levels for each subrecipient was not updated to reflect current risk assessments. • There was no evidence of review noted on the "Review Master Spreadsheet." Cause: MDE did not have adequate internal controls to ensure required subrecipient monitoring was established and perform monitoring activities. Effect: Noncompliance at the subrecipient level may occur and not be detected and corrected. Questioned Costs: None Context/ Sampling: A nonstatistical sample of 60 subrecipients out of a population greater than 250 was selected for testing. Of the 60 samples selected, MDE did not perform onsite reviews for 20 subrecipients in compliance with their monitoring procedures. In addition, for 5 of the samples selected, the subrecipient risk ratings were not updated in the "Review Master Spreadsheet" as required by their monitoring procedures. Next, the "Review Master Spreadsheet" was not prepared and reviewed by separate individuals as required by their monitoring procedures. Repeat Findings from Prior Year(s): No Recommendation: We recommend MDE implement internal controls to ensure compliance with their procedures over subrecipient monitoring requirements. Views of Responsible Officials: MDE agrees with this finding.

FINDING 2025-012 SNAP Cluster, ALN 10.551 and 10.561 and Summer Electronic Benefits Transfer Program for Children, ALN 10.646 - System and Organization Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS should ensure it reviews System and Organization Controls* (SOC) reports for services provided by the State's electronic benefits transfer (EBT) service provider. We noted MDHHS did not review and evaluate 2 of the 5 SOC reports received. Of the 3 reports reviewed, we noted MDHHS business area owners did not timely review one of the SOC reports received. For this SOC report, the business area owner completed its review 13 days past the required 60 days. Criteria Federal regulations 7 CFR 274.1(i)(1) and 7 CFR 292.16(a)(7) require states to establish procedures to monitor EBT benefit issuers to ensure their operations comply with SNAP and Summer EBT requirements, including the identification and correction of deficiencies, and to report any violations to the federal government. Also, federal regulations 7 CFR 274.1(i)(2) and 7 CFR 292.16(a)(7) require states to obtain a SOC report by an independent auditor of the state EBT service provider regarding the issuance, redemption, and settlement of benefits under SNAP and Summer EBT. The SOC report must follow EBT guidance as indicated in various federal regulations and Appendix VIII of the U.S. Office of Management and Budget* (OMB) Compliance Supplement to the extent the guidelines relate to SNAP and Summer EBT benefits. The State of Michigan Financial Management Guide (FMG) (Part VII, Chapter 1, Section 1000) prescribes guidelines for departments to assess and manage risks associated with third-party relationships. Departments need to understand and/or evaluate risks and the controls each service organization designs, implements, and operates for the assigned operational process and how the service organization's internal control system impacts the department's internal control system. The FMG provides required SOC report review procedures and requires management to report its review of the SOC report within 60 days of receiving the SOC report. Cause MDHHS stated it did not review the 2 SOC reports because it determined the reports did not include key business process control activities; however, based on our review of the reports, MDHHS agreed the report included the relevant control activities. Also, for the one report not reviewed timely, MDHHS's internal control was not sufficient to ensure all appropriate parties timely complete their review of the SOC reports. Effect MDHHS cannot ensure general controls of vendor-hosted systems are sufficient to ensure the security of the issuance, redemption, and settlement of EBT benefits. The federal grantor agency could issue sanctions or disallowance related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS ensure it reviews SOC reports for services provided by the State's EBT service provider. Management Views MDHHS agrees with the finding.

FINDING 2025-056 WIOA Cluster, ALN 17.258, 17.259, and 17.278 See Schedule of Findings and Questioned Costs for chart/table. Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor and Economic Opportunity (LEO) did not report subaward information to SAM.gov timely or accurately. Context: Eight subawards were selected for testing and the following exceptions were noted: • 2 of 8 subawards were not reported timely. The subawards were issued in March 2025 and should have been reported by April 30, 2025, but were not reported until May 13, 2025, or thirteen days late. • 2 of 8 subawards were not reported accurately: o The total of subaward 58128 25-19 was $192,109 but $194,030 was reported which is a variance of $1,921. o The total of subaward 58140 25-19 was $152,340 but $153,863 was reported which is a variance of $1,523. See Schedule of Findings and Questioned Costs for chart/table. Cause: LEO's procedures and controls were not operating effectively to ensure that subawards were reported timely and accurately. Program financial staff indicated to auditors that the late reports were due to conflicting quarter-end priorities and that the inaccurate reports were due to rounding errors. Effect: Subawards were not reported timely or accurately to SAM.gov. Questioned costs: None noted. Recommendation: We recommend that LEO review and enhance procedures and internal controls to ensure that all required subawards are reported timely to SAM.gov by the end of the month following the month in which each subaward is issued. Controls should be designed to operate effectively throughout the year, including during peak workload periods and competing deadlines. We further recommend that LEO should have sufficient controls in place to verify the accuracy of FFATA reporting before submission, including controls to detect and correct rounding variances and other reporting errors. Views of Responsible Officials: Management Views LEO agrees with the finding.

FINDING 2025-064 Unemployment Insurance, ALN 17.225 See Department of Labor and Economic Opportunity, Unemployment Insurance Agency - Unemployment Compensation Fund, Report on Expenditures of Federal Awards, Year Ended September 30, 2025, Finding 2025-001.

FINDING 2025-065 Unemployment Insurance, ALN 17.225 See Department of Labor and Economic Opportunity, Unemployment Insurance Agency - Unemployment Compensation Fund, Report on Expenditures of Federal Awards, Year Ended September 30, 2025, Finding 2025-002.

FINDING 2025-066 Unemployment Insurance, ALN 17.225 See Department of Labor and Economic Opportunity, Unemployment Insurance Agency - Unemployment Compensation Fund, Report on Expenditures of Federal Awards, Year Ended September 30, 2025, Finding 2025-003.

FINDING 2025-067 Unemployment Insurance, ALN 17.225 See Department of Labor and Economic Opportunity, Unemployment Insurance Agency - Unemployment Compensation Fund, Report on Expenditures of Federal Awards, Year Ended September 30, 2025, Finding 2025-004.

FINDING 2025-057 Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs, ALN 20.106 See Schedule of Findings and Questioned Costs for chart/table. Criteria or specific requirement: Compliance: 2 CFR 200.313 prescribes the requirements for non-federal entities regarding equipment and real property management. Requirements include the following: Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the federal award identification number), who holds title, the acquisition date, cost of the property, percentage of federal participation in the project costs for the federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sales price of the property. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Michigan Department of Transportation (MDOT) did not manage equipment nor maintain property records in accordance with federal requirements. MDOT does not have sufficient policies and controls to adequately oversee equipment and real property purchased with program funds. Context: MDOT awards Airport Improvement Program Funding in accordance with provisions outlined in a Memorandum of Understanding with the Federal Aviation Administration to recipient airports across the State. MDOT is not the end recipient of the program funds, however, MDOT makes direct payments to vendors on behalf of Block Grant Program recipient airports in accordance with FAA policies and procedures. MDOT determined that the agreements it has with the non-primary airports are contractual relationships and not subrecipient. Therefore, despite programmatic requirements being part of the agreement, federal program requirements have not been passed on to the public airports and MDOT is responsible for adherence to applicable federal program requirements specified in the federal award. Auditors selected eight of the forty-three airports for testing and noted the following: • MDOT contracts contain requirements for the airports to manage equipment or maintain property records in accordance with federal requirements, however, MDOT did not require airports to report two-year equipment inventories or real property in a manner that allowed for verification that equipment and real property was acquired and managed by the airports in accordance with federal requirements in a timely manner. • 4 of 8 airports selected for testing did not provide equipment listings. MDOT was unable to provide auditors with a complete list of equipment and real property purchased with program funds to confirm the airports that did not submit information did not have any property or equipment purchases to report. • Two-year physical inventory verifications were not performed nor reconciled. Cause: MDOT informed us that due to variances between the Uniform Guidance and program guidance, MDOT exercised operational discretion and good faith and also sustained program continuity by following and executing program guidance. Effect: MDOT lacks assurance that equipment and real property purchased with federal funds is properly recorded, safeguarded, and used in accordance with program requirements. The absence of complete property records and required physical inventories increases the risk of loss, misuse, or unauthorized disposition of federally funded assets, and that noncompliance could occur and remain undetected. This condition may subject the program to federal actions such as increased oversight, withholding of funds, or other enforcement actions. Questioned costs: None. Recommendation: We recommend that MDOT strengthen its internal controls over equipment and real property in accordance with federal requirements. Specifically, MDOT should develop and implement policies and procedures to ensure that equipment and real property purchased with federal funds is properly tracked, recorded, and safeguarded. If MDOT determines that these requirements should be handled through a subrecipient agreement with the airports, MDOT should update policies and procedures, contracts, and controls regarding subrecipient relationships to ensure the federal requirements are passed through to the subrecipient in accordance with the federal requirements, and update reporting within the schedule of expenditures of federal awards to report subrecipient payments accordingly. Views of Responsible Officials: Management Views MDOT agrees with the finding.

FINDING 2025-058 Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs, ALN 20.106 See Schedule of Findings and Questioned Costs for chart/table. Criteria or specific requirement: Compliance: All laborers and mechanics employed by contractors or subcontractors to work on construction contracts in excess of $2,000 financed by federal assistance funds must be paid wages not less than those established for the locality of the project (prevailing wage rates) by the Department of Labor (DOL) (40 USC 3141–3147). Nonfederal entities shall include in their construction contracts subject to the Wage Rate Requirements (which still may be referenced as the Davis-Bacon Act) a provision that the contractor or subcontractor comply with those requirements and the DOL regulations (29 CFR Part 5, Labor Standards Provisions Applicable to Contracts Governing Federally Financed and Assisted Construction). This includes a requirement for the contractor or subcontractor to submit to the nonfederal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls) (29 CFR sections 5.5 and 5.6; the A-102 Common Rule (section 36(i)(5)); OMB Circular A-110 (2 CFR Part 215, Appendix A, Contract Provisions); 2 CFR Part 176, Subpart C; and 2 CFR section 200.326). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Michigan Department of Transportation (MDOT) did not ensure that contractors complied with Davis-Bacon wage rate requirements. It did not properly obtain weekly certified payrolls from contractors to monitor compliance. Context: MDOT determined that the agreements it has with the non-primary airports are contractual relationships and not subrecipient. Therefore, federal program requirements have not been passed on to the public airports and MDOT is responsible for adherence to applicable federal program requirements specified in the federal award. Auditors selected eight of the forty-three airports for testing Davis-Bacon wage rate requirements and noted the following exceptions: • 5 of the 8 contractors did not have certified payrolls, therefore, MDOT did not review payroll data during the fiscal year to ensure contractors complied with wage rate requirements in a timely manner. • For 2 of 8 contracts, MDOT included Davis-Bacon wage rate requirements in the bid documentation, but not in the executed contracts as required by program requirements. Cause: MDOT does not have sufficient procedures or internal controls to ensure that it monitors contractors' compliance with Davis-Bacon wage rate requirements. Effect: MDOT's failure to include Davis-Bacon wage rate requirements in its contracts and to obtain current year certified payrolls from contractors reduces its ability to monitor compliance with program requirements. As a result, there is an increased risk that contractors were not paid in accordance with required prevailing wage rates, which could result in noncompliance with federal requirements and potential questioned costs. Additionally, continued noncompliance may subject the program to sanctions such as withholding of funds, increased oversight, or other federal enforcement actions. Questioned costs: None. Recommendation: We recommend that MDOT strengthen its internal controls over compliance with Davis-Bacon wage rate requirements. Specifically, MDOT should ensure that contractors are appropriately informed of applicable wage rate requirements by incorporating these provisions into contracts and related documents. In addition, MDOT should develop and implement procedures to ensure that weekly certified payrolls are submitted by contractors and are reviewed in a timely manner to verify compliance. MDOT should also establish follow-up procedures to address instances of noncompliance and ensure timely resolution. If MDOT determines that these requirements should be handled through a subrecipient agreement with the airports, MDOT should update policies and procedures, contracts, and controls regarding subrecipient relationships to ensure the federal requirements are passed through to the subrecipient in accordance with the federal requirements, and update reporting within the schedule of expenditures of federal awards to report subrecipient payments accordingly. Views of Responsible Officials: Management Views MDOT agrees with the finding.

FINDING 2025-059 Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs, ALN 20.106 See Schedule of Findings and Questioned Costs for chart/table. Criteria or specific requirement: Compliance: All revenues generated by a public airport must be expended for the capital or operating costs of the airport, the local airport system, or other local facilities that are owned or operated by the owner or operator of the airport and are directly and substantially related to the actual air transportation of passengers or property. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Michigan Department of Transportation (MDOT) did not ensure that revenues generated by non-commercial airports were expended for the capital or operating costs of the airport, the local airport system, or other local facilities that are owned or operated by the owner or operator of the airport and are directly and substantially related to the actual air transportation of passengers or property. Context: MDOT determined that the agreements it has with the non-primary public airports are contractual relationships and not subrecipient. Therefore, federal program requirements have not been passed on to the public airports and MDOT is responsible for adherence to applicable federal program requirements specified in the federal award. Auditors selected eight of the forty-three airports for testing and for the eight airports selected, MDOT did not ensure that revenue diversion requirements were met. The contracts executed by MDOT included the program's revenue diversion requirements, but MDOT did not monitor the airports' compliance with these requirements and is unable to provide documentation that revenue diversion requirements were met. Cause: MDOT has not prioritized its monitoring and oversight efforts to help ensure that contractors comply with revenue and program income requirements to prevent revenue diversion. Effect: MDOT is unable to ensure that public airports used revenue in accordance with federal requirements. There is an increased risk of revenue diversion occurring or going undetected, potentially resulting in noncompliance with program requirements and questioned costs. Continued noncompliance may also subject the program to federal actions such as increased oversight, withholding of funds, or other enforcement actions. Questioned costs: None. Recommendation: We recommend that MDOT strengthen its internal controls over compliance with revenue diversion requirements. Specifically, MDOT should develop and implement monitoring procedures to ensure that public airports comply with contractual provisions prohibiting revenue diversion. Such procedures should include periodic reviews of financial and supporting documentation, documentation of monitoring activities performed, and timely follow-up on any identified instances of noncompliance to ensure appropriate corrective action is taken. If MDOT determines that these requirements should be handled through a subrecipient agreement with the airports, MDOT should update policies and procedures, contracts, and controls regarding subrecipient relationships to ensure the federal requirements are passed through to the subrecipient in accordance with the federal requirements, and update reporting within the schedule of expenditures of federal awards to report subrecipient payments accordingly. Views of Responsible Officials: Management Views MDOT agrees with the finding.

FINDING 2025-021 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - AASHTOWare Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MDOT did not fully establish effective security management and access controls over AASHTOWare users. MDOT program staff utilize AASHTOWare to administer construction contracts and approve payments to contractors. We noted: a. MDOT did not fully review internal users on an annual basis. b. MDOT did not disable 88 (4%) of 2,287 users who had not accessed the application within 365 days for internal user accounts and 18 months for external user accounts as of September 30, 2025. Our review disclosed: (1) For the 650 internal user accounts, 14 (2%) users had not logged into the application within 365 days, ranging from 1,399 to 4,597 days and 18 (3%) users had not logged in since access was granted. (2) For the 1,637 external user accounts, 56 (3%) users had not logged in since access was granted. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires accounts to be reviewed annually to validate their continued need and the information system to automatically disable inactive internal user accounts after 60 days and inactive external user accounts after 18 months. However, MDOT has a documented business need to allow user access to remain enabled until 365 days of inactivity. Cause MDOT's internal control and monitoring activities were not sufficient to ensure all appropriate parties adhered to established policies. Effect Without effective security management and access controls, individuals may maintain unauthorized or inappropriate access to AASHTOWare. Known Questioned Costs None. Recommendation We recommend MDOT fully establish effective security management and access controls over AASHTOWare users. Management Views MDOT agrees with the finding.

FINDING 2025-022 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - Concur Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition The Michigan Strategic Fund (MSF), in conjunction with the Michigan Economic Development Corporation (MEDC), did not fully implement effective security management and access controls over Concur. MSF and MEDC program staff utilize Concur to approve subrecipient* reimbursement requests. We noted: a. MSF did not fully implement an effective annual recertification process of non-privileged and privileged accounts. MSF did not review active employees' user accounts to ensure users still require system access and the users' access was assigned in accordance with their job responsibilities. b. MSF did not disable 8 (11%) of 73 Concur user accounts able to approve invoices who did not access the application in over 60 days as of September 30, 2025. In 7 instances, users last logged in between 190 to 1,406 days prior and in the other instance, the user had not logged in since access was granted. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. MEDC Standard SECU.01.020.01 requires accounts to be reviewed annually to validate the necessity of all accounts and ensure data permissions assigned to each account are based on the principle of least privilege. The Standard also requires monthly reviews of accounts with no activity for 60 days and determine which inactive accounts should be disabled. Cause MSF informed us its current policy does not apply to Concur because of undocumented risk assessments. However, MSF, in conjunction with MEDC, did not document any exceptions to the policy for Concur. Effect Without effective user access controls, individuals may maintain unauthorized or inappropriate access to Concur. As a result, an increased risk exists because MSF cannot ensure the security of the Concur application and data used to issue payments to subrecipients of federal awards. Known Questioned Costs None. Recommendation We recommend MSF, in conjunction with MEDC, fully implement effective security management and access controls over Concur. Management Views MSF agrees that Concur was not written as an exception in the identified policy, but disagrees that there is a control deficiency. MSF maintains effective controls within its control environment that effectively mitigate risks associated with exempting Concur from the identified policy and provide reasonable assurance MSF is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Auditor's Comments to Management Views MSF believes it has reasonable assurance federal awards are being managed in compliance with federal statutes, regulations, and the terms and conditions of federal awards. However, federal regulation 2 CFR 200.303 states internal control should align with the guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States (Green Book) or the "Internal Control-Integrated Framework" issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Appendix I of the Green Book requires management to document the results of risk assessments including identification, analysis, and response to risks. This includes documentation of the consideration of risks related to information security, which could impact the internal control system. While MSF disagrees a control deficiency exists, it acknowledges it does not have a written exception identified in the referenced policy; it also does not have documentation of its risk assessment related to Concur security, which could impact the internal control system and the response to additional risks by exempting this information system from policy. Therefore, the finding stands as written.

FINDING 2025-023 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - EGrAMS Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition The Department of Labor and Economic Opportunity (LEO) did not fully establish effective security management and access controls over EGrAMS users. LEO utilizes EGrAMS to approve subrecipient reimbursement requests. We noted: a. LEO did not maintain documentation to support the appropriate individual approved the system role for 4 of 6 sampled EGrAMS users, of which all 4 were external users. b. LEO did not establish a process to review internal user accounts on an annual basis. c. LEO did not disable 1,069 (76%) of 1,403 EGrAMS user accounts not accessing the application in over 60 days as of September 30, 2025, ranging from 62 to 838 days since last login. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires agencies to implement and document baseline controls, such as access authorizations. The Standard also requires accounts to be reviewed annually to validate their continued need and the information system to automatically disable inactive user accounts after 60 days. Cause LEO's internal control and monitoring activities were not sufficient to ensure all appropriate parties adhered to established policies. Effect Without effective user access controls, individuals may obtain or maintain unauthorized or inappropriate access to EGrAMS. As a result, an increased risk exists LEO cannot ensure the security of the EGrAMS application and data used to issue payments to subrecipients of federal awards. Known Questioned Costs None. Recommendation We recommend LEO fully establish effective security management and access controls over EGrAMS users. Management Views LEO agrees with the finding.

FINDING 2025-024 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - MiSSG Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MiLEAP did not fully establish effective security management and access controls over the Michigan Student Aid Scholarships and Grants (MiSSG) users. MiLEAP program staff utilize MiSSG to administer Michigan Reconnect scholarships and approve payments to community colleges on behalf of Michigan students. We noted: a. MiLEAP did not maintain documentation for 2 of 7 sampled MiSSG access request forms. b. MiLEAP did not maintain sufficient documentation of its recertification review of internal users. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires agencies to implement and document baseline controls, such as access authorization. The Standard also requires accounts to be reviewed annually to validate their continued need. Cause MiLEAP informed us internal control and monitoring activities were not sufficient to ensure all appropriate parties adhered to established policies and procedures. Effect Without effective security management and access controls, individuals may obtain or maintain unauthorized or inappropriate access to MiSSG. Known Questioned Costs None. Recommendation We recommend MiLEAP fully establish effective security management and access controls over MiSSG. Management Views MiLEAP agrees with the finding.

FINDING 2025-025 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - PTMS Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MDOT did not fully establish effective security management and access controls over PTMS users. MDOT program staff utilize PTMS to approve subrecipient budget and payment requests. We noted MDOT did not maintain a sufficient audit trail to document the users' roles in place during the audit period. As a result, we were unable to isolate a population of users who received access to PTMS during fiscal year ending on September 30, 2025. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.040.01 requires the information system owner to ensure the logging of user access management activities, such as additions, modifications, and deletions of user accounts. Cause MDOT informed us, because of a system limitation, historical user access data was deleted when an existing user received a new role. Effect Without effective user access controls, individuals may obtain or maintain unauthorized or inappropriate access to PTMS. As a result, an increased risk exists where MDOT cannot ensure the security of the PTMS application and data used to issue payments to subrecipients of federal awards. Known Questioned Costs None. Recommendation We recommend MDOT fully implement effective security management and access controls over PTMS users. Management Views MDOT agrees with the finding.

FINDING 2025-026 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Period of Performance - Insufficient Respite Payment Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not have sufficient controls in place to prevent or detect and correct payment errors made to respite grant recipients. We noted MDHHS did not review and approve respite grant payments subsequent to manual input into the Medical Services Administration Manual Payment System (MSAPay). Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Also, Subpart E of federal regulation 2 CFR 200 requires costs charged to federal programs be necessary and reasonable for the administration of the federal award and be in accordance with the relative benefits received by the program. Cause MDHHS's internal control and monitoring activities were not sufficient to ensure it documented its review and approval of respite grant payments in MSAPay. Effect These deficiencies could potentially result in improper payments to recipients. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS improve its controls to prevent or detect and correct payment errors made to respite grant recipients. Management Views MDHHS agrees with the finding.

FINDING 2025-027 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance, and Subrecipient Monitoring - Salesforce Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MSF, in conjunction with MEDC, did not fully implement effective security management and access controls over Salesforce. Program subrecipients utilize Salesforce to submit expenditure reports and reimbursement requests to MSF. Also, MEDC program staff utilize Salesforce to review and approve reimbursement requests. We noted: a. MSF did not fully implement an effective annual recertification process of non-privileged and privileged accounts. MSF did not review active employees' user accounts to ensure users still required access and the users' access was assigned privileges in accordance with their job responsibilities. b. MSF did not disable 14 (4%) of 347 Salesforce user accounts not accessing the application in over 60 days as of September 30, 2025, ranging from 117 to 2,128 days since last login. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. MEDC Standard SECU.01.020.01 requires accounts to be reviewed annually to validate the necessity of all accounts and data permissions assigned to each account are based on the principle of least privilege. The Standard also requires monthly reviews of accounts with no activity for 60 days to determine which inactive accounts should be disabled. Cause MSF informed us its current policy does not apply to Salesforce because of undocumented risk assessments. However, MSF, in conjunction with MEDC, did not document any exceptions to the policy for Salesforce. Effect Without effective user access controls, individuals may maintain unauthorized or inappropriate access to Salesforce. As a result, an increased risk exists where MSF cannot ensure the security of the Salesforce application and data used to issue payments to subrecipients of federal awards. Known Questioned Costs None. Recommendation We recommend MSF, in conjunction with MEDC, fully implement effective security management and access controls over Salesforce. Management Views MSF agrees that Salesforce was not written as an exception in the identified policy, but disagrees that there is a control deficiency. MSF maintains effective controls within its control environment that effectively mitigate risks associated with exempting Salesforce from the identified policy and provide reasonable assurance MSF is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Auditor's Comments to Management Views MSF believes it has reasonable assurance federal awards are being managed in compliance with federal statutes, regulations, and the terms and conditions of federal awards. However, federal regulation 2 CFR 200.303 states internal control should align with the guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States (Green Book) or the "Internal Control-Integrated Framework" issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Appendix I of the Green Book requires management to document the results of risk assessments including identification, analysis, and response to risks. This includes documentation of the consideration of risks related to information security, which could impact the internal control system. While MSF disagrees a control deficiency exists, it acknowledges it does not have a written exception identified in the referenced policy; it also does not have documentation of its risk assessment related to Salesforce security, which could impact the internal control system and the response to additional risks by exempting this information system from policy. Therefore, the finding stands as written.

FINDING 2025-028 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Procurement and Suspension and Debarment - Suspension and Debarment Process See Schedule of Findings and Questioned Costs for chart/table. Condition DTMB did not have an adequate process to ensure the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) contractors who expected to receive more than $25,000 were not suspended or debarred prior to contract execution or purchase order approval for 1 of 3 sampled contractors. Criteria Federal regulations 2 CFR 180.200, 2 CFR 180.220, and 2 CFR 180.300 require when DTMB enters into a covered transaction expecting to equal or exceed $25,000, DTMB must verify the contractor, with whom it plans to do business, is not suspended or debarred. This can be accomplished by checking the federal website, collecting a certification, or adding a clause or condition to the covered transaction agreement. Cause DTMB informed us this error was due to an oversight in its process for verifying its contractors are not federally suspended or debarred. Effect An increased risk exists because DTMB could provide grant funds to suspended or debarred contractors. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. We reviewed the federal website and noted this contractor was not suspended or debarred; therefore, we did not question the cost. Recommendation We recommend DTMB establish an adequate process to ensure CSLFRF contractors expected to receive more than $25,000 are not suspended or debarred prior to contract execution or purchase order approval. Management Views DTMB agrees with the finding.

FINDING 2025-029 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Subrecipient Monitoring - MiGrants Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition The Department of Natural Resources (DNR) did not fully establish effective security management and access controls over MiGrants. DNR program staff utilize MiGrants to approve subrecipient reimbursement requests. We noted: a. DNR did not maintain documentation to support the appropriate individual approved the system role for 2 (8%) of 24 sampled MiGrants user accounts. Of the 22 user accounts reviewed, DNR did not ensure it properly approved 1 (5%) user account prior to granting access to MiGrants. b. DNR did not maintain documentation of its annual recertifications for 10 (91%) of 11 sampled internal MiGrants user accounts. c. DNR did not disable 219 (16%) of 1,391 MiGrants user accounts not accessing the application in over 60 days as of September 30, 2025, ranging from 61 to 363 days since last login. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires agencies to implement and document baseline controls, such as access authorizations. The Standard also requires accounts should be reviewed annually to validate their continued need and the information system to automatically disable inactive user accounts after 60 days. Cause DNR's internal control and monitoring activities were not sufficient to ensure all appropriate parties adhered to established policies. Effect Without effective user access controls, individuals may obtain or maintain unauthorized or inappropriate access to MiGrants. As a result, an increased risk exists where DNR cannot ensure the security of the MiGrants application and data used to issue payments to subrecipients of federal awards. Known Questioned Costs None. Recommendation We recommend DNR fully establish effective security management and access controls over MiGrants. Management Views DNR agrees with the finding.

FINDING 2025-030 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Subrecipient Monitoring - Subaward Information See Schedule of Findings and Questioned Costs for chart/table. Condition MSF did not report to its subrecipients all subaward information as required by the Uniform Guidance. We noted MSF did not report one or more of the following for 3 of 4 sampled CSLFRF subrecipients: identification of whether the award is for research and development (R&D), indirect cost rate for the federal award, and an approved federally recognized indirect cost rate for the subrecipient. Criteria Federal regulation 2 CFR 200.332(b) requires all pass-through entities ensure every subaward includes certain information. Cause MSF incorrectly interpreted federal regulation notification requirements for two subrecipients. For the remaining subrecipient, MSF informed us staff turnover and limitations contributed to a delay in complete communication of required subaward information to current subrecipients. Effect Subrecipients and their auditors may not be aware of the federal award information needed to ensure compliance with the federal requirements. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MSF report to its subrecipients all subaward information as required by the Uniform Guidance. Management Views MSF agrees with the finding.

FINDING 2025-031 Coronavirus State and Local Fiscal Recovery Funds, ALN 21.027, Subrecipient Monitoring - Subrecipient Audits See Schedule of Findings and Questioned Costs for chart/table. Condition The Department of Environment, Great Lakes, and Energy (EGLE) and DNR did not properly monitor their subrecipients to ensure they complied with the Uniform Guidance. We noted: a. EGLE did not appropriately identify or document if its subrecipients required a single audit for 7 (27%) of 26 sampled subrecipients. We reviewed the federal audit clearinghouse (FAC) and noted 5 of the 7 subrecipients had single audit reports submitted to the FAC in fiscal year 2025 and one required a management decision letter on its findings. b. DNR did not appropriately identify or document if the subrecipients required a single audit for 5 of 8 sampled subrecipients. Therefore, DNR did not monitor these subrecipients to ensure the status or submission of their single audit reports, if applicable. For these five subrecipients, we reviewed the FAC and noted the subrecipients did not submit a single audit report to the FAC during fiscal year 2025. Criteria Federal regulation 2 CFR 200.501 requires nonfederal entities who expend $750,000 or more in federal awards during their fiscal year to obtain a single audit for that fiscal year. Also, federal regulation 2 CFR 200.332(f) requires the pass-through entity to verify these subrecipients are audited as required by Subpart F of the Uniform Guidance, Audit Requirements, when it is expected the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the $750,000 threshold. In addition, federal regulation 2 CFR 200.521(d) requires the pass-through entity to issue a management decision letter on the appropriateness of all audit findings related to its federal awards and the subrecipient's corrective action plan within six months of acceptance by the FAC. Cause For part a., EGLE informed us its subrecipient expenditure query was limited to only EGLE expenditure data because of an oversight, which prevented the identification of all subrecipients exceeding the single audit threshold. For part b., DNR informed us its subrecipient expenditure query did not include sufficient CSLFRF coding because of an oversight, which prevented the identification of all CSLFRF subrecipients. Effect EGLE and DNR limited the State's assurance their subrecipients complied with grant requirements and implemented corrective actions for audit findings to prevent future sanctions or disallowed costs, which could necessitate adjustments to their records. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend EGLE and DNR properly monitor their subrecipients to ensure they comply with the Uniform Guidance. Management Views EGLE and DNR agree with the finding.

FINDING 2025-060 Coronavirus Capital Projects Fund, ALN 21.029 See Schedule of Findings and Questioned Costs for chart/table. Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. For the Coronavirus Capital Projects Fund program, FSRS was inaccessible to recipients due to a technical configuration problem until August 2023. Due to this technical issue, Treasury issued guidance requesting that recipients complete FSRS reporting by no later than June 30, 2024. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor and Economic Opportunity (LEO) did not report subaward information timely. Context: Seven of eight subawards selected for testing were not reported timely. Specifically, we noted the following: • 5 of 8 subawards, totaling $50,553,778, were issued in 2023 and early 2024 and, per Treasury's reporting guidance, should have been reported in FSRS no later than June 30, 2024. Two of the subawards were reported in March 2025 and three of the subawards were reported in September 2025, which was eight to thirteen months after Treasury's extended deadline. • 2 of 8 subawards, totaling $9,739,385, were issued on August 1, 2024, but were not reported until January and February 2025, or four to five months late. See Schedule of Findings and Questioned Costs for chart/table. Cause: LEO's procedures and controls were not operating effectively to ensure that subawards were reported timely, in accordance with FFATA reporting requirements and Treasury's reporting guidance. Effect: Subawards were not reported timely to FSRS or SAM.gov. Questioned costs: None noted. Recommendation: We recommend that LEO review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to SAM.gov no later than the end of the month following the month of issuance of each subaward, or in accordance with deadlines established by Treasury. Views of Responsible Officials: Management Views The Department of Labor and Economic Opportunity (LEO) agrees with the finding.

FINDING 2025-063 Special Education Cluster (IDEA), ALN 84.027 and 84.173 2025-063: U.S. Department of Education Special Education Cluster (IDEA) Special Education - Grants to States, 84.027A, Special Education - Preschool Grants (IDEA Preschool), 84.173A Subrecipient Monitoring Significant Deficiency in Internal Control over Compliance Grant Award Number/Year: Affects grant award #H027A230110 (7/1/2024 - 9/30/2026) under assistance listing 84.027A. Criteria: Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.332 requires that: • Pass-through entities establish policies for subrecipient monitoring that have a risk-based approach to determine the appropriate monitoring. • Pass-through entities evaluate the risk of noncompliance with a subaward to determine the appropriate monitoring. • Pass-through entities monitor the activities of a subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: The Michigan Department of Education (MDE) has established policies that have a risk-based approach to determine their monitoring procedures. As part of this process, they evaluate the risk of noncompliance with a subaward which determined the level of monitoring performed. For all low and moderate‑risk subrecipients, management reviews the financial summaries, approved budget, budget‑to‑actual reports, and holds meetings with the subrecipients. However, the reports reviewed are at a summary level allowing for the risk that the subrecipient has unallowable costs/activities since none of the underlying data is reviewed or sampled. While review of the high-level summaries and budgets do provide some reasonable assurance that the subaward is used for authorized purposes, the lack of review of underlying data could result in a noncompliance that goes undetected and uncorrected. Cause: MDE does not have monitoring policies for low and moderate risk subrecipients that requires for review or sampling of the underlying data for allowable costs/activities to ensure the subaward is used for authorized purposes and complies with the terms and conditions of the subaward. Without a review of the underlying source documentation, allowability cannot be adequately determined to provide reasonable assurance. Effect: Noncompliance at the subrecipient level may occur and not be detected and corrected. Questioned Costs: None Context/ Sampling: A nonstatistical sample of 9 out of 58 subrecipients was selected for testing. Repeat Findings from Prior Year(s): No Recommendation: We recommend MDE enhance their existing controls and update the subrecipient monitoring procedures to include some level of review of underlying supporting documentation for allowable costs/activities for low and moderate subrecipients. These procedures could include: • A random sample of subrecipients each year to review a sample of their underlying documentation. • Require a select number of subrecipients each year to provide a detailed general ledger and perform detailed analytics on the data received. Views of Responsible Officials: MDE disagrees with this finding as more fully described in the accompanying corrective action plan. Auditor's Comments to Views of Responsible Officials: The Uniform Guidance requires MDE to monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. While MDE's response is accurate in that the Uniform Guidance does not require routine review of underlying documentation for every subrecipient in every monitoring cycle, our professional judgment is such that the monitoring performed by MDE is not to a sufficient level of detail or comprehensive enough for low or moderate risk subrecipients to provide for reasonable assurance that the low risk and moderate risk subrecipients complied with federal statutes, regulations, and the terms of conditions of the subaward. The procedures performed by MDE, while contributing to the overall monitoring program, are too broad for consistent reasonable assurance to occur. Therefore, in our judgment, the finding and recommendation are appropriate.

FINDING 2025-001 SIGMA High-Risk Activity Monitoring See Schedule of Findings and Questioned Costs for chart/table. Condition The Michigan Department of Lifelong Education, Advancement, and Potential (MiLEAP) did not sufficiently monitor its high-risk activity reports to ensure users performed only authorized override actions in the Statewide Integrated Governmental Management Applications* (SIGMA). We reviewed one sampled report and noted MiLEAP did not document its review. Criteria Title 2, Part 200, section 303 of the Code of Federal Regulations* (CFR) requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Federal regulation 45 CFR 98.68 requires MiLEAP to describe in its CCDF State Plan the internal control in place to help ensure program integrity. MiLEAP's CCDF State Plan for Federal Fiscal Years 2025-2027 describes specific procedures for program integrity and accountability, including program violations and administrative errors. Also, the CCDF State Plan provides specific requirements for child care assistance, which MiLEAP utilizes an information system for payment of benefits. The State of Michigan establishes Statewide technical standards for all State information systems. State of Michigan Administrative Guide to State Government policy 1340.00 states security* controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality*, integrity*, and availability* of State of Michigan information. State of Michigan (SOM) Technical Standard 1340.00.020.01 requires agencies to implement and document baseline controls, such as the principle of least privilege*. The Standard also requires agencies to monitor privileged system functions to identify inappropriate or unusual activity. Cause MiLEAP informed us the transfer of the high-risk transaction monitoring process from another State agency contributed to a delay in MiLEAP implementing its monitoring process. Effect Individuals may have made inappropriate override actions in SIGMA that were not detected in a timely manner. As a result, an increased risk exists MiLEAP did not identify inappropriate or high-risk activity associated with SIGMA transactions. Known Questioned Costs None. Recommendation We recommend MiLEAP sufficiently monitor its high-risk activity reports to ensure users performed only authorized override actions in SIGMA. Management Views MiLEAP agrees with the finding.

FINDING 2025-009 MDE, Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition The Michigan Department of Education (MDE) did not fully establish effective security management and access controls over the Grant Electronic Monitoring System/Michigan Administrative Review System (GEMS/MARS) and Next Generation Grant, Application and Cash Management System (NexSys). We noted: a. MDE did not consistently follow its established policies and procedures over the granting of access to NexSys. Our review disclosed MDE did not maintain documentation to support it approved the system role for 1 (2%) of 47 sampled NexSys users. Of the 46 forms received, we noted MDE did not properly approve 1 (2%) form prior to granting access to NexSys. Also, MDE did not ensure the access rights were consistent with the most recently approved NexSys forms for 2 (4%) of 46 sampled users. b. MDE did not document or properly review its annual recertification of internal users. Our results are summarized in the following table: See Schedule of Findings and Questioned Costs for chart/table. c. MDE did not disable 317 (5%) of 5,798 NexSys user accounts who did not access the application in over 18 months as of September 30, 2025. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Federal regulation 45 CFR 98.68 requires MiLEAP to describe in its CCDF State Plan the internal control in place to help ensure program integrity. MiLEAP's CCDF State Plan for Federal Fiscal Years 2025-2027 describes specific procedures for program integrity and accountability, including program violations and administrative errors. Also, the CCDF State Plan provides specific requirements for child care assistance, which MiLEAP utilizes an information system for approving grant applications and authorizing payment requests for services. The State of Michigan establishes Statewide technical standards for all State information systems. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires agencies to implement and document baseline controls, such as access authorizations. The Standard also requires separation of duties must be supported through defined system access authorizations, accounts should be reviewed annually to validate their continued need, and the information system to automatically disable inactive internal user accounts after 60 days. However, MDE requested and received an approved exception, which allows user accounts to not be disabled until after 18 months. Cause MDE's internal control and monitoring activities were not sufficient to ensure all appropriate parties adhered to established policies. Effect Without effective user access controls, individuals may obtain or maintain unauthorized or inappropriate access to MDE's systems. Known Questioned Costs None. Recommendation We recommend MDE fully establish effective security management and access controls over GEMS/MARS and NexSys. Management Views MDE agrees with the finding.

FINDING 2025-010 MDE, Change Management Process See Schedule of Findings and Questioned Costs for chart/table. Condition MDE did not fully implement an effective change management process over NexSys. We sampled 11 NexSys change deployments and noted: See Schedule of Findings and Questioned Costs for chart/table. Criteria Federal regulation 2 CFR 200.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Federal regulation 45 CFR 98.68 requires MiLEAP to describe in its CCDF State Plan the internal control in place to help ensure program integrity. MiLEAP's CCDF State Plan for Federal Fiscal Years 2025-2027 describes specific procedures for program integrity and accountability, including program violations and administrative errors. Also, the CCDF State Plan provides specific requirements for child care assistance, which MiLEAP utilizes an information system for approving grant applications and authorizing payment requests for services. The State of Michigan establishes Statewide technical standards for all State information systems. State of Michigan Administrative Guide to State Government policy 1340.00 establishes the configuration management standard and procedures to address the controls implemented within systems and organizations. SOM Technical Standard 1340.00.060.04 requires the business owner to perform post-implementation validation. SOM Technical Procedure 1340.00.060.04.01 requires each test type to have its own set of documentation. Cause MDE informed us because of an oversight, it did not document the testing results and perform post-implementation validation. Effect Without an effective change management process, individuals may make unauthorized or inappropriate changes to NexSys. As a result, an increased risk exists where MDE cannot ensure NexSys is configured and operating securely and as intended. Known Questioned Costs None. Recommendation We recommend MDE fully implement an effective change management process over NexSys. Management Views MDE partially agrees with the finding. MDE agrees that testing results were not fully documented. However, MDE does not agree that post implementation validation could be performed. The scan-vulnerability process could not be performed in the production environment in this instance without significantly impacting system performance for users, making post implementation validation infeasible. Auditor's Comments to Management Views MDE acknowledged it did not perform post-implementation validation in the production environment because it would significantly impact system performance. Contrary to MDE's views, not conducting post-implementation testing increases the risk of potential vulnerabilities or system failure, and testing is required by SOM technical standards. Further, MDE has indicated it plans to take some corrective action by evaluating alternative methods for post-implementation validation. During this evaluation, MDE could consider implementing alternative testing strategies to minimize operational disruptions, such as conducting vulnerability scans and deployments outside normal business hours. Therefore, the finding stands as written.

FINDING 2025-032 CCDF Cluster, ALN 93.575 and 93.596, Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility; and Cost Sharing (including Matching), Level of Effort, and Earmarking - Client Eligibility See Schedule of Findings and Questioned Costs for chart/table. Condition MiLEAP and MDHHS did not ensure compliance with federal laws and regulations relating to client eligibility for CCDF Cluster child care payments for 2 (3%) of the 60 cases we reviewed. In both instances, MDHHS case record documentation was inconsistent with client eligibility information entered in Bridges. For these cases, the authorized hours of care in Bridges exceeded the client's documented need for hours of child care services. Criteria Federal regulation 45 CFR 98.20 provides eligibility requirements for child care services and permits MiLEAP to establish eligibility requirements in addition to those outlined in the section as long as the additional requirements are not in violation of the regulation. Federal regulation 45 CFR 98.16(i)(5) requires MiLEAP identify child care eligibility requirements in its CCDF State Plan. MiLEAP's CCDF State Plan for Federal Fiscal Years 2025-2027 provides specific requirements for client, child, and provider eligibility. Also, CCDF program policy deems clients are either income eligible or categorically eligible if they participate in certain other programs such as foster care. The client's income or categorical eligibility determines the client's level of benefits, and the child must be assigned to an eligible provider. Federal regulation 45 CFR 98.55 allows states to claim expenditures to be matched at the FMAP rate for allowable activities, as described in the approved state plan. In order to receive federal matching funds for a fiscal year, states must also expend an amount of nonfederal funds for child care activities in the state at least equal to the state's share of expenditures for the fiscal years 1994 or 1995 (whichever is greater) under Sections 402(g) and 402(i) of the federal Social Security Act as these sections were in effect before October 1, 1995, and the expenditures must be for allowable services or activities, as described in the approved state plan. Cause MDHHS informed us its internal control and monitoring activities were not sufficient to ensure MDHHS maintained or appropriately considered all required verification documentation in the client's case record to support eligibility. Effect MiLEAP may have made payments on behalf of ineligible clients. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs Federal regulation 2 CFR 200.516(a)(3) requires the auditor to report known questioned costs less than $25,000 if it is likely total questioned costs would exceed $25,000. • $431 - federal share. • $231 - State share of costs MiLEAP inappropriately used as matching. Recommendation We recommend MiLEAP and MDHHS maintain sufficient documentation and ensure Bridges appropriately reflects documentation to support client eligibility was determined in accordance with eligibility requirements. Management Views MiLEAP and MDHHS agree with the finding.

FINDING 2025-033 CCDF Cluster, ALN 93.575 and 93.596, Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility; Cost Sharing (including Matching), Level of Effort, and Earmarking; and Special Tests and Provisions - Provider Health and Safety Requirements See Schedule of Findings and Questioned Costs for chart/table. Background For fiscal year 2025, MiLEAP was responsible for performing on-site inspections and licensing of child care providers. MiLEAP completed on-site inspections to issue licenses, to renew licenses at the end of the license period, and to perform an interim inspection during the license period. Condition MiLEAP did not ensure inspections to support child care providers were performed in accordance with applicable health and safety requirements to be eligible for CCDF Cluster payments. Our review of 53 sampled licensed providers for the CCDF Cluster payments disclosed: a. MiLEAP did not perform annual on-site inspections for 2 (4%) licensed providers. b. MiLEAP did not ensure timely annual on-site inspections for 3 (6%) licensed providers. We noted MiLEAP performed the on-site inspections ranging from 14 to 23 months after the last on-site inspection. Criteria Federal regulation 45 CFR 98.41 states the lead agency (MiLEAP) shall have in effect, under State, local, or tribal law, requirements designed, implemented, and enforced to protect the health and safety of children and provide the minimum health and safety topics applicable to child care providers of services. The regulation also allows for MiLEAP to include additional requirements determined to be necessary to promote child development and to protect children's health and safety as long as the additional requirements are not inconsistent with the parental choice safeguards. Federal regulation 45 CFR 98.42(b)(2) states MiLEAP shall certify in its CCDF State Plan it has monitoring policies and practices applicable to all child care providers eligible to deliver services for which assistance is provided under the CCDF Cluster. MiLEAP must require inspections of licensed child care providers at licensure and not less than annually for compliance with all health and safety requirements described in federal regulation 45 CFR 98.41 and fire standards. Section 5 of MiLEAP's CCDF State Plan for Federal Fiscal Years 2025-2027 provides the State's standards and monitoring processes to ensure providers meet health and safety requirements in the federal regulations. Cause MiLEAP informed us limited resources and transition to a new system impacted the timeliness of some inspections. Effect MiLEAP may not have identified the child care providers potential noncompliance with all applicable health and safety requirements in a timely manner, resulting in potential improper payments to providers. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MiLEAP ensure inspections to support child care providers are performed in accordance with applicable health and safety requirements to be eligible for CCDF Cluster payments. Management Views MiLEAP agrees with the finding.

FINDING 2025-034 CCDF Cluster, ALN 93.575 and 93.596, Reporting - FFATA Reporting See Schedule of Findings and Questioned Costs for chart/table. Condition MiLEAP did not ensure it timely reported CCDF Cluster subaward information as required by FFATA. We reviewed five subawards totaling $7,687,446 and noted MiLEAP did not timely report any subaward information. Criteria Federal regulation 2 CFR 170 implemented FFATA requirements for reporting subaward information and requires MiLEAP to report, on the federal website, each action that obligates $30,000 or more in federal funds by the end of the month following the month in which the subaward was made. Cause MiLEAP informed us because of an oversight and the transfer of the reporting procedures to a new agency, it did not timely report the subaward information. Effect MiLEAP grant information was not timely available for public access through the federal website established to improve transparency of governmental spending, as required. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MiLEAP ensure it timely reports CCDF Cluster subaward information as required by FFATA. Management Views MiLEAP agrees with the finding.

FINDING 2025-035 CCDF Cluster, ALN 93.575 and 93.596, Subrecipient Monitoring - Subaward Information See Schedule of Findings and Questioned Costs for chart/table. Condition MiLEAP did not report to its subrecipients all subaward information as required by the Uniform Guidance. We noted MiLEAP did not report the unique entity identifier (UEI), FAIN, federal awarding agency name, ALN title, and identification of whether the award was R&D for all five sampled CCDF Cluster subawards. Criteria Federal regulation 45 CFR 75.352(a) requires all pass-through entities ensure every subaward includes certain information. Cause MiLEAP informed us it did not always provide all required subaward information to subrecipients because of an oversight. Effect Subrecipients and their auditors may not be aware of the federal award information needed to ensure compliance with the federal requirements. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MiLEAP report to its subrecipients all subaward information as required by the Uniform Guidance. Management Views MiLEAP agrees with the finding.

FINDING 2025-006 ADP Security Program See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS and DTMB did not ensure a comprehensive ADP security program was fully implemented for information systems used to administer their federal programs. We reviewed 6 significant systems and noted MDHHS and DTMB did not complete all necessary updates to the system security plan for 3 systems during fiscal year 2025, including not updating the risk analyses which resulted in the expiration of the authority to operate and/or missing control assessments for the systems. Criteria Federal regulations 7 CFR 272.10 and 45 CFR 95.621 make state agencies responsible for security of information systems used to administer federal programs. In part, the regulations require state agencies to establish and maintain an ADP security program, including a security plan and a program for conducting periodic risk analyses. In addition, federal regulations 2 CFR 200.303 and 45 CFR 75.303 require the auditee to establish and maintain effective internal control over federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Cause MDHHS and DTMB indicated resources were focused on meeting federal and State mandates while maintaining operational needs and addressing information technology (IT) security risks highlighted in prior audits. MDHHS and DTMB also indicated limited resources caused delays in the completion of a comprehensive ADP security program. Effect MDHHS and DTMB cannot demonstrate they have implemented effective controls to ensure the confidentiality, integrity, and availability of their information systems and cannot ensure they comply with applicable direct and material federal compliance requirements, such as the Medicaid Cluster special tests and provisions - ADP risk analysis and system security review requirement. Outdated or incomplete system security plans and risk analyses put the security of critical systems at risk by failing to mitigate potential vulnerabilities. The federal grantor agency could issue sanctions and/or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS and DTMB ensure a comprehensive ADP security program is fully implemented for information systems used to administer federal programs. Management Views MDHHS and DTMB agree with the finding.

FINDING 2025-036 Medicaid Cluster, ALN 93,775, 93.777, and 93.778, Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility; and Cost Sharing (including Matching), Level of Effort, and Earmarking - MiAIMS User Access See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not fully implement effective user access controls over MiAIMS. We noted MDHHS did not always request users to complete their annual recertification for 1 (3%) of 35 sampled non-privileged users. Therefore, MDHHS did not review this user to ensure the appropriateness of their access to MiAIMS. Criteria Federal regulation 45 CFR 75.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires agencies to implement and document baseline controls, such as the principle of least privilege. The Standard also requires accounts to be reviewed annually to validate their continued need and accounts should be removed in accordance with agency policy and procedures. MDHHS MiAIMS policy indicates the Database Security Application (DSA) automatically generates a renewal form for non-privileged users. The users complete the forms and the authorized approvers review the forms. When users are not reauthorized within 45 days, DSA will send notifications to the system administrator and create a removal access form for those users. Cause MDHHS informed us the user did not complete their annual recertification because of staff oversight. Effect Without effective user access controls, individuals may maintain unauthorized or inappropriate access to MiAIMS. As a result, an increased risk exists where MDHHS cannot ensure the security of the MiAIMS application. Known Questioned Costs None. Recommendation We recommend MDHHS fully implement effective user access controls over MiAIMS. Management Views MDHHS agrees with the finding.

FINDING 2025-037 Medicaid Cluster, ALN 93.775, 93.777, and 93.778, Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility; and Cost Sharing (including Matching), Level of Effort, and Earmarking - Transitional Medicaid Eligibility See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not ensure renewals were processed on a timely basis for beneficiaries receiving transitional medical assistance Medicaid coverage. Our query of 20,166 Medicaid beneficiaries receiving transitional medical assistance for more than 13 months disclosed 16,682 (83%) beneficiaries continued to receive improper benefit payments after the transitional eligibility period ended. Criteria In accordance with federal regulation 42 CFR 435.10, MDHHS's Medicaid State Plan specifies it provides extended medical coverage for up to 12 months to families with dependent children terminated solely because of earnings, hours of employment, or loss of earned income disregards (although the provision expired in 1998, this is still permitted according to federal law 42 USC 1396r-6). Also, MDHHS developed policies and procedures related to the "transitional medical assistance" Medicaid coverage eligibility group providing coverage for up to 12 months. MDHHS elected to exercise the option extended to the states, by CMS, to delay procedural disenrollments for beneficiaries for one month while the State conducts targeted outreach for renewals initiated through June 30, 2025. This strategy, offered by CMS, assists the states during the process of returning to normal operations following the expiration of the continuous enrollment condition in place during the public health emergency (PHE). Our review did not include beneficiaries who had accumulated 13 months of transitional medical assistance because of the above provision. Cause MDHHS informed us there was a breakdown of internal processes causing the delay in timely termination of some beneficiaries within the transitional medical assistance Medicaid eligibility group. Effect MDHHS paid Medicaid providers $18,200,871 during fiscal year 2025 on behalf of 16,682 beneficiaries in the transitional Medicaid eligibility group for medical services provided after the allowed 13-month transitional period had expired. The 16,682 beneficiaries received an average of 108 additional transitional Medicaid coverage days, ranging from 28 to 1,826 days. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs • $11,854,227 - federal share. • $6,346,644 - State share of costs MDHHS inappropriately used as matching. Recommendation We recommend MDHHS ensure renewals are processed on a timely basis for beneficiaries receiving transitional medical assistance Medicaid coverage. Management Views MDHHS agrees with the finding.

FINDING 2025-038 Medicaid Cluster, ALN 93.775, 93.777, and 93.778, Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility; and Cost Sharing (including Matching), Level of Effort, and Earmarking - Payments on Behalf of Ineligible Beneficiaries See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not ensure beneficiary eligibility was updated in CHAMPS. As a result, MDHHS issued $3,277 for 19 (63%) of 30 payments sampled from a $2,159,524 population of beneficiary payments with no corresponding Medicaid coverage. Criteria Federal regulation 42 CFR 435.1002(b) indicates federal funding is available only for services provided to eligible beneficiaries. Cause MDHHS informed us that because of system issues in Bridges, inaccurate eligibility information from Bridges was interfaced into CHAMPS, resulting in beneficiaries appearing eligible in CHAMPS in error and payments being processed based on that eligibility. Outstanding system defect fixes remain unresolved at this time, primarily because of competing priorities and resource constraints within MDHHS and DTMB. Effect MDHHS made payments on behalf of ineligible beneficiaries. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs Federal regulation 2 CFR 200.516(a)(3) requires the auditor to report known questioned costs less than $25,000 if it is likely total questioned costs exceed $25,000. • $2,155 - federal share of payments made to providers on behalf of ineligible beneficiaries. • $1,122 - State share of payments made to providers on behalf of ineligible beneficiaries. Recommendation We recommend MDHHS ensure beneficiary eligibility is updated in CHAMPS. Management Views MDHHS agrees with the finding.

FINDING 2025-039 Medicaid Cluster, ALN 93.775, 93.777, and 93.778, Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility; and Cost Sharing (including Matching), Level of Effort, and Earmarking - Ineligible HHP Payments See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not prevent or timely recover payments, totaling $118, for 2 (13%) of 15 sampled clients who were hospitalized while receiving Home Help Program (HHP) services and no longer met eligibility requirements. Criteria Federal regulation 42 CFR 435.10 requires MDHHS to specify in its State Plan the groups to whom Medicaid is provided and the conditions of eligibility for individuals in those groups. MDHHS's Medicaid State Plan states it will provide personal care services under HHP. MDHHS has developed the Adult Services Manual (ASM) to further define specific policies and procedures for delivery of Medicaid HHP services. ASM Section 140 prohibits payment for HHP services on days a client is unavailable because of hospitalization, except the caregiver may receive payment of HHP services on the day a client is admitted to a hospital if HHP services were completed before the time the client was admitted to the hospital. Also, ASM Section 140 allows payment for HHP services on the day a client is discharged from the hospital. Cause MDHHS informed us the monthly Home Help Hospitalization reports excluded some overlapping HHP services and hospitalizations because of timing differences between the report run dates and the weekly schedule updates of CHAMPS hospitalization data. Effect MDHHS paid a total of $118 from October 1, 2024 through September 30, 2025 for sampled clients who did not qualify for HHP services because they were hospitalized. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs Federal regulation 2 CFR 200.516(a)(3) requires the auditor to report known questioned costs less than $25,000 if it is likely total questioned costs would exceed $25,000. • $77 - federal share of amounts paid for HHP services while sampled clients were hospitalized. • $41 - State share of costs MDHHS inappropriately used as matching. Recommendation We recommend MDHHS prevent or timely recover payments for HHP services when the clients no longer meet eligibility requirements. Management Views MDHHS agrees with the finding.

FINDING 2025-040 Medicaid Cluster, ALN 93.775, 93.777, and 93.778, Allowable Costs/Cost Principles and Cost Sharing (including Matching), Level of Effort, and Earmarking - Practitioner Reimbursement See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not ensure proper payment of practitioner fee-for-service (FFS) claims. We noted MDHHS paid $760,516 for 10,984 FFS claims for beneficiaries simultaneously enrolled in an MHP. Criteria According to its Medicaid State Plan, MDHHS provides coverage of practitioner services for eligible Medicaid beneficiaries. Also, MDHHS's policy contained in its Medicaid Provider Manual establishes limitations, restrictions, and other requirements that must be met in order for MDHHS to reimburse Medicaid practitioner FFS claims. In addition, Subpart E of federal regulation 45 CFR 75 requires costs conform to any limitations, exclusions, or conditions and be consistent with policies applying to the federal award. Cause MDHHS stated eligibility and enrollment are not static, and CHAMPS is not the system of record for eligibility. CHAMPS must make payments to FFS providers and managed care entities based upon the eligibility and enrollment in the system at the time the payment is made. MDHHS informed us the primary remaining sources for overlaps between FFS and capitation payments are due to retroactive removal of Medicaid eligibility. Effect MDHHS made improper FFS practitioner payments of $760,516 from October 1, 2024 through September 30, 2025. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs • $550,094 - federal share of improper payments made to providers from October 1, 2024 through September 30, 2025. • $210,422 - State share of costs MDHHS inappropriately used as matching. Recommendation We recommend MDHHS ensure proper payment of practitioner FFS claims for the Medicaid Cluster. Management Views MDHHS agrees with the finding.

FINDING 2025-041 Medicaid Cluster, ALN 93.775, 93.777, and 93.778, Activities Allowed or Unallowed; Allowable Costs/Cost Principles; and Cost Sharing (including Matching), Level of Effort, and Earmarking - Medical Records See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS was unable to provide medical records to support 1 of 3 selected Medicaid FFS claims. Criteria Federal law 42 USC 1396a(a)(78) requires providers to be enrolled with the state before providing medical assistance on an FFS basis. When enrolling, providers agree to keep any records necessary to disclose the extent of services the provider furnishes to beneficiaries. Also, State law requires licensed providers to keep and maintain medical records for a minimum of seven years. Cause MDHHS informed us it places heavy reliance on the provider maintaining appropriate documentation for services provided because post-payment review processes do not validate all provider documentation requirements. Effect Without medical records, MDHHS is unable to demonstrate the services actually occurred or were medically necessary. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs Federal regulation 2 CFR 200.516(a)(3) requires the auditor to report known questioned costs less than $25,000 if it is likely total questioned costs would exceed $25,000. • $107 - federal share of the payment made for services not supported by a medical record. • $57 - State share of costs MDHHS inappropriately used as matching. Recommendation We recommend MDHHS ensure providers maintain medical records to support Medicaid FFS claims. Management Views MDHHS agrees with the finding.

FINDING 2025-042 Medicaid Cluster, ALN 93.775, 93.777, and 93.778, Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cost Sharing (including Matching), Level of Effort, and Earmarking; and Special Tests and Provisions - Benefits Monitoring Program See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not ensure the notification of and placement reviews for Medicaid beneficiaries enrolled in the Benefits Monitoring Program (BMP) were conducted in a timely manner. Our review disclosed: a. MDHHS did not ensure the MHP timely notified beneficiaries of their enrollment in BMP for 1 (4%) of 23 sampled Medicaid beneficiaries. The MHP notified the beneficiary 15.2 months after the initial enrollment. b. MDHHS did not complete timely placement reviews for 4 (24%) of 17 sampled Medicaid beneficiaries who participated in BMP a minimum of 24 months. For these 4 beneficiaries, the placement reviews were late between 1.2 and 6.7 months, averaging 4.6 months. Criteria Federal regulations 42 CFR 456.3(a) and 42 CFR 456.4 require MDHHS to implement and monitor a statewide surveillance and utilization control program, which includes safeguards against unnecessary or inappropriate use of Medicaid services and against excess payments. MDHHS Medicaid Provider Manual (Beneficiary Eligibility Chapter, Section 8) indicates, prior to enrollment, the beneficiaries receive a BMP enrollment notification letter detailing the findings, enrollment effective date, instructions on the selection of providers, and how to file an appeal. The Medicaid Provider Manual also indicates beneficiaries found to engage in misutilization are placed in BMP for a minimum of 24 months and MDHHS shall review these placements at least once every 24 months. Cause For part a., MDHHS's monitoring activities were not sufficient to ensure the MHPs adhered to the MDHHS Medicaid Provider Manual. MDHHS informed us an oversight by the Health Plan BMP care managers resulted in the late enrollment notification provided to the beneficiary. For part b., MDHHS informed us the beneficiaries moved from an MHP to FFS during fiscal year 2025, and MDHHS's review of the enrolled research reports did not identify it was now responsible for these beneficiaries' BMP placement reviews instead of the MHP. Effect Beneficiaries not notified of enrollment in BMP do not have the opportunity to appeal the findings and select their authorized providers, which could hinder the beneficiaries' utilization of Medicaid services. Also, MDHHS may not have identified if the beneficiaries' utilization patterns continue to demonstrate potential overutilization and/or misutilization of their Medicaid benefits in a timely manner, thus, potentially increasing unnecessary Medicaid costs. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS ensure the timely notification of and placement reviews for Medicaid beneficiaries enrolled in BMP. Management Views MDHHS agrees with the finding.

FINDING 2025-043 Temporary Assistance for Needy Families, ALN 93.558, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility - Non-Financial Eligibility Documentation See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not obtain or maintain sufficient non-financial case record documentation, such as completed application forms, verifications to support the age and relationship of the children to the adult on the case record, and support for timely completion of the Family Automated Screening Tool to support client eligibility for 5 (20%) of 25 sampled TANF-funded assistance payments. Criteria Federal regulation 45 CFR 260.20 requires a family be needy in order to be eligible for TANF assistance and job preparation services. Federal regulation 45 CFR 205.60(a) requires MDHHS to maintain records to support eligibility, including facts to support the client's need for assistance. MDHHS's policies and procedures require documentation used to verify eligibility be maintained in the case file. In addition, Subpart E of federal regulation 45 CFR 75 requires costs charged to federal programs be adequately documented, be necessary and reasonable for the administration of the federal award, be in accordance with the relative benefits received by the program, and be consistent with policies and procedures applying to both the federal award and other activities of the state. Cause MDHHS informed us its controls were not sufficient to ensure all of the required verification documentation was appropriately maintained in the client's case record. Effect MDHHS may have made TANF-funded assistance payments to ineligible clients. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs Federal regulation 2 CFR 200.516(a)(3) requires the auditor to report known questioned costs less than $25,000 if it is likely total questioned costs would exceed $25,000. • $462 - federally funded. Recommendation We recommend MDHHS obtain and maintain sufficient non-financial case record documentation to support client eligibility for TANF-funded assistance payments. Management Views MDHHS agrees with the finding.

FINDING 2025-044 Temporary Assistance for Needy Families, ALN 93.558, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility - Inappropriate TANF-Funded Emergency Foster Care Assistance See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not timely consider a child's circumstances to ensure the child met eligibility requirements for 1 of 5 sampled, TANF-funded, emergency foster care case records. Our review disclosed the child met Foster Care Title IV-E program requirements, therefore did not meet TANF eligibility requirements. Criteria MDHHS's TANF State Plan allows MDHHS to use TANF funds for emergency foster care only if such care cannot be provided under Title IV-E. ACF's TANF Program Policy Questions and Answers indicate states may not use federal TANF or State maintenance of effort funds to take the place of any foster care maintenance payments provided under the federal foster care program. In addition, Subpart E of federal regulation 45 CFR 75 requires costs charged to federal programs be necessary and reasonable for the administration of the federal award, be in accordance with the relative benefits received by the program, and be consistent with policies and procedures applying to both the federal award and other activities of the State. Cause MDHHS's internal control was not sufficient to review and approve the fund source reconciliation within the same fiscal year as the TANF eligibility requirements were redetermined and the child became Title IV-E eligible. Effect MDHHS may have made emergency foster care payments on behalf of a child who did not qualify for TANF federal reimbursement. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs Federal regulation 2 CFR 200.516(a)(3) requires the auditor to report known questioned costs less than $25,000 if it is likely total questioned costs would exceed $25,000. • $587 - federally funded. Recommendation We recommend MDHHS timely consider a child's circumstances to ensure the child meets TANF eligibility requirements. Management Views MDHHS agrees with the finding.

FINDING 2025-045 Temporary Assistance for Needy Families, ALN 93.558, Subrecipient Monitoring - Risk Assessments See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not sufficiently monitor and evaluate the risk of noncompliance with program requirements. We noted MDHHS did not complete a risk assessment to determine the type of monitoring appropriate for 1 of 4 sampled subrecipients. Criteria Federal regulation 45 CFR 75.352(b) requires MDHHS to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring related to the subaward. Cause MDHHS informed us it did not complete the risk assessment because of staff oversight and because this was the first year TANF funded the grant. Effect Insufficient monitoring of subrecipients could increase the subrecipients' and MDHHS's noncompliance with federal statutes, regulations, or the terms and conditions of federal awards. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS sufficiently monitor and evaluate the risk of noncompliance with program requirements. Management Views MDHHS agrees with the finding.

FINDING 2025-046 Temporary Assistance for Needy Families, ALN 93.558, Special Tests and Provisions - Child Support Non-Cooperation See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not appropriately and timely sanction TANF families who did not cooperate with establishing paternity and child support orders in 6 (15%) of the 40 sampled case records. MDHHS uses an automated interface between the Michigan Child Support Enforcement System and Bridges to identify and sanction TANF families not cooperating with establishing paternity and child support orders. We noted: a. In 5 of the 6 cases, the automated interface identified the TANF family was not cooperating, but the benefits did not stop, and the clients' case records did not contain evidence the clients met good cause criteria for not cooperating. b. In 1 of the 6 cases, the TANF family cooperated within the negative action period; however, the family was inappropriately sanctioned and benefits were stopped. Criteria Federal regulation 45 CFR 264.30 states MDHHS must deduct an amount equal to not less than 25% from the TANF-funded assistance that would otherwise be provided to the family of the individual or may deny the family any TANF-funded assistance. MDHHS's TANF State Plan states failure to cooperate in establishing paternity and pursuing child support for dependent children will result in TANF client ineligibility for a one month minimum. Cause MDHHS's internal control was not sufficient to ensure the accurate application of TANF non-cooperation sanctions in five identified cases. In one case, MDHHS did not ensure Bridges appropriately excluded a TANF non-cooperation sanction. Effect MDHHS may have inappropriately paid TANF funds to individuals who were ineligible because of failure to comply with child support requirements. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendations We recommend MDHHS appropriately and timely sanction TANF families who do not cooperate with establishing paternity and child support orders. We also recommend MDHHS not sanction TANF families who timely cooperate with establishing paternity and child support orders. Management Views MDHHS agrees with the finding.

FINDING 2025-047 Refugee and Entrant Assistance State/Replacement Designee Administered Programs, ALN 93.566, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Period of Performance, and Subrecipient Monitoring - Salesforce Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition LEO did not fully establish effective security management and access controls over the Salesforce users. Program subrecipients utilize Salesforce to submit performance data, contract budgets, and expenditure submissions related to refugee resettlement. Also, LEO program staff utilize Salesforce to manage subgrants and review and approve subrecipient contract budgets and payment requests. We noted: a. LEO did not establish a process to review internal user accounts on an annual basis. b. LEO did not disable users who had not accessed the application within 60 days for internal user accounts and 18 months for external user accounts. Our review disclosed 1 (4%) of 26 internal user accounts had not been accessed in 189 days as of September 30, 2025. Also, 14 (4%) of 330 external user accounts had not been accessed in over 18 months as of September 30, 2025, ranging from 20 to 57 months since last login. Criteria Federal regulation 45 CFR 75.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires accounts should be reviewed annually to validate their continued need and the information system to automatically disable inactive internal user accounts after 60 days and inactive external user accounts after 18 months. Cause LEO's internal control and monitoring activities were not sufficient to ensure all appropriate parties adhered to established policies. Effect Without effective user access controls, individuals may maintain unauthorized or inappropriate access to Salesforce. As a result, an increased risk exists where LEO cannot ensure the security of the Salesforce application and data used to issue payments to subrecipients of federal awards. Known Questioned Costs None. Recommendation We recommend LEO fully establish effective security management and access controls over Salesforce users. Management Views LEO agrees with the finding.

FINDING 2025-048 Refugee and Entrant Assistance State/Replacement Designee Administered Programs, ALN 93.566, Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility - Assistance to Ineligible Refugees See Schedule of Findings and Questioned Costs for chart/table. Condition LEO and MDHHS did not ensure compliance with federal laws and regulations to support continuous client eligibility requirements. Our review disclosed MDHHS did not maintain sufficient documentation to support the clients met mandatory work requirements for 16 (43%) of 37 sampled refugee cash assistance payments. Criteria Federal regulation 45 CFR 400.75(a) requires eligible refugees receiving refugee cash assistance must not, without good cause, fail or refuse to meet the work registry requirements. Also, federal regulation 45 CFR 400.28 requires MDHHS provide for the maintenance of operational records as are necessary for federal monitoring of the State's REAP. Federal regulation 45 CFR 75.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Cause MDHHS's internal control and monitoring activities were not sufficient to ensure MDHHS maintained or appropriately considered the required verification documentation in clients' case records to support registration and mandatory work requirements. Effect We consider this to be a material weakness and material noncompliance because MDHHS may have provided assistance to ineligible clients and because of the overall high error rate. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs Federal regulation 2 CFR 200.516(a)(3) requires the auditor to report known questioned costs less than $25,000 if it is likely total questioned costs would exceed $25,000. • $1,163 - federal share. Recommendation We recommend LEO and MDHHS maintain documentation to support client eligibility in accordance with eligibility requirements. Management Views LEO and MDHHS agree with the finding.

FINDING 2025-049 Refugee and Entrant Assistance State/Replacement Designee Administered Programs, ALN 93.566, Reporting - FFATA Reporting See Schedule of Findings and Questioned Costs for chart/table. Condition LEO did not ensure it reported or timely reported all REAP subaward information as required by the FFATA of 2006. Our results are summarized in the following table: See Schedule of Findings and Questioned Costs for chart/table. We noted LEO did not report any subaward information for 2 (10%) of 20 sampled subawards. Of the 18 subawards in SAM, LEO did not timely submit subaward information for 14 (78%) sampled subawards. Criteria Federal regulation 2 CFR 170 implemented FFATA requirements for reporting subaward information and requires LEO to report, on the federal website, each action that obligates $30,000 or more in federal funds by the end of the month following the month in which the subaward was made. Cause LEO informed us it relied on a query process that failed to account for substantial delays between the time a subaward was signed by both parties and when it was entered and fully approved in SIGMA, which adversely impacted its ability to complete or timely complete FFATA reporting. Effect LEO grant information was not reported or timely available for public access through the federal website established to improve transparency of governmental spending. We consider this to be a material weakness and material noncompliance because of the amount of subawards not reported. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend LEO ensure it reports or timely reports all REAP subaward information as required by FFATA. Management Views LEO agrees with the finding.

FINDING 2025-050 Refugee and Entrant Assistance State/Replacement Designee Administered Programs, ALN 93.566, Subrecipient Monitoring - Subrecipient Audits and Subaward Information See Schedule of Findings and Questioned Costs for chart/table. Condition LEO did not properly monitor its subrecipients to ensure they complied with the Uniform Guidance. In addition, LEO did not report to its subrecipients all subaward information as required by the Uniform Guidance. We noted: a. LEO did not review subrecipient single audit reports for all nine sampled REAP subrecipients during fiscal year 2025. Therefore, LEO did not monitor these subrecipients to ensure the status or submission of their single audit reports and did not determine whether a management decision letter was needed. b. LEO did not report the UEI, FAIN, federal award date, total amount of the federal award committed to the subrecipient, federal awarding agency name, ALN, Assistance Listing Title, identification of whether the award is for R&D, and an approved federally recognized indirect cost rate for the subrecipient for 1 (9%) of 11 sampled REAP subrecipients. Criteria Federal regulation 45 CFR 75.501 requires nonfederal entities who expend $750,000 or more in federal awards during their fiscal year to obtain a single audit for that fiscal year. Also, federal regulation 45 CFR 75.352(f) requires the pass-through entity to verify these subrecipients are audited as required by Subpart F of the Uniform Guidance, Audit Requirements, when it is expected the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the $750,000 threshold. In addition, federal regulation 45 CFR 75.521(d) requires LEO to issue a management decision letter on the appropriateness of all audit findings related to its federal awards and the subrecipient's corrective action plan within six months of acceptance by FAC. In addition, federal regulation 45 CFR 75.352(a) requires all pass-through entities ensure every subaward includes certain information. Cause For part a., LEO informed us the timing of process implementation and competing priorities contributed to its inability to review subrecipient single audits. For part b., LEO informed us, because of an oversight, the original grant agreement and amendments did not include all federal award information. Effect LEO limited the State's assurance its subrecipients complied with grant requirements and implemented corrective actions for audit findings to prevent future sanctions or disallowed costs, which could necessitate adjustments to LEO's records. Also, subrecipients and their auditors may not be aware of the federal award information needed to ensure compliance with the federal requirements. We consider this to be a material weakness and material noncompliance because LEO did not complete any monitoring of its subrecipients' single audits. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendations We recommend LEO monitor its subrecipients to ensure they comply with the Uniform Guidance. We also recommend LEO ensure it reports to its subrecipients all subaward information as required by the Uniform Guidance. Management Views LEO agrees with the finding.

FINDING 2025-051 Low-Income Home Energy Assistance, ALN 93.568, Eligibility - Eligibility Determinations See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not maintain sufficient documentation of its efforts to evaluate client eligibility; examples of documentation include support for the verification of the client's income, client contribution payment, and proof of energy crisis for 8 (21%) of 38 sampled LIHEAP-funded State Emergency Relief (SER) energy payments. Criteria Federal law 42 USC 8624 requires the state to expend funds in accordance with the LIHEAP State Plan and allows MDHHS to use LIHEAP funds to intervene in energy-related crisis situations and assist eligible households to meet the costs of home energy. MDHHS policy requires county/district office specialists to verify and include certain incomes of SER group members during intake in order to determine eligibility for SER energy services. Also, policy indicates the client contribution payment or payment by another agency must be verified before authorizing the department's portion of the remaining cost of services. In addition, policy requires the case record documentation be maintained to support the proof of energy crisis. Cause MDHHS's internal control and monitoring activities were not sufficient to ensure county/district office specialists adhered to established policies and procedures. Effect We consider this to be a material weakness and material noncompliance because MDHHS may have made payments on behalf of ineligible recipients and because of the high error rate. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs Federal regulation 2 CFR 200.516(a)(3) requires the auditor to report known questioned costs less than $25,000 if it is likely total questioned costs would exceed $25,000. • $2,071 - federal share. Recommendation We recommend MDHHS maintain sufficient documentation to support client eligibility for LIHEAP-funded SER energy payments. Management Views MDHHS agrees with the finding.

FINDING 2025-052 Low-Income Home Energy Assistance, ALN 93.568, Subrecipient Monitoring - Subrecipient Audits See Schedule of Findings and Questioned Costs for chart/table. Condition The Department of Licensing and Regulatory Affairs (LARA) did not properly monitor its Michigan Energy Assistance Program (MEAP) subrecipients to ensure they complied with the Uniform Guidance. LARA did not have an adequate process to identify or document if the subrecipient required a single audit and steps taken to determine whether a management decision letter was needed. We reviewed the FAC and noted 6 of 8 MEAP subrecipients submitted single audit reports to the FAC in fiscal year 2024 and/or fiscal year 2023. We verified there were no findings related to the subrecipients' LIHEAP federal awards. Criteria Federal regulation 2 CFR 200.501 requires nonfederal entities who expend $750,000 or more in federal awards during their fiscal year to obtain a single audit for that fiscal year. Also, federal regulation 2 CFR 200.332(f) requires the pass-through entity to verify these subrecipients are audited as required by Subpart F of the Uniform Guidance, Audit Requirements, when it is expected the subrecipient's federal awards expended during the respective fiscal year equaled or exceeded the $750,000 threshold. In addition, federal regulation 2 CFR 200.521(d) requires the pass-through entity to issue a management decision letter on the appropriateness of all audit findings related to its federal awards and the subrecipient's corrective action plan within six months of acceptance by the FAC. Cause LARA informed us it did not have a process in place to document its review of MEAP subrecipient single audits. Effect LARA limited the State's assurance its subrecipients complied with grant requirements and implemented corrective actions for audit findings to prevent future sanctions or disallowed costs, which could necessitate adjustments to their records. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend LARA monitor its MEAP subrecipients to ensure they comply with the Uniform Guidance. Management Views LARA agrees with the finding.

FINDING 2025-020 Foster Care Title IV-E, ALN 93.658 and Adoption Assistance, ALN 93.659 - Accuracy of Financial Reports See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not accurately report administrative costs on the Foster Care Title IV-E and Adoption Assistance quarterly financial reports (CB-496 reports) to the U.S. Department of Health and Human Services' (HHS's) Administration for Children and Families (ACF). MDHHS's Public Assistance Cost Allocation Plan (PACAP) describes the procedures used to identify, measure, and allocate all costs to each of its federal programs. Depending on various factors, MDHHS may not record these cost allocation transactions until after the quarterly financial report due dates. MDHHS's process is to report the cost allocation expenditures related to a prior quarter as current quarter claims in the subsequent CB-496 reports. For all 2 Foster Care Title IV-E CB-496 sample reports and 2 Adoption Assistance CB-496 sample reports, we noted MDHHS included unreported cost allocation expenditures allocated to a previous quarter in the current quarter claims columns, resulting in overstating of the total and federal share of expenditures made in the current (claiming) quarter columns and understating the total and federal share of expenditure made in or allocated in the prior quarter adjustment columns. Our review disclosed: a. In the 2025 first quarter Foster Care Title IV-E CB-496 report, MDHHS reported fiscal year 2024 fourth quarter cost allocation related to in-placement administrative costs (lines 5, 6, and 7) in the current quarter claims columns, resulting in overstating the current quarter claims total and federal share of expenditures (columns A and B) by $30.5 million and $15.2 million, respectively, and understating the prior quarter adjustment total and federal share of expenditures (columns C and D) by $30.5 million and $15.2 million, respectively. b. In the 2025 third quarter Foster Care Title IV-E CB-496 report, MDHHS reported fiscal year 2025 second quarter cost allocation related to in-placement administrative costs (lines 5, 6, and 7) in the current quarter claims columns, resulting in overstating the current quarter claims total and federal share of expenditures (columns A and B) by $23.9 million and $11.9 million, respectively, and understating the prior quarter adjustment total and federal share of expenditures (columns C and D) by $23.9 million and $11.9 million, respectively. c. In the 2025 second quarter Adoption Assistance CB-496 report, MDHHS reported fiscal year 2025 first quarter cost allocation related to administrative costs - agency (line 22) in the current quarter claims columns, resulting in overstating the current quarter claims total and federal share of expenditures (columns A and B) by $8.6 million and $4.3 million, respectively, and understating the prior quarter adjustment total and federal share of expenditures (columns C and D) by $8.6 million and $4.3 million, respectively. d. In the 2025 fourth quarter Adoption Assistance CB-496 report, MDHHS reported fiscal year 2025 third quarter cost allocation related to administrative costs - agency (line 22) in the current quarter claims columns, resulting in overstating the current quarter claims total and federal share of expenditures (columns A and B) by $14.9 million and $7.4 million, respectively, and understating the prior quarter adjustment total and federal share of expenditures (columns C and D) by $14.9 million and $7.4 million, respectively. Criteria Federal regulation 45 CFR 75.302(b)(2) requires grantees to submit accurate, current, and complete disclosure of the financial results of each federal award or program in accordance with the reporting requirements. Federal regulation 45 CFR 95.13(d) indicates when a state allocates administrative or training costs, the expenditures are considered to have been made in the quarter to which the costs were allocated in accordance with each program's regulations. The reporting instructions include specific detail for reporting information, such as current quarter claims are expenditures made in or allocated to the current quarter being reported and prior quarter adjustments are expenditures made in or allocated to a previous quarter that were either unreported or incorrectly reported on an earlier report. Cause MDHHS's internal control was not sufficient to ensure accurate financial reports. Effect MDHHS may have diminished the federal grantor's ability to ensure appropriate oversight and monitoring of Foster Care Title IV-E and Adoption Assistance funds. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS improve its internal control and report accurate administrative costs on the Foster Care Title IV-E and Adoption Assistance quarterly financial reports to ACF. Management Views MDHHS disagrees with the finding. The expenditures noted were recorded through MDHHS's normal, federally approved Public Assistance Cost Allocation Plan (PACAP) cost allocation process. As part of this process, certain administrative costs are not identifiable or allocable to federal programs until the allocation is completed. At that point, MDHHS recognizes these costs as expenditures in the CB-496 report in the quarter in which the allocation occurs and the costs are assigned to the grant. Consistent with this approach, MDHHS has historically reported these amounts as current quarter expenditures. MDHHS previously consulted with the U.S. Department of Health and Human Services (HHS) Administration for Children and Families (ACF) on the appropriate use of the prior quarter adjustment column, and MDHHS was verbally instructed to no longer record these administrative costs as adjustments since this is part of the normal cost allocation process. ACF approves the CB-496 reports in the federal system and ensures the final award amount reconciles with the amounts reported. This approval process supports the reporting approach used by MDHHS is both consistent with prior guidance and accepted by ACF through its approval and award process. Auditor's Comments to Management Views In October 2021, MDHHS requested guidance via e-mail to ACF regarding the reporting of cost allocation expenditures on the CB-496 report. In this correspondence, MDHHS informed ACF it runs the quarterly cost allocation after the close of the quarter and since fiscal year 2018, when the State implemented its new accounting system, it reported cost allocation expenditures as prior quarter adjustments. MDHHS asked ACF if it would be acceptable to report these cost allocation expenditures as current quarter expenditures. The ACF regional grant management contact indicated it would be acceptable for maintenance payments, but it may not apply to administration cost under 45 CFR 95.13. ACF indicated it would discuss further. There was no further written communication from ACF. However, MDHHS indicated ACF "verbally instructed" MDHHS to "no longer record these administrative costs as adjustments". Also, MDHHS documented its interpretation of 45 CFR 95.13, indicating "allocation determines the reporting quarter, not the date the original accounting entry is posted." However, this interpretation conflicts with federal regulation 45 CFR 95.13(d), which states expenditures for administration or training are considered to have been made "in the quarter to which the costs were allocated in accordance with the regulations for each program." In addition, MDHHS documented its interpretation of the CB-496 instructions, stating "prior-period adjustments are for corrections, not normal timing differences." MDHHS also identified actual payments or allowable cost items allocable to the program and indirect costs allocable in accordance with its cost allocation plan as key instructions. MDHHS believes the key instruction language "reinforces allocability, not posting date, determines the reporting period." However, this interpretation conflicts with the reporting instructions. The reporting instructions define current quarter claims as "expenditures made in or allocated to the 'Current (Claiming) Quarter' being reported" and prior quarter adjustments as "expenditures made in or allocated to a previous quarter that were either unreported or incorrectly reported on an earlier report." Without documented correspondence between MDHHS and ACF, it is unclear if the regional grant management contact had all necessary information to assess MDHHS's procedures to report cost allocation expenditures on the CB-496 reports. Also, lack of written guidance limits MDHHS's assurance it obtained an opinion from a federal person with the authority to issue an opinion on behalf of ACF, thus ensuring consistent interpretation of federal regulations and reporting instructions. While ACF reviews the submitted CB-496 reports, it has no way of knowing whether the expenditures reported are from prior periods unless it has requested the grantees provide supporting documentation, such as support of current expenditures, prior quarter adjustments, and other information reported on the form. During our audit period, ACF did not request this information. Further, the OMB Compliance Supplement identified existing compliance requirements which the federal government expects to be considered as part of an audit, including expecting the auditor to determine whether required reports include all activity of the reporting period, are supported by applicable accounting records, and are fairly presented in accordance with governing requirements. We have concluded these reports did not meet those requirements. Therefore, the finding stands as written.

FINDING 2025-053 Adoption Assistance, ALN 93.659, Cost Sharing (including Matching), Level of Effort, and Earmarking and Reporting - Annual Adoption Savings Calculation and Accounting Report See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not ensure the accuracy of the savings reported to HHS on the cumulative Annual Adoption Savings Calculation and Accounting Report. MDHHS utilizes a query to determine applicable only status and non-applicable status cases to calculate the required savings for applicable only status cases. Our review of 60 cases included on the report disclosed: a. Four (13%) of the 30 cases determined by MDHHS to be applicable only status were not accurately accounted for in this status. The statuses were actually non-applicable, and MDHHS inappropriately reported savings associated with these four cases. b. Five (17%) of the 30 cases determined by MDHHS to be non-applicable status were not accurately accounted for in this status. The statuses were actually applicable only, and MDHHS did not report the savings associated with these five cases. Criteria Federal law 42 USC 673(a)(8)(A) requires MDHHS to calculate savings realized as a result of applying revised eligibility requirements during the fiscal year. Federal law 42 USC 673(a)(8)(D)(i) requires MDHHS to spend an amount equal to the calculated savings on any service provided to children of families under Part B or E of Title IV of the federal Social Security Act. Federal laws 42 USC 673(a)(8)(B)(ii) and 42 USC 673(a)(8)(B)(iii) require MDHHS to report annually to HHS the savings realized and how the savings were spent on the Annual Adoption Savings Calculation and Accounting Report. Cause MDHHS informed us an error in its query criteria contributed to the inaccurate case statuses. Effect MDHHS may have improperly calculated savings and inaccurately reported the information to HHS. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS ensure the accuracy of the savings reported to HHS on the Annual Adoption Savings Calculation and Accounting Report. Management Views MDHHS agrees with the finding.

FINDING 2025-054 Adoption Assistance, ALN 93.659, Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility; and Cost Sharing (including Matching), Level of Effort, and Earmarking - Lack of Fingerprint Background Checks See Schedule of Findings and Questioned Costs for chart/table. Background Upon initial assessment, MDHHS is responsible for conducting background checks, clearances, criminal history checks, and fingerprinting on all prospective adoptive families. Within 12 months of adoption approval, placement, and finalization, MDHHS is responsible for conducting fingerprinting on all prospective adoptive parents. Condition MDHHS did not ensure it conducted the required fingerprint background checks on prospective adoptive parents within the 12 months prior to adoptive placement and/or adoption finalization for 5 (13%) of 40 sampled cases. The initial fingerprint background checks were completed between 12 and 38 months prior to the adoption finalization, averaging 24 months. Criteria Federal law 42 USC 671(a)(20) implemented additional background checks for prospective foster care and adoptive placements. The law requires each state to conduct fingerprint-based criminal records checks of the national crime information databases for prospective foster or adoptive parents and to search child abuse and neglect registry databases in each state where the prospective foster or adoptive parent, and any other adult living in the home, have resided in the preceding five years if the state maintains such a registry. The checks must be completed prior to approving the family for foster care or adoptive placement and are required regardless of whether foster care or adoption assistance title IV-E maintenance payments are to be made on behalf of the child. According to its Title IV-E Foster Care and Adoption Assistance State Plan, MDHHS has established policy related to safety requirements, including fingerprint-based checks, for adoptive home providers as specified in federal law 42 USC 671(a)(20). MDHHS policy requires all prospective adoptive families undergo background checks, clearances, criminal history checks, and fingerprinting. The policy states fingerprint background checks must be current within 12 months of adoption approval, placement, and finalization. Federal regulation 45 CFR 1356.60(a) allows states to claim federal financial participation for allowable expenditures in the approved Title IV-E State Plan, including expenditures related to adoption assistance payments. Cause MDHHS informed us its policy needs a clearer distinction between federal eligibility requirements for adoption approval, placement, and finalization and MDHHS safety monitoring practices during adoption finalization. Effect Children could have potentially been placed in the homes of adults who have been convicted of certain crimes or have had child abuse and neglect complaints filed in other states, making them ineligible and unfit to adopt children, resulting in potential improper adoption assistance payments to ineligible adoptive parents. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs • $49,026 - federal share. • $26,248 - State share of costs MDHHS inappropriately used as matching expenditures for adoption assistance funds. Recommendation We recommend MDHHS conduct the required fingerprint background checks on prospective adoptive parents within the 12 months prior to the adoptive placement and adoption finalization. Management Views MDHHS disagrees that completion of fingerprint-based background checks within 12 months of adoption finalization are a condition of eligibility for adoption assistance payments. Federal law 42 USC 671(a)(20) requires states to complete a fingerprint-based criminal background check before a prospective adoptive parent may be finally approved for placement; however, federal statute does not mandate additional or subsequent fingerprint-based criminal history rechecks after placement approval as a condition of eligibility for adoption assistance payments. Michigan's Title IV-E State Plan incorporates the safety requirements mandated by federal law 42 USC 671(a)(20) and cites MDHHS policy ADM 0520 (Background Checks, Clearances, Criminal History Checks, and Fingerprinting). ADM 0520 governs all background checks, clearances, criminal history checks, and fingerprinting requirements that MDHHS must complete for foster care and adoptive home providers. The policy establishes the department's comprehensive safety check framework and is not limited to adoption assistance eligibility determinations. Rather, ADM 0520 outlines the procedures MDHHS uses to meet federal and State safety requirements for approving and supervising foster and adoptive placements, including checks conducted both before placement approval and those completed afterward to ensure the ongoing safety and well being of children under MDHHS supervision. For all cases sampled, fingerprint based clearances were completed within 12 months of the family's approval for placement, and documentation of these clearances is included in the adoption assistance file. Therefore, MDHHS is compliant with all applicable federal and State requirements for adoption assistance payments. Auditor's Comments to Management Views As a condition for receiving federal funds, federal law 42 USC 602 requires MDHHS to submit a Title IV-E Foster Care and Adoption Assistance State Plan. It also requires MDHHS to agree to administer the programs in accordance with the provisions of the State Plan, Title IV-E of the Social Security Act, and all applicable federal regulations and other official issuances of HHS. MDHHS acknowledges it cited MDHHS's Adoption Services Manual (ADM) 0520 in its State Plan to comply with the safety requirements of federal law 42 USC 671(a)(20). ADM 0520 requires "All prospective adoptive parents must have fingerprints for the purposes of adoption current within 12 months at the time of adoption approval by the adoption agency, adoptive placement and prior to adoption finalization." For the five sampled items, MDHHS conducted fingerprinting of the prospective parents at time of adoption approval; however, it did not conduct fingerprinting on the prospective parents within 12 months prior to adoptive placement and/or adoption finalization in accordance with its policy and the State Plan. In addition, MDHHS does not disagree with any facts in the finding and indicates it plans to implement corrective action. Therefore, the finding stands as written.

FINDING 2025-007 MiSACWIS Security Management and Access Controls See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS had not established effective security management and access controls over MiSACWIS. We noted: a. MDHHS did not maintain documentation for 1 (3%) of 40 sampled MiSACWIS incompatible role exception requests. b. Of the total 40 sampled MiSACWIS non-privileged user account recertifications, 1 no longer needed access to the system. For this user, MDHHS did not properly remove their access at the time of their annual recertification. Criteria Federal regulation 45 CFR 75.303 requires the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Federal law 42 USC 1397a(a)(2)(A) indicates states are entitled to payment for services that meet the goals of SSBG. Federal regulation 45 CFR 96.30 requires MDHHS have sufficient fiscal controls and accounting procedures to permit the tracing of SSBG funds to document MDHHS did not use SSBG funds in violation of the restrictions and prohibitions of SSBG laws and regulations. MDHHS utilizes an information system for processing SSBG payments. The State of Michigan establishes Statewide technical standards for all State information systems. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires agencies to implement and document baseline controls, such as the principle of least privilege. The Standard also requires separation of duties must be supported through defined system access authorizations and accounts should be removed in accordance with agency policy and procedures. MDHHS policy requires access to be removed within 48 hours of notification from the manager. In addition, the GAO's FISCAM recommends compensating controls, such as additional monitoring and supervision, should be in place where segregation of duties' conflicts exist. Cause For part a., MDHHS informed us local office security coordinators and security administrators did not follow established policies and procedures regarding granting of MiSACWIS access. For part b., MDHHS informed us the user's role was not removed because of staff oversight. Effect Without effective security management and access controls, individuals may maintain unauthorized or inappropriate access to MiSACWIS. As a result, an increased risk exists MDHHS cannot ensure the security of the MiSACWIS application and data used to help determine eligibility and benefits for TANF, Foster Care Title IV-E, Adoption Assistance, and SSBG. Known Questioned Costs None. Recommendation We recommend MDHHS establish effective security management and access controls over MiSACWIS. Management Views MDHHS agrees with the finding.

FINDING 2025-055 Social Services Block Grant, ALN 93.667, Reporting - Post-Expenditure Report See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not submit an accurate post-expenditure report to the ACF. Our review of the fiscal year 2025 Social Services Block Grant Post-Expenditure Report noted MDHHS inappropriately excluded 77,771 children who received protective services funded by the SSBG program, resulting in a 40% understatement of total recipients on the report. Criteria Federal law 42 USC 1397e requires each state to prepare and submit an annual post-expenditure report to include the number of individuals who received services paid for in whole or in part with funds and the amount spent on providing each type of service. The SSBG Post-Expenditure Report instructions indicate the total number of recipients includes all recipients of services supported by the total expenditures. Cause MDHHS's internal control was not sufficient to detect that all required data was not included in the annual post-expenditure report. Effect MDHHS may have diminished the federal grantor agency's ability to ensure appropriate oversight and monitoring of SSBG funds. We consider this to be a material weakness and material noncompliance because of the high error rate. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS submit accurate post-expenditure reports and include all individuals receiving SSBG supported services. Management Views MDHHS agrees with the finding.

FINDING 2025-002 DTMB, IT General Controls See Schedule of Findings and Questioned Costs for chart/table. Background The Michigan Department of Health and Human Services (MDHHS) and the Department of Technology, Management, and Budget (DTMB) are jointly responsible for maintenance and operation of Bridges Integrated Automated Eligibility Determination System* (Bridges), Michigan Statewide Automated Child Welfare Information System (MiSACWIS), Community Health Automated Medicaid Processing System (CHAMPS), Medicaid Audit Recovery and Investigation System (MARIS), and Michigan Adult Integrated Management System (MiAIMS). The Michigan Department of Transportation (MDOT) and DTMB are jointly responsible for maintenance and operation of AASHTOWare and Public Transportation Management System (PTMS). DTMB provides support for these applications' operating system. Condition DTMB did not fully implement effective general controls* over Bridges, MiSACWIS, CHAMPS, MARIS, MiAIMS, AASHTOWare, and PTMS operating system servers. Our review of fiscal year 2025 activity disclosed DTMB did not review privileged accounts* for the operating system servers. After bringing this matter to management's attention, DTMB corrected the issue noted. Criteria Federal regulations 2 CFR 200.303 and 45 CFR 75.303 require the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Federal regulation 45 CFR 98.68 requires MiLEAP to describe in its CCDF State Plan the internal control in place to help ensure program integrity. MiLEAP's CCDF State Plan for Federal Fiscal Years 2025-2027 describes specific procedures for program integrity and accountability, including program violations and administrative errors. Also, the CCDF State Plan provides specific requirements for child care assistance, including the utilization of an information system for determining eligibility and benefit amounts. Title 42, section 1397a(a)(2)(A) of the United States Code (USC) indicates states are entitled to payment for services that meet the goals of the Social Services Block Grant (SSBG). Federal regulation 45 CFR 96.30 requires MDHHS to have fiscal controls and accounting procedures sufficient to permit the tracing of SSBG funds to document MDHHS did not use SSBG funds in violation of the restrictions and prohibitions of SSBG laws and regulations. MDHHS utilizes an information system for processing SSBG payments. Federal law 42 USC 8624 requires the State to expend funds in accordance with the Low-Income Home Energy Assistance Program (LIHEAP) State Plan and allows MDHHS to use LIHEAP funds to intervene in energy-related crisis situations and assist eligible households to meet the costs of home energy. MDHHS utilizes an information system for determining eligibility. The State of Michigan establishes Statewide technical standards for all State information systems. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01, effective through May 26, 2025, requires accounts be reviewed for compliance with account management requirements semiannually for privileged accounts. DTMB revised its policy, effective May 27, 2025, to indicate access agreements be reviewed annually, including verification access is required for system accounts. Cause DTMB informed us competing priorities contributed to its inability to recertify the users' roles. Effect Without timely review and recertification, individuals may maintain unauthorized or inappropriate access or make inappropriate changes to the Bridges, MiSACWIS, CHAMPS, MARIS, MiAIMS, AASHTOWare, and PTMS operating system servers. Known Questioned Costs None. Recommendation We recommend DTMB fully implement effective general controls over Bridges, MiSACWIS, CHAMPS, MARIS, MiAIMS, AASHTOWare, and PTMS operating system servers. Management Views DTMB agrees with the finding.

FINDING 2025-003 Bridges Interface Controls See Schedule of Findings and Questioned Costs for chart/table. Background MDHHS uses Bridges for determining eligibility and benefit amounts for food assistance, cash assistance, child care assistance, medical assistance, and emergency assistance programs. MDHHS and DTMB are jointly responsible for maintenance and operation of Bridges. Condition DTMB did not always ensure its interface controls over the Bridges data exchanges were operating as prescribed. We noted DTMB did not ensure the file control and batch summary tables used to reconcile Bridges interfaces consistently represented control totals of information processed for 3 of the 9 interfaces sampled. For these 3 interfaces, we sampled 30 daily, monthly, and quarterly files and noted 5 (17%) files did not reconcile. Criteria Federal regulations 2 CFR 200.303 and 45 CFR 75.303 require the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Federal regulation 45 CFR 98.68 requires MiLEAP to describe in its CCDF State Plan the internal control in place to help ensure program integrity. MiLEAP's CCDF State Plan for Federal Fiscal Years 2025-2027 describes specific procedures for program integrity and accountability, including program violations and administrative errors. Also, the CCDF State Plan provides specific requirements for child care assistance, including the utilization of an information system for determining eligibility and benefit amounts. Federal law 42 USC 8624 requires the State to expend funds in accordance with the LIHEAP State Plan and allows MDHHS to use LIHEAP funds to intervene in energy-related crisis situations and assist eligible households to meet the costs of home energy. MDHHS utilizes an information system for determining eligibility. The State of Michigan establishes Statewide technical standards for all State information systems. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. In addition, the U.S. Government Accountability Office's (GAO's) Federal Information System Controls Audit Manual* (FISCAM) recommends interface controls be established and implemented to reasonably ensure data transferred from a source system to a receiving system is processed accurately, completely, and timely. Also, effective interface reconciliation procedures should include the use of control totals, records, counts, and other logging techniques. Cause DTMB informed us because of a reconciliation procedure issue and clean-up efforts, some record counts either were not documented or exception tables were removed. Effect DTMB's weakness in maintaining sufficient internal control over federal program compliance could result in noncompliance not being detected or corrected in a timely manner. Known Questioned Costs None. Recommendation We recommend DTMB ensure its interface controls over Bridges data exchanges are operating as prescribed. Management Views DTMB agrees with the finding.

FINDING 2025-004 Bridges Security Management and Access Controls* See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS had not established effective security management and access controls over Bridges users. We noted: a. MDHHS did not maintain documentation for 1 (2%) of 51 sampled Bridges incompatible role exception requests. Of the 50 forms received, we noted MDHHS did not properly approve 8 (16%) forms prior to granting the exception requests. b. MDHHS did not maintain documentation for 7 (9%) of 80 sampled local office security monitoring reports. Also, MDHHS did not complete timely reviews for 7 (10%) of 73 sampled security monitoring reports. c. MDHHS did not properly approve 3 (8%) of 40 sampled Bridges application security agreements prior to granting access to Bridges. d. MDHHS did not document or properly review its annual recertification of 3 (9%) of 35 sampled Bridges non-privileged user accounts. e. MDHHS did not maintain documentation for 3 (15%) of 20 sampled local office high-risk Bridges transaction monitoring reports. Of the 17 reports received, MDHHS did not document its review date for 2 (12%) of the reports. Criteria Federal regulations 2 CFR 200.303 and 45 CFR 75.303 require the auditee to establish and maintain effective internal control over federal awards that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Federal regulation 45 CFR 98.68 requires MiLEAP to describe in its CCDF State Plan the internal control in place to help ensure program integrity. MiLEAP's CCDF State Plan for Federal Fiscal Years 2025-2027 describes specific procedures for program integrity and accountability, including program violations and administrative errors. Also, the CCDF State Plan provides specific requirements for child care assistance, including the utilization of an information system for determining eligibility and benefit amounts. Federal law 42 USC 8624 requires the State to expend funds in accordance with the LIHEAP State Plan and allows MDHHS to use LIHEAP funds to intervene in energy-related crisis situations and assist eligible households to meet the costs of home energy. MDHHS utilizes an information system for determining eligibility. The State of Michigan establishes Statewide technical standards for all State information systems. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from unauthorized access, use, disclosure, modification, destruction, or denial and to ensure confidentiality, integrity, and availability of State of Michigan information. SOM Technical Standard 1340.00.020.01 requires agencies to implement and document baseline controls, such as access authorizations and the principle of least privilege. The Standard also requires separation of duties must be supported through defined system access authorizations and accounts should be reviewed annually to validate their continued need. In addition, the GAO's FISCAM recommends compensating controls, such as additional monitoring and supervision, should be in place where segregation of duties'* conflicts exist. Cause For parts a., c., and d., MDHHS's internal control and monitoring activities were not sufficient to ensure all appropriate parties adhered to established policies and procedures. For parts b. and e., MDHHS's internal control and monitoring activities need improvement to ensure all appropriate parties maintain and timely complete their review of the local office security monitoring reports and high-risk Bridges transaction monitoring reports. Effect We consider these issues to be a material weakness because, without effective security management and access controls, individuals may obtain or maintain unauthorized or inappropriate access to Bridges. As a result, an increased risk exists MDHHS cannot ensure the security of the Bridges application and data used to help determine eligibility and benefit levels for the SNAP Cluster, Summer Electronic Benefit Transfer Program for Children, CCDF Cluster, Medicaid Cluster, Temporary Assistance for Needy Families (TANF), Refugee and Entrant Assistance State/Replacement Designee Administered Programs (REAP), LIHEAP, and Children's Health Insurance Program (CHIP). Known Questioned Costs None. Recommendation We recommend MDHHS establish effective security management and access controls over Bridges users. Management Views MDHHS agrees with the finding.

FINDING 2025-005 Income Eligibility and Verification System See Schedule of Findings and Questioned Costs for chart/table. Background MDHHS's automated data processing (ADP) system for the SNAP Cluster, Medicaid Cluster, TANF, and CHIP is Bridges. Bridges obtains and utilizes information from the Income Eligibility and Verification System (IEVS) to verify the eligibility and benefit levels of applicants and participating households for these federal programs. To obtain IEVS information, Bridges conducts 15 data exchanges through interfaces with various governmental agencies. Bridges disseminates the IEVS information obtained from the majority of these interfaces through electronic notifications in Bridges to the recipients' MDHHS county/district office specialists to manually consider and take action to determine the recipients' eligibility and benefit levels of the SNAP Cluster, Medicaid Cluster, TANF, and CHIP. Some interfaces automatically update Bridges with the IEVS information and determine the recipients' eligibility and benefit levels. Condition MDHHS did not request and obtain IEVS information for all recipients. In addition, MDHHS did not ensure county/district office specialists considered and used IEVS information when making eligibility and benefit level determinations for these programs. We noted: a. For 3 (21%) of 14 IEVS interfaces requiring manual consideration and action by the county/district office specialist, MDHHS did not maintain sufficient documentation to support that county/district office specialists considered and utilized the IEVS information to determine eligibility and benefit level for each recipient in 6 (11%) of 56 cases. b. For 3 (21%) of 14 IEVS interfaces, MDHHS did not take timely action on IEVS information in 7 (13%) of 56 cases reviewed, of which 6 are also reported in part a. c. MDHHS had not fully established a process to review and monitor the electronic notifications provided to county/district office specialists to ensure they utilized the IEVS information to determine the recipients' eligibility. For 1 (9%) of 11 IEVS interfaces with electronic notifications, county/district office specialists could manually mark electronic notifications as complete without utilizing the IEVS information to determine the recipients' eligibility. d. MDHHS did not include all recipients funded by the TANF adoption subsidies in the IEVS interfaces conducted during the audit period. Also, MDHHS did not establish and implement the other applicable financial and non-financial interfaces during the audit period for TANF adoption subsidies. e. MDHHS did not include modified adjusted gross income (MAGI)-based recipients funded by the Medicaid Cluster Healthy Kids and Healthy Michigan Plan programs and the CHIP Healthy Kids and MiChild programs in the applicable IEVS interfaces conducted during the audit period. Criteria Federal regulation 7 CFR 272.10 requires all state agencies to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information. Also, federal regulation 7 CFR 272.10(b) states that, in order to meet the requirements, a SNAP system must be automated for certification and meet the requirements of IEVS. In addition, federal regulation 7 CFR 273.2(f)(9) requires state agencies to obtain information through IEVS from provider agencies and use it to verify the eligibility and benefit levels of applicants and participating households. Also, federal regulation 7 CFR 273.2(f)(9) requires the state agency to take action to terminate, deny, or reduce benefits based on information obtained through the IEVS processes. Further, federal regulations 7 CFR 272.8(c) and 7 CFR 272.8(e) require the state agency to timely document information obtained through IEVS both when an adverse action is and is not instituted. Federal law 42 USC 1320b-7(a)(4)(A) requires all state agencies to exchange with each other information in their possession which may be of use in establishing or verifying eligibility or benefit amounts. Federal regulations 42 CFR 435.948, 45 CFR 205.55, and 42 CFR 457.380(d) for the Medicaid Cluster, TANF, and CHIP, respectively, require states to request information through IEVS for wages, unemployment compensation, Social Security Administration (SSA) information, and unearned income from the Internal Revenue Service (IRS) at the first opportunity following receipt of an application for assistance. Also, federal regulations 42 CFR 435.948, 42 CFR 435.952, 45 CFR 205.56, and 42 CFR 457.380(d) require states to timely use the IEVS information to determine an individual's eligibility and the amount of assistance available. Further, federal regulations 42 CFR 435.916(a) and 42 CFR 457.343 indicate the state must redetermine MAGI-based eligibility without requiring information from the individual if the information is based on reliable information in the individual's account or other more current information available to the state, including information accessed through any databases, to verify the financial and non-financial information related to eligibility. MDHHS Bridges Administrative Manual Policy 800, Data Exchanges, requires information received from most computer matches to be resolved by the county/district office specialist within 45 calendar days of receiving the electronic notification. Cause For parts a. and b., MDHHS did not always have information available to identify if the IEVS interface information was appropriately utilized in determining recipients' eligibility when county/district office specialists marked electronic notifications as complete. For part c., MDHHS believes it had a sufficient process in place to review and monitor electronic notifications during fiscal year 2025. However, the process did not substantiate the reviews completed. For part d., MDHHS informed us it had not yet established and implemented the applicable IEVS interfaces to validate income, social security number, criminal background, or citizenship. For part e., MDHHS believes post eligibility verification for MAGI-based recipients is not subject to IEVS requirements; therefore, MDHHS did not include all MAGI-based recipients coded to the Medicaid Cluster Healthy Kids and Healthy Michigan Plan programs and CHIP Healthy Kids and MiChild programs in the applicable IEVS data exchanges. Effect We consider this to be a material weakness and material noncompliance because of the high error rates in our testing and the incomplete data matches noted. As a result, MDHHS may have provided the SNAP Cluster, Medicaid Cluster, TANF, and CHIP benefits to ineligible recipients. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs Undeterminable. Because of the unique circumstances of each case, a projection of questioned costs cannot be reasonably estimated. Recommendations We recommend MDHHS request and obtain IEVS information for all recipients. We also recommend MDHHS ensure that county/district office specialists consider and use IEVS information, in a timely manner, when making eligibility and benefit level determinations for these programs. Management Views MDHHS agrees with parts a., b., and d. of the finding. MDHHS disagrees with parts c. and e. of the finding. For part c., MDHHS disagrees with the conclusion that a process is not fully established to monitor the electronic notifications provided to county/district office caseworkers to ensure they utilized the Income Eligibility and verification System (IEVS) information to determine the recipients' eligibility. MDHHS had policies and procedures in place during fiscal year 2025 to help ensure monitoring of electronic notifications occurred. Review of IEVS information is fully incorporated into the case read procedure governed by Bridges Administrative Manual 301 and further detailed in accompanying desk aids and reading guides. The MDHHS Economic Stability Administration (ESA) also provides regular direction and reminders regarding case read requirements through ESA memos. For part e., MDHHS disagrees that IEVS information is required to be requested and obtained for Medicaid Cluster Healthy Kids, Healthy Michigan Plan, CHIP Healthy Kids, and MiChild modified adjusted gross income (MAGI) based recipients since eligibility is verified upon determination through the MAGI eligibility determination process. MAGI verification rules are contained within federal regulation 42 CFR 435.603, which describe electronic verification through the Federal Data Services Hub, reasonable compatibility standards, and verification at application and renewal. The CMS MAGI Application and Eligibility Process Implementation Guides describe MAGI verification as a streamlined, electronic process using the federal hub and state data sources with no reference to IEVS. The IEVS rules are contained within federal regulations 42 CFR 435.940 through 42 CFR 435.965 and are part of the non-MAGI verification framework. Auditor's Comments to Management Views* Regarding part c., although MDHHS provided various guidance to the caseworkers regarding the utilization of IEVS information, the guidance did not result in the maintenance of sufficient documentation to support if caseworkers considered and utilized IEVS information, as noted in part a. Regarding part e., federal regulations 42 CFR 435.916(a), 42 CFR 435.948, and 42 CFR 435.952 require the State to use reliable information or information available to the State, including information accessed through databases, to determine or renew a Medicaid recipient's eligibility. MAGI verification rules contained in 42 CFR 435.603(h)(3) state, in determining current monthly or projected annual household income and family size, the State may adopt a reasonable method to include a prorated portion of reasonably predicted future income or to account for a reasonably predictable increase or decrease in future income. Such future increase or decrease in income or family size must be verified in the same manner as other income and eligibility factors, in accordance with the income and eligibility verification requirements in 42 CFR 435.940 through 42 CFR 435.965 (IEVS rules). Similarly, federal regulations 42 CFR 457.343 and 42 CFR 457.380(d) require the use of such databases to determine or renew CHIP recipient eligibility. MDHHS requested IEVS data for Medicaid recipients, including certain MAGI-based recipients, but did not include all MAGI-based recipients in its IEVS data exchanges at application and redetermination. Further, MDHHS did not utilize IEVS data exchanges to identify whether eligibility was erroneously granted to its MAGI-based recipients enrolled in the Medicaid Cluster Healthy Kids, CHIP Healthy Kids, and MiChild programs due to agency error or fraud, abuse, or perjury attributed to the child or the child's representative. Federal regulations 42 CFR 435.926(d)(4) and 42 CFR 457.342 require MDHHS to terminate benefits if any of the above circumstances are identified. Therefore, the finding stands as written.

FINDING 2025-008 CHAMPS Eligibility Interface Errors See Schedule of Findings and Questioned Costs for chart/table. Background MDHHS uses Bridges for determining eligibility and benefits amounts for medical assistance, among other assistance programs. Eligibility and benefit records from Bridges are then interfaced into CHAMPS, MDHHS's system used to process medical claims and payments. Condition MDHHS did not maintain documentation to support eligibility records with identified errors were properly investigated, corrected, and resubmitted for processing. Our sample of 16 daily interface runs identified 7 (44%) which had been excluded from eligibility interface processing. Criteria Federal regulation 45 CFR 75.303 requires the auditee to establish and maintain effective internal control over federal programs that provides reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. According to State of Michigan Administrative Guide to State Government policy 1340.00, security controls must be implemented to protect State of Michigan information from modification to ensure confidentiality, integrity, and availability of State of Michigan information. In addition, the GAO's FISCAM indicates interface error handling and reconciliation procedures should reasonably ensure all transactions are accounted for and all errors are identified, isolated, analyzed, and corrected in a timely manner. Cause MDHHS informed us its central office did not document or conduct any further review on these errors since local offices already review potential duplicated identification numbers through Bridges reports and specialist discoveries. Effect MDHHS could not ensure eligibility and benefit level information from Bridges was accurately reflected in CHAMPS for the Medicaid Cluster, REAP, and CHIP and, as a result, could not ensure medical payments were made based on up-to-date and accurate eligibility information. MDHHS's weakness in maintaining sufficient internal control over federal program compliance could result in noncompliance not being detected or corrected in a timely manner. Known Questioned Costs None. Recommendation We recommend MDHHS maintain documentation to support eligibility records with identified errors and excluded from eligibility interface processing are investigated, corrected, and resubmitted for processing as appropriate. Management Views MDHHS agrees with the finding.

FINDING 2025-011 MDHHS, Reporting - FFATA Reporting See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not ensure it reported or accurately and timely reported all subaward information as required by the Federal Funding Accountability and Transparency Act (FFATA) of 2006. Our results are summarized by Assistance Listing Number (ALN) in the following tables: See Schedule of Findings and Questioned Costs for chart/table. We noted: a. MDHHS did not report any subaward information for 3 (5%) of 61 sampled subawards. b. Of the 58 subawards in the FFATA Subaward Reporting System (FSRS), MDHHS did not: (1) Submit timely subaward information for 23 (40%) sampled subawards. (2) Submit the correct amount for 37 (64%) sampled subawards. (3) Report all key data elements for 1 (2%) sampled subaward. Criteria Federal regulation 2 CFR 170 implemented the FFATA requirements for reporting subaward information and requires MDHHS to report, on the federal website, each action that obligates $30,000 or more in federal funds by the end of the month following the month in which the subaward was made. Cause MDHHS informed us it received fatal validation errors when submitting to the FSRS and the System for Award Management (SAM), which prevented subaward submissions. Other contributing factors include inaccurate Electronic Grants Administration and Management System (EGrAMS) account code and funding source fields, which impacted the query used to obtain certain FFATA data elements. Effect MDHHS grant information was not reported or timely available for public access through the website established to improve transparency of governmental spending. We consider this to be a material weakness and material noncompliance because of the high error rates. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS ensure it reports or accurately and timely reports all subaward information as required by FFATA. Management Views MDHHS agrees with the finding.

FINDING 2025-013 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Beneficiary Eligibility See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not ensure or demonstrate compliance with federal laws and regulations relating to beneficiary eligibility for 11 (18%) of 60 Medicaid and 29 (48%) of 60 CHIP cases. Our review disclosed: a. MDHHS did not determine beneficiary eligibility in accordance with eligibility requirements for 5 (8%) of 60 Medicaid and 13 (22%) of 60 CHIP cases reviewed. b. MDHHS did not maintain case file documentation supporting the beneficiary eligibility determination; examples of documentation include MAGI-based income verification results, other income support, and signed applications for 5 (8%) of 60 Medicaid and 16 (27%) of 60 CHIP cases reviewed. c. MDHHS did not ensure Bridges contained the appropriate coverage termination date for 1 (2%) of 60 Medicaid cases reviewed. Criteria Federal regulations 42 CFR 435.1002(b) and 42 CFR 457.622(d) indicate federal funding is available only for services provided to eligible beneficiaries. Federal regulations 42 CFR 435.914 and 42 CFR 457.965 require case record documentation be maintained to support the eligibility decision. Federal regulations 42 CFR 435.10, 42 CFR 457.50, and 42 CFR 457.70 require MDHHS to specify in its State Plan the groups to whom Medicaid and CHIP are provided and the conditions of eligibility for individuals in those groups. MDHHS Bridges Administrative Manual 300, The Case Record, indicates a case record includes documents and information related to a given case arranged in a series of packets and contained in a folder identified by a case name, grantee ID, or case number. A case record consists of both paper case records and electronic case files (ECF). The paper case record and ECF contain all forms, documents, and other evidence relevant to the group's current and past eligibility. Unless captured in Bridges, the case record must document the facts essential to the eligibility determination and actions taken by the local office regarding the case. Cause MDHHS's internal control and monitoring activities were not sufficient to ensure MDHHS maintained or appropriately considered the required documentation in beneficiaries' case records to support eligibility determinations. Also, MDHHS informed us, due to a system issue, Bridges did not reflect the correct Medicaid coverage termination date for the case reviewed. Effect We consider this to be a material weakness and material noncompliance because MDHHS may have made payments on behalf of ineligible beneficiaries and because of the 18% Medicaid and 48% CHIP error rates. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs Federal regulation 2 CFR 200.516(a)(3) requires the auditor to report known questioned costs less than $25,000 if it is likely total questioned costs would exceed $25,000. • $5,682 - federal share. • $2,117 - State share of costs MDHHS inappropriately used as matching. Recommendations We recommend MDHHS properly consider Medicaid and CHIP eligibility documentation in accordance with eligibility requirements. We also recommend MDHHS maintain documentation to support beneficiary eligibility was determined in accordance with eligibility requirements. We further recommend MDHHS ensure Bridges contains the appropriate termination date for beneficiaries receiving Medicaid coverage. Management Views MDHHS agrees with the identified exceptions for parts a. and c. However, MDHHS disagrees that 2 Medicaid cases and 11 CHIP cases with MAGI determinations cited in part b. lacked documentation supporting the eligibility determination. The Centers for Medicare and Medicaid Services (CMS) has determined that a reasonable compatibility indicator can be used for CMS audit purposes to determine if the attested income information was electronically verified for modified adjusted gross income (MAGI) cases. For this reason, MDHHS disagrees that documentation was not maintained. The State of Michigan MiIntegrate system communicates with various electronic state and federal trusted data sources and sends information from these sources, along with the beneficiaries' attested income, to the State of Michigan MAGI Rules Engine where the MAGI eligibility determination is made. As part of the MAGI eligibility determination, a reasonable compatibility test is completed to determine if beneficiary/applicant attested income is within a specified percentage of the trusted data sources or if the attested and verified income are below the threshold for the applicable program. The results of the MAGI eligibility determination are sent back to MiIntegrate using an Account Transfer (AT) packet that contains the results. MiIntegrate then communicates the results to the State of Michigan MAGI Viewer and Bridges using an AT packet and Bridges stores the AT packet number only that can be used to view the details of the AT packet within the State of Michigan MAGI Viewer. The version of the AT packet within the MAGI Viewer also contains a reasonable compatibility indicator that documents the outcome of the reasonable compatibility test and supports the SOM MAGI Rules Engine eligibility decision. MDHHS stores the AT packet information, including facts essential to the eligibility determination, within MiIntegrate and the MAGI viewer instead of Bridges to help protect and secure the federal income tax data and unemployment data used for the determination. The AT packet for each individual determination can be retrieved from the MAGI Viewer using the AT packet number stored in each beneficiary's case file within Bridges. MDHHS is not aware of any federal regulations that preclude MDHHS from storing this information in a separate, secure system to ensure appropriate data protection and access controls required by federal and State laws. Auditor's Comments to Management Views Regarding the MAGI beneficiary eligibility documentation cited in part b., the CMS's Payment Error Rate Measurement (PERM) Manual indicates if states use electronic verification to verify eligibility elements, an indicator should be in the eligibility system, i.e., Bridges, showing the State verified the element, including the result of the verification. Also, federal regulations 42 CFR 435.914 and 42 CFR 457.965 require MDHHS to maintain facts in the case file to support the eligibility determination. The AT packet number does not include the reasonable compatibility indicator. Therefore, it does not provide sufficient detail within the case file, defined by MDHHS as records captured in Bridges, to demonstrate MDHHS verified the income or the caseworker confirmed the result of the verification. Therefore, the finding stands as written.

FINDING 2025-014 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Expenditure Processing for Medical Payments See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not ensure Bridges and CHAMPS contained the correct Medicaid Cluster and CHIP eligibility information to record expenditures to the appropriate program at the time of payment. On a quarterly basis, MDHHS transferred expenditure amounts from the Medicaid Cluster to CHIP by completing a summary-level adjustment determined by analyzing CHAMPS payment data and Bridges eligibility data. As a result, MDHHS identified it incorrectly recorded $19.3 million of CHIP medical payments to the Medicaid Cluster throughout fiscal year 2025. However, we noted 4 of 5 sampled beneficiaries transferred to CHIP were not eligible for CHIP. They were in fact Medicaid eligible and, therefore, should not have been transferred. Criteria Federal regulation 45 CFR 75.303 requires the auditee to establish and maintain effective internal control over federal programs to provide reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Cause MDHHS implemented a system change to correct eligibility classifications in Bridges for new cases but needed to complete a quarterly Medicaid to CHIP transfer during the audit period for existing cases. However, during the manual reclassification process, some cases were transferred from the Medicaid Cluster to CHIP in error. Effect MDHHS inappropriately transferred $1,185 Medicaid Cluster expenditures to CHIP. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Also, of the $19.3 million in quarterly transfers, MDHHS may have improperly received either federal Medicaid Cluster funds or federal CHIP funds depending on the accuracy of the transferred amount. After MDHHS recorded the quarterly summary-level adjustments in the accounting system, it returned the Medicaid Cluster funds to the federal government and appropriately received reimbursement from CHIP. Known Questioned Costs Federal regulation 2 CFR 200.516(a)(3) requires the auditor to report known questioned costs less than $25,000 if it is likely total questioned costs would exceed $25,000. • $896 - federal share of CHIP payments made to providers for ineligible CHIP beneficiaries, of which $896 is questioned in Finding 2025-013. • $289 - State share of costs MDHHS inappropriately used as matching. Recommendation We recommend MDHHS ensure Bridges and CHAMPS contain the correct Medicaid Cluster and CHIP eligibility information to allow MDHHS to record expenditures to the appropriate program at the time of payment. Management Views MDHHS agrees with the finding.

FINDING 2025-015 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Provider Eligibility See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not obtain all required disclosures and/or ensure disclosures were timely and accurately updated and approved in CHAMPS for the Prepaid Inpatient Health Plan (PIHP) entities, MI Choice Waiver Program (MI Choice) entities, Medicaid Health Plan (MHP) entities, Dental Health Plan entities, or the Pharmacy Benefits Manager (PBM) during the audit period. In addition, MDHHS did not monitor its MI Choice entities' network of providers to ensure the providers entered into provider agreements and made required disclosures. Criteria Federal regulations 42 CFR 455.104 through 42 CFR 455.106 and 42 CFR 457.935 require MDHHS to obtain certain identifying information from medical providers, including PIHP entities, MI Choice entities, MHP entities, Dental Health Plan entities, and its PBM. Disclosures are due when a fiscal agent or managed care entity submits a proposal, upon execution of a contract with the State, upon renewal or extension of the contract, or within 35 days after any change in ownership. These regulations also require MDHHS to obtain information such as identification information of the owners, agents, and managing employees and information on the ownership and control interest in the provider's subcontractors. According to its Medicaid and CHIP State Plans, MDHHS has established procedures for the disclosure of information by providers and fiscal agents as specified in federal regulations 42 CFR 455.104 through 42 CFR 455.106 and 42 CFR 457.935. Cause MDHHS indicated it relied on managed care organizations and other contracted entities to provide timely and complete ownership and disclosure information, including updates occurring during the contract period. MDHHS may not always receive notification from the entities when ownership or control changes occur, which can delay required updates to CHAMPS. In addition, limited staff resources affected the timeliness of completing all monitoring activities for MI Choice entities' provider networks, including verifying provider agreements were in place and required disclosures submitted. Effect MDHHS could potentially reimburse ineligible medical providers for medical services. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendations We recommend MDHHS obtain, timely and accurately update, and approve CHAMPS for all required disclosures from PIHP entities, MI Choice entities, MHP entities, Dental Health Plan entities, and its PBM. We also recommend MDHHS monitor its MI Choice entities' network of providers to ensure all providers enter into provider agreements and make all required disclosures. Management Views MDHHS agrees with the finding.

FINDING 2025-016 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Refunding of Federal Share of Overpayments See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not accurately and timely report the federal share of fraud, waste, and abuse overpayments made to providers on the quarterly statement of expenditures reports (CMS-64 and CMS-21 reports). We noted: a. MDHHS did not have adequate processes in place to ensure receivables recorded in its Adult Services Authorized Payments (ASAP) system were accurately reflected on the reports used for preparation of the CMS-64 report, which resulted in untimely reporting of $716,757 of the federal share of overpayments. b. MDHHS did not ensure receivables entered into CHAMPS and ASAP, as a result of an overpayment due to fraud, waste, and abuse, were calculated using the correct federal medical assistance percentage (FMAP) rate for 3 (12%) of 25 Medicaid overpayments and 2 (40%) of 5 CHIP overpayments. Criteria Federal regulations 42 CFR 433.320 and 42 CFR 457.628 require MDHHS to refund the federal share of overpayments subject to recovery to CMS through a credit on its CMS-64 and CMS-21 reports. MDHHS must credit CMS with the federal share of overpayments subject to recovery on the earlier of the quarter in which the State recovers the overpayment from the provider or the quarter in which the one year period following discovery ends, if no recovery is received. Cause MDHHS informed us system issues and lack of sufficient communication within MDHHS contributed to the untimely reporting of overpayments and application of the incorrect FMAP rate. Effect MDHHS did not ensure accurate and timely reporting in accordance with federal regulations for the federal share of fraud, waste, and abuse overpayments made to providers. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs Undeterminable. Because of the unique circumstances of each overpayment, a projection of questioned costs cannot be reasonably estimated. Recommendation We recommend MDHHS accurately and timely report the federal share of fraud, waste, and abuse overpayments made to providers on the CMS-64 and CMS-21 reports. Management Views MDHHS agrees with the finding.

FINDING 2025-017 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Provider Screening See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS had not fully implemented effective CHAMPS provider screening controls over managed care organization (MCO) providers furnishing Medicaid and CHIP services. Our query of 72,649 MCO providers with accepted encounter claims disclosed 1,815 (2%) providers were inactive in CHAMPS at the time of service. MCO rendering providers are only screened for adverse action, disbarment, or criminal convictions when the MCO billing provider has a Michigan address. Criteria Federal regulations 42 CFR 455.410, 42 CFR 455.436, and 42 CFR 457.990 require MDHHS to screen all ordering or referring physicians or other professionals rendering medical services and verify the provider information in federal databases. Provider screening, such as the List of Excluded Individuals/Entities and the Excluded Parties List System, is required to identify potentially ineligible medical providers. Cause MDHHS informed us because of an oversight, MCO rendering providers were not screened when the MCO billing provider had an out-of-state address. Effect MDHHS could not ensure only eligible MCO providers rendered medical services to Medicaid and CHIP beneficiaries. Also, failure to reject inaccurate MCO encounter data could affect the development of capitation rates. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS fully implement effective CHAMPS provider screening controls. Management Views MDHHS agrees with the finding.

FINDING 2025-018 Medicaid Cluster, ALN 93.775, 93.777, and 93.778 and Children's Health Insurance Program, ALN 93.767 - Medical Loss Ratio See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not ensure 2 of 8 sampled managed care entities' medical loss ratio (MLR) reports contained a comparison of the amounts used in the MLR calculation with the audited financial reports. The MLR is the proportion of premium revenues spent on behalf of beneficiary services and quality improvement. The Affordable Care Act requires each managed care entity to spend at least 85% of premium dollars on medical care. Criteria Federal regulations 42 CFR 438.8 and 42 CFR 457.1203 require managed care entities to calculate and report an MLR to MDHHS, including a comparison of the amounts reported in the MLR calculation with audited financial reports. Cause MDHHS's internal control and monitoring activities were not sufficient to ensure all submitted MLR reports are completed in accordance with federal regulations. Effect MDHHS limits its assurance the calculated MLR is accurate and could fail to collect remittance owed to the State if entities are overstating the MLR inappropriately. The federal grantor agency could issue sanctions or disallowances related to noncompliance. Known Questioned Costs None. Recommendation We recommend MDHHS ensure MLR reports contain a comparison of the amounts reported in the MLR calculation with audited financial reports. Management Views MDHHS agrees with the finding.

FINDING 2025-019 MARIS Change Management Process See Schedule of Findings and Questioned Costs for chart/table. Condition MDHHS did not fully implement an effective change management process over MARIS. MDHHS staff use MARIS to track and investigate complaints alleging Medicaid and CHIP fraud, waste, or abuse. Our review disclosed MDHHS did not document post-implementation approvals for 1 of 3 sampled MARIS change records. Criteria Federal regulation 45 CFR 75.303 requires the auditee to establish and maintain effective internal control over federal awards to provide reasonable assurance the auditee is managing federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. State of Michigan Administrative Guide to State Government policy 1340.00 establishes the configuration management standard and procedures to address the controls implemented within systems and organizations. SOM Technical Standard 1340.00.060.04 requires the business owner to perform post-implementation validation. SOM Technical Procedure 1340.00.060.04.01 requires each test type to have its own set of documentation. Cause MDHHS informed us it did not document the post implementation validation because of the lack of a notification e-mail. Effect Without an effective change management process, individuals may make unauthorized or inappropriate changes to MARIS. As a result, an increased risk exists where MDHHS cannot ensure MARIS is configured and operating securely and as intended. Known Questioned Costs None. Recommendation We recommend MDHHS fully implement an effective change management process over MARIS. Management Views MDHHS agrees with the finding.

FINDING 2025-061 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), ALN 93.323 and Block Grants for Prevention and Treatment of Substance Abuse, ALN 93.959 2025-061 U.S. Department of Health and Human Services Epidemiology and Laboratory Capacity for Infectious Diseases, 93.323 Block Grants for Prevention and Treatment of Substance Abuse, 93.959 Reporting Material Weakness in Internal Control over Compliance and Material Noncompliance Grant Award Number/Year: Affects grant award #NU51CK000362 (8/1/24 - 7/31/29) under assistance listing 93.323 and grant awards #B08TI083947 (9/1/21 - 9/30/25), #B08TI087045 (10/1/23 - 9/30/25), and #B08TI088112 (10/1/24 - 9/30/26) under assistance listing 93.959. Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.303 provides that recipients must establish and maintain effective internal control that provides reasonable assurance that the recipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award (applicable for the Epidemiology program). The Federal Funding Accountability and Transparency Act (FFATA) requires direct recipients of certain federal awards to report subaward information by the end of the month following the month in which the prime awardee obligates a subgrant award equal to or greater than $30,000 (applicable for the Epidemiology and Substance Abuse programs). Condition: In some instances, subaward information was not reported, not reported accurately, or not reported timely. In addition, evidence of the performance of control activities, such as review procedures or segregation of duties, was not documented to support that the control activity occurred. Cause: The Michigan Department of Health and Human Services (MDHHS) informed us they received validation errors when attempting to submit the subaward information required. Re-submissions were not always attempted and new submissions were not always reconciled to successful or unsuccessful past attempts. MDHHS did not have adequate internal controls to ensure subaward information was submitted in accordance with the FFATA. In addition, MDHHS did not ensure internal controls were documented and maintained. Effect: Subaward obligations were not reported in the FSRS accurately, and, therefore, inaccurate information is included on the FFATA's website for public information disclosure. In some instances, the subaward obligations were not reported in the FSRS timely, and, therefore, were not available for public information disclosure in a timely manner. Questioned Costs: None Context/Sampling: Epidemiology and Laboratory Capacity for Infectious Diseases A nonstatistical sample of 21 out of a population of 138 applicable subaward obligations was selected for testing. The summary of errors was noted as follows: See Schedule of Findings and Questioned Costs for chart/table. Total subawards of $19,180,449 were reported with inaccurate obligations; however, $11,957,365 of those obligations were reported, thus leaving a net variance of $7,223,084 in underreported obligations. Block Grants for Prevention and Treatment of Substance Abuse A nonstatistical sample of 13 out of a population of 85 applicable subaward obligations was selected for testing. The summary of errors was noted as follows: See Schedule of Findings and Questioned Costs for chart/table. Total subawards of $9,949,532 were reported with inaccurate obligations; however, $3,872,549 of those obligations were reported, thus leaving a net variance of $6,076,983 in underreported obligations. In addition, documentation of control activities performed was not maintained for any of the subaward obligations tested for both programs. Repeat Finding from Prior Year: No Recommendation: We recommend MDHHS enhance internal controls to ensure subaward information is submitted in accordance with the FFATA and that evidence of control activities, such as segregation of duties, is documented and maintained. Views of Responsible Officials: MDHHS agrees with this finding.