Audit 405318

Finding Number: 2025-001 Prior Year Finding Number: 2024-002 Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/ Department of Health Care Finance (DHCF) DC Access System (DCAS) Program Management Administration Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 272.10(a), “All State agencies are required to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP.” Per 7 CFR Section 272.10(b), “In order to meet the requirements of the Act and ensure the efficient and effective administration of the program, a SNAP system, at a minimum, shall be automated in each of the following program areas (1) Certification and (2) Issuance Reconciliation and Reporting. Under Certification – States agencies must determine eligibility and calculate benefits or validate the eligibility worker’s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members’ names, addresses, dates of birth, social security numbers, individual household members’ earned and unearned income by source, deductions, resources and household size). Also, State agencies must redetermine or revalidate eligibility and benefits based on notices of change in households’ circumstances.” Condition – The District is self-reporting findings it noted from its ongoing efforts to resolve issues with the ADP system for SNAP. The issues identified and the estimated impact follows: 1. Failure to Send Correct and Timely Notices to SNAP Households - Notices pertaining to SNAP eligibility contain incorrect information, and/or SNAP applicants and recipients fail to receive proper notices. For example, in the Federal Fiscal Year (FFY) 2018 Local Program Access Review (PAR), Food and Nutrition Service (FNS) cited that SNAP applicants did not receive a Notice of Eligibility or notice contained incorrect information, no notice of required verification, and the notice of adverse action was incorrect. 2. Untimely Processing of SNAP Applications and Periodic Reports - On October 23, 2017, FNS advised DHS that its application processing timeliness (APT) rate between October 2016 and March 2017 was 88.45%, which triggered corrective action per FNS policy. Moreover, between that last APT report and now, DHS has disclosed that it has experienced processing backlogs of varying severity and persistence to FNS via ongoing communications and as part of waiver requests. DHS also provided a report to FNS in August 2022 that indicated significant application processing backlogs. 3. Establishment of Duplicate Accounts - DHS discovered that duplicate Product Delivery Cases (PDC) were being created in DCAS. One PDC was active and the other closed, but the closed PDC was still receiving benefits. 4. Issuance of Duplicate Payment - As a result of duplicate accounts in Deficiency 3, duplicate payments may have been issued to the same household when a caseworker reactivated a closed case. There is also a possibility that customers who received duplicate electronic benefits transfer (EBT) cards from different EBT vendors may have received duplicate payments. 5. Failure to Implement Computer Matching System - Based on the FFY18 Program Integrity Management Evaluation (ME) review, DHS failed to process Prisoner Verification System (PVS) matches, deceased matches, and National Directory of New Hires (NDNH) matches in accordance with federal requirements. 6. Failure to Produce System Computations to Support Recipient Claims - DCAS does not have the ability to calculate overpayments or send a demand letter. FNS correspondence letters dated October 18, 2017, and September 20, 2018, advised DHS to suspend the establishment of DCAS claims but allowed DHS to continue servicing ACEDS claims. 7. Treasury Offset Program (TOP) Reporting and Maintenance Decertified - FNS conducted a TOP Technical Review in June 2021 and DHS was decertified from TOP due to the following: • Referral of customers to TOP that are undergoing recoupment. • Incorrect determination of the date of delinquency. • Incorrect debt balance and debt status in TOP. 8. Failure to Initiate Recoupment on Active Households - When DCAS launched in October 2016, more than 3,000 claim cases with outstanding balances originating from SNAP overpayments were converted from ACEDS to DCAS. Some claims were not properly converted or activated in DCAS. As a result, DHS failed to take the required recovery actions, including TOP recovery or activation of the recoupment process through EBT cards. 9. Recipient and Benefit Integrity Report Update Required - DHS must provide an update on the target completion dates for system generation of all SNAP-related reports currently being created through manual intervention. The plan must include the procedures for reviewing and ensuring the accuracy of the data being submitted to Food Programs Reporting System (FPRS) with particular emphasis on the FNS-209 and the FNS-366B reports. DHS experienced some technical challenges in processing and retrieving claim and recoupment information accurately since the launch of DCAS in October 2016, which affected the FNS-209 quarterly reports. The Payment and Collections Division (PCD) and the DCAS report development team have made concerted efforts to improve the ability to generate data for the reports but continue to have difficulties in verifying the accuracy of data due in part to the laborious manual processes involved. Based on the FFY 2018 Program Integrity ME review, lines 3b, 10, and 14 of the FNS-209 failed to reconcile with the detailed documentation. 10. Work Requirements Have Not Been Properly Implemented - DHS is not in compliance with the requirement to accurately report on the FNS 583. DHS is unprepared to implement the work requirement and time limit for able-bodied adults without dependents when the current suspension mandated by the Families First Coronavirus Response Act ends and/or its waiver ends. Additionally, the District is not prepared to apply the Able-Bodied Adults Without Dependents (ABAWD) time limits when their ABAWD waiver expires. 11. Failure to Analyze Client Complaints and Include in the State’s Corrective Action Plans (CAP) Where Appropriate - DHS is failing to analyze client complaints and include in the State’s CAP where appropriate, per 7 CFR 271.6(a)(3) and 275.16. 12. The SNAP Application Does Not Clearly Explain Which Questions Are Required for SNAP - FNS reviewers found that the District’s SNAP application does not provide clear directions about which questions are required for SNAP, versus Cash or Medical Assistance. For example, Step 5 of the application asks “Does anyone in your household (including non-applicants) have any income? Yes – complete below; No – skip to step 6 (Complete if you are applying for Food, Medical, or Cash Assistance).” The directions are confusing and may be difficult to understand. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements resulting from a system implementation. Effect – Without an effectively designed and operated system in place, ineligible beneficiaries may receive benefits under the SNAP grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Inaccurate beneficiary allotment payments could result in participants receiving benefits that they are not entitled to receive under the program. Cause – DHS did not effectively design and operate the ADP system for SNAP which resulted to inaccurate benefit payments. Recommendation – We recommend that DHS continue to evaluate and improve the new ADP system for SNAP to ensure that it addresses all the administration requirements of the SNAP program. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DHS and DHCF DCAS team agree with the findings noted in this report. DHS self-reported these findings as part of the agency’s ongoing effort to maintain integrity with all eligibility determinations. The root cause of each of the twelve (12) case issues with the ADP system for SNAP varied. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-002 Prior Year Finding Number: 2024-003 Compliance Requirement: Special Tests and Provisions – EBT Card Security Program: U.S. Department of Agriculture Supplemental Nutrition Assistance Program Cluster ALN: 10.551, 10.561 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/ Office of the Chief Financial Officer/Office of Finance and Treasury (OCFO/OFT) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 7 CFR Section 274.8(b)(3), As an addition to or component of the Security Program required of Automated Data Processing (ADP) systems, the State agency shall ensure that the following electronic benefits transfer (EBT) security requirements are established: (i) Storage and control measures to control blank unissued EBT cards and PINs, and unused or spare POS devices; (ii) Measures to ensure communication access control. Communication controls shall include the transmission of transaction data and issuance information from POS terminals to work-stations and terminals at the data processing center; (iii) Message validation; (iv) Administrative and operational procedures; (v) A separate EBT security component shall be incorporated into the State agency Security Program for ADP systems. The periodic risk analyses required by the Security Program shall address the following items specific to an EBT system – (B) Completeness and timeliness of the reconciliation system; and (vi) The State agency shall incorporate the contingency plan approved by FNS into the Security Program. Condition – OCFO/OFT for DHS are required to maintain adequate security over, and documentation/records for EBT cards, to prevent their theft, embezzlement, loss damage, destruction, unauthorized transfer, negotiation, or use. OCFO/OFT have contracted with Fidelity National Information Service (FIS) for the issuance and security of the EBT cards; however, it is OCFO/OFT’s ultimate responsibility to ensure the contractor has controls in place to maintain adequate security over, and documentation/records of EBT cards in accordance with 7 CFR Section 274.8(b)(3). During our tests of the design and implementation of internal controls and compliance requirements in accordance with 7 CFR Section 274.8(b)(3), we noted the following issues: • For sixteen (16) out of the sixty (60) samples, out of a population of 496 days from two EBT card centers, although both EBT Balance Sheets reconciled with the EBT Card Issuance Logs included in the package, we noted the following deficiencies: o For eleven (11) out of the samples, we noted various issues including (a) the ID type for identification purposes was missing or incorrect, (b) the customer case number was missing, (c) the Photo ID Program Referral Form was missing, (d) the identification type was noted as referral on the EBT Intake Form, but no referral form was attached, (e) the UPO EBT Center Intake Form was not signed by staff who created the card, and (f) the EBT Card Referral Form for the EBT Summer Program was missing the eligibility staff name and signature verification although e-signed by the supervisor. o For five (5) out of the samples, we noted various issues including (a) illegible information on the UPO EBT Training Center Intake Form, (b) the customer name on the UPO EBT Training Center Intake Form did not agree with the name on the EBT Card Issuance Log and a nominee name was not indicated (we were therefore unable to trace and agree the beneficiary names on the UPO EBT Center Intake Forms in the reconciliation package to the EBT Card Issuance Log for (a) or (b)), (c) summary reconciliation sheet (an EBT Balance Sheet) was prepared and agreed to the EBT Card Issuance Log for the day selected for each workstation but the EBT Card Issuance Log was only initialed by the CPS and none initialed by the Witness, and (d) the EBT Card Issuance Log had incorrect page numbers and at least one customer documented on different page and line numbers when we compared the EBT Card Issuance Log to the UPO EBT Training Center Intake Form. • In addition, for one (1) out of the sixty (60) samples, we noted that the information on the summary reconciliation sheet did not agree to the Card Issuance Log. The summary reconciliation sheet shows 121 cards issued while the Card Issuance Log shows a total of 111 cards issued. These exceptions resulted in the Agency not being in compliance with 7 CFR Section 274.8(b)(3). Questioned Costs – None. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without adequate internal controls to ensure compliance with EBT Card Security requirements, there is an increased risk that the inventory of EBT cards will not be properly maintained and accounted for, or that the program will not be in compliance with program requirements. Cause – OCFO/OFT for DHS does not have adequate policies and procedures in place to ensure adequate safeguarding, documentation over issuance and monitoring of EBT cards. Recommendation - We recommend that OCFO/OFT for DHS strengthen formal policies and procedures to maintain adequate security over, and documentation/records for EBT Cards. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The OCFO/OFT for DHS concurs with this finding. The process to manage card distribution is supported by established policies and procedures documented within the EBT Program Manual. While these controls have been formalized, recent audit results indicate that opportunities for improvement remain, particularly in consistent adherence to defined processes. Accordingly, the focus for the current period is on strengthening compliance with existing policy and procedures rather than further policy development. Emphasis will be placed on reinforcing expectations, enhancing oversight, and ensuring accountability for adherence among staff. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-003 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Agriculture Child Nutrition Cluster ALN: 10.553, 10.555, 10.559 and 10.582 Award #: 11131-028 Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Office of the State Superintendent of Education (OSSE) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal Funding Accountability and Transparency Act (FFATA) Reporting Compliance: In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025 onwards. FFATA reports are submitted no later than the month following the month in which this Federal award is made, and annually after that. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, 2 CFR Section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – For one (1) subaward sample selected for FFATA testing, we noted that OSSE failed to submit the FFATA report within the required timeframe. Transactions tested - 8 Subaward not reported - 0 Report not timely - 1 Subaward amount incorrect - Not applicable – subaward amount was correct. Subaward missing key elements - Not applicable – no missing key elements. Dollar amount of tested 2025 subawards - $8,900,559 Subaward not reported - $ - Report not timely - $ 38,487 Subaward amount incorrect - Not applicable – subaward amount was correct. Subaward missing key elements - Not applicable – no missing key elements. Additionally, during our testing of the SEFA, we noted that OSSE incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2025, OSSE incurred $25.7 million in subrecipient expenditures for this program and incorrectly reported that there were no subrecipient expenditures on the preliminary SEFA. While the subrecipient expenditure amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of OSSE’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report and failure to properly review and present expenditure can result in noncompliance with reporting requirements. Cause – OSSE did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. In addition, OCFO did not comply with their policies and procedures to ensure accuracy of the SEFA. Recommendation – We recommend that OSSE evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report to be submitted timely. In addition, we recommend that OCFO adhere to instituted policies and procedures to ensure accuracy of the SEFA. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – OSSE concurs with the auditor’s finding and recommendations related to this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-004 Prior Year Finding Number: N/A Compliance Requirement: Cash Management; Reporting Program: U.S. Department of Defense National Guard Military Operations and Maintenance (O&M) Projects ALN: 12.401 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: District of Columbia National Guard (DCNG) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Uniform Guidance at 2 CFR Section 200.305 requires payment methods to align with actual, immediate cash requirements and support allowability of costs. Additionally, 2 CFR Section 200.305(b) requires non-Federal entities to minimize the time elapsing between the transfer of funds from the Federal government and the disbursement of those funds for program purposes. 2 CFR Section 200.302(b)(6) requires financial management systems to provide accurate, current, and complete disclosure of financial results, including proper recording of cash transactions. When entities are funded on a reimbursement basis, program costs must be incurred prior to the date of the reimbursement request (2 CFR Section 200.305(b)(3)). Federal awarding agency regulations and grant award terms require recipients to submit the Request for Advance or Reimbursement (SF-270) timely to support reimbursement requests and proper cash management under the award. Condition – BDO selected four (4) out of twelve (12) months for cash management testing and identified a total of 44 drawdowns within the sampled period. The following findings were noted during testing: • Twenty-four (24) out of forty-four (44) sampled drawdowns were not submitted on a timely or regular basis, occurring beyond the grant period and inconsistent with prescribed monthly timelines. • In three (3) out of forty-four (44) instances, no drawdowns were submitted for the Facility Sustainment Restoration Modernization project (main Federal grant), indicating incomplete initiation of reimbursement requests. • In twenty-three (23) out of forty-four (44) instances, no evidence of submission of reimbursement requests (SF-270) to the Federal officers was available, and forms lacked DCNG Director approval. In addition, in 2 instances (out of 3 noted), although DCNG Director approval existed, no evidence of submission was available. • In three (3) instances, amounts in billing authorization did not match the amounts requested on SF-270, indicating lack of reconciliation control. • In one (1) instance, a grant award was excluded from the billing authorization worksheet, but a corresponding SF-270 existed, which was neither Director-approved nor supported by submission evidence, indicating drawdowns processed outside the established authorization framework. • Evidence of cash receipt was available for only six (6) out of forty-four (44) instances; for the remaining instances, no supporting documentation was provided, and funds were reportedly not received. Questioned Costs – Not determinable. Context – These deficiencies were identified during testing of forty-four (44) cash drawdown and reimbursement transactions performed as part of the audit of internal control over compliance and compliance with Federal cash management requirements. Effect – The identified deficiencies result in noncompliance with Federal cash management requirements and increase the risk of delayed reimbursements. They also create a heightened risk of unsupported, inaccurate, or unauthorized drawdowns being processed. Furthermore, the lack of adequate documentation and controls over cash receipts and grant activity weakens tracking mechanisms, thereby impacting the reliability and accuracy of financial reporting. Cause – These issues are primarily due to a lack of adherence to established controls over the review and approval of drawdowns, along with inadequate monitoring of timelines and completeness across grants. Additionally, the absence of effective reconciliation controls between billing authorizations, SF-270 forms, and cash receipts contributes to inconsistencies. Weak implementation of approval workflows and insufficient documentation retention practices further exacerbate the control deficiencies. Recommendation – We recommend that DCNG strengthen internal controls over Federal reporting compliance by: • Establishing and enforcing a formal drawdown schedule aligned with actual cash needs. • Ensuring all eligible expenditures are included in billing authorizations and drawdowns. • Requiring documented supervisory review and certification of SF-270 prior to submission. • Strengthening approval workflows (e.g., BOX routing) with complete audit trails. • Performing routine reconciliations between billing authorizations, drawdowns, and recorded receipts. • Implementing procedures to track and document receipt of funds for all submitted drawdowns. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DC Government Operations concurs with this finding and acknowledges the deficiencies identified during the audit period. We want to provide important operational context that speaks to the shared nature of the SF-270 drawdown process and how corrective actions will be distributed across responsible parties. The SF-270 reimbursement cycle is a multi-agency process. The Office of the Chief Financial Officer is responsible for generating the drawdown reports that serve as the prerequisite data source for DC Government Operations’ Grants Management Specialist to develop and route SF-270 forms for Director approval and submission to the Grants Officer Representative and U.S. Property and Fiscal Officer. Deficiencies identified in this finding reflect breakdowns at multiple points across that workflow. The corrective action plan assigns responsibility accordingly and includes a designated section for OCFO’s response. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-005 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Defense National Guard Military Operations and Maintenance (O&M) Projects ALN: 12.401 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: District of Columbia National Guard (DCNG) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, 2 CFR Section 200.302(a) requires that the financial management system of each non-Federal entity be sufficient to permit the preparation and timely submission of required financial reports, including those required by program-specific terms and conditions. Federal awarding agency regulations and the terms of the award require recipients to accurately prepare and timely submit required financial reports, including the Federal Financial Report (SF-425). Condition – Management did not submit the annually required SF-425 Federal Financial Report for the National Guard Military Operations and Maintenance (O&M) Projects grant within the reporting periods required by the terms and conditions of the award. Questioned Costs – Not determinable. Context – This deficiency was identified during the audit as part of our review of DCNG’s internal control over compliance and compliance with Federal reporting requirements, including the submission of required financial reports under the program. Effect – Failure to properly review and present expenditures can result in noncompliance with Federal reporting requirements. Cause – DCNG did not adhere to established policies and procedures designed to ensure the timely preparation, supervisory review, and submission of required Federal financial reports. Specifically, controls to monitor reporting deadlines and ensure accountability for report submission were not operating as designed. Recommendation – We recommend that DCNG strengthen internal controls over Federal reporting compliance by: • Assigning responsibility for the preparation and submission of all required Federal reports. • Ensuring required reports, including the SF-425, are reviewed and submitted timely in accordance with grant requirements. • Implementing documented supervisory review procedures and a formal reporting calendar to monitor compliance with reporting deadlines. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DC Government Operations concurs with the finding. We acknowledge that the SF-425 Federal Financial Report is required and that it was not completed. While we do not contest the finding, we offer the following context. The Capital Guardian Youth ChalleNGe Academy (Appendix 4001) agreement has been subject to multiple formal inspections and audits conducted by the National Guard Bureau, the federal oversight authority for DC Government Operations’ thirteen appendices. These inspections were comprehensive and detailed, including a review of grant compliance and financial management practices. At no point during any of these reviews did the National Guard Bureau, the Grants Officer Representative, or the U.S. Property and Fiscal Officer identify SF-425 submission as a deficiency, issue a recommendation for corrective action, or communicate to DC Government Operations that this report was an outstanding requirement under the award. This context does not change the compliance obligation. It is offered because it directly informs the corrective actions below, which are designed to ensure this requirement is memorialized in our internal controls and reporting calendar rather than dependent on external notifications from our federal partners. DC Government Operations is committed to full compliance going forward and has developed corrective action plan in coordination with the Office of the Chief Financial Officer. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-006 Prior Year Finding Number: 2024-009 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: Office of the Deputy Mayor for Planning and Economic Development (DMPED) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.403, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented.” In addition, the U.S. Department of Treasury, Guidance for the Coronavirus Capital Projects Fund For States, Territories & Freely Associated States (CPF), Section D. Eligible and Ineligible Cost: states that “Allowable costs are determined in accordance with the cost principles identified in 2 CFR Part 200, Subpart E. Federal funds committed to an award may only be used to cover allowable costs incurred during the period of performance and for allowable closeout costs incurred during the grant closeout process. Cost sharing is not a requirement for the use of these funds” Section C. Project Eligibility: also states the following, “Capital Project or Project means the construction, purchase, and installation of, and/or improvements to capital assets where the costs of such assets are capitalized or depreciated, including ancillary costs necessary to put the capital asset to use. Examples of capital assets include buildings, towers, digital devices and equipment, fiber-optic lines, and broadband networks. Examples of ancillary costs include project costs related to project planning and feasibility, broadband installation, and community engagement, broadband adoption, digital literacy, and training associated with a planned or completed Project funded by the Capital Projects Fund program.” Condition – During our examination of Activities Allowed or Unallowed and Allowable Costs/Cost Principles, we observed that the agency used federal funds to reimburse their subrecipient for $4,100,000 in improvement allowances paid to subtenants at the Max Robinson Center facility in connection with their leases of the space. The subtenant improvement allowances do not appear to align with the definition of ancillary costs as outlined by the CPF guidance mentioned earlier, which describes ancillary costs as project costs related to project planning and feasibility, community engagement, and training associated with a planned or completed Project. BDO deemed this a recurrence of the same substantive issue identified in prior year Finding 2024-009 where the agency charged rent payments to the program reported as ancillary costs, which was identified as questioned cost and was later on disallowed by Treasury in its management decision letter dated December 22, 2025. The prior-year rent payments and the current-year subtenant improvement allowances are both lease and occupancy-related costs charged to the program intended to fund capital project costs, both of which do not appear to meet the definition of ancillary cost. Additionally, the U.S. Department of the Treasury issued an Information Document Request (IDR) that included a request for a detailed explanation of the $4,100,000 in ancillary costs charged to the program. On May 28, 2026, Treasury notified the agency that the IDR was closed based on the agency’s response, however, did not include an affirmative determination that the $4,100,000 in subtenant improvement allowances are allowable as charged under the program. Further response from Treasury on June 1, 2026, noted “no additional questions or concerns about these issues” with regards the Agency asking for Treasury to approve the $4,100,000 to be used as ancillary costs. This further response from Treasury does not give an affirmative determination regarding the allowability of the subtenant improvement allowances charged to the program. Based on the procedures performed and review of relevant guidance, BDO notes that these costs do not meet the requirements to be considered allowable under the program. Questioned Costs – Known amount $4,100,000. Context – This is a condition identified per review of DMPED’s compliance with specified requirements using a statistically valid sample. Total subrecipient expenditures reported as allowable costs were $8,100,000. Effect – DMPED was unable to demonstrate that the subtenant improvement allowance charged was approved by the Department of Treasury and was an allowable cost under the guidance. Cause – DMPED did not have proper internal controls and policies and procedures in place to identify allowable costs and activities. Recommendation – We recommend that DMPED evaluate its procedures to ensure only allowable expenses are charged to the program as required under 2 CFR Section 200.403. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DMPED does not concur with the auditor’s finding regarding the allowability of subtenant improvement allowance per the CPF guidance. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section. BDO’s Response – We have reviewed management’s response, and our finding remains as indicated.

Finding Number: 2025-007 Prior Year Finding Number: N/A Compliance Requirement: Procurement and Suspension and Debarment Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: Department of General Services (DGS), on behalf of the Department of Parks and Recreation (DPR) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Section 180.300, Suspension and Debarment, non-federal entities cannot enter into awards, subawards, or contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in federal assistance programs or activities. Non-federal entities must either check for exclusions in the System for Award Management (SAM); collect a certification from the entity, or add a clause or condition to the covered transaction with the entity prior to entering into a covered transaction with a non-federal entity. In addition, in accordance with 2 CFR Section 180.415(b), non-federal entities cannot renew or extend covered transactions (other than no-cost time extension) with any excluded person, or under which an excluded person is a principal, unless the non-federal entity obtains an exception under 2 CFR Section 180.135. Condition – During our testing of procurement and suspension and debarment requirements, we examined seven (7) procurement contracts, valued at $24,796,728, out of a total population of eleven (11), valued at $25,329,758. We noted that DGS did not maintain documentation evidencing the suspension and debarment check for two (2) separate procurement contracts, valued at $97,508, involving the same contractor, hence, performance of the required suspension and debarment check could not be verified. Questioned Costs – Not determinable. Context – DPR owns and maintains budget authority over the project property, while DGS is responsible for managing construction and conducting all procurement activities for the project on DPR’s behalf. As such, DGS performs all required suspension and debarment checks for the project’s procurement transactions. This is a condition identified per review of DGS’s compliance, on behalf of DPR, with the specified procurement and suspension and debarment requirements using a statistically valid sample. Effect – Failure to adhere to the procurement procedures specified in the Uniform Administrative Requirements may lead to the Federal agency disallowing the procurement and associated costs. Cause – DGS did not maintain documentation of the suspension and debarment check as required by 2 CFR Section 180.300 and 2 CFR Section 200.318(i) listed above, preventing verification that the required check was performed prior to accepting the contractor. Recommendation – We recommend that management ensure consistent adherence to federal procurement requirements (2 CFR Section 180.300 and 2 CFR Section 200.318(i)) to perform the suspension and debarment verification for all covered transactions and to retain documentation evidencing the verification in the procurement file. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DGS and DPR management concur with the finding. DGS acknowledges that documentation of the required suspension and debarment checks was not retained in two procurement files. While the checks were performed, the absence of supporting documentation does not meet federal record-retention standards. DGS and DPR remain committed to full compliance with 2 CFR Section 180.300 and 2 CFR Section 200.318(i) and will strengthen internal controls to ensure complete and consistent documentation of all verification activities. The hard copies of the tax compliance documentation may have been filed in the paper records, which are currently unavailable for review. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-008 Prior Year Finding Number: 2024-011 Compliance Requirement: Reporting Program: U.S. Department of the Treasury COVID-19 – Coronavirus Capital Projects Fund ALN: 21.029 Award #: CPFFN0167 Award Year: 02/09/2022 – 12/31/2026 Government Department/Agency: Office of the Deputy Mayor for Planning and Economic Development (DMPED) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025, onwards. FFATA reports are submitted no later than the month following the month in which this Federal award is made, and annually after that. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Condition – DMPED had a single subrecipient through which $8.1 million in grant funds was expended. During our audit, we noted that DMPED did not submit the required FFATA report for its subrecipient through the FSRS or the sam.gov website for the one subaward issued in fiscal year 2025. Questioned Costs – None. Context – This is a condition identified per review of DMPED’s compliance with reporting requirements. Effect – Failure to properly submit the FFATA report results in noncompliance for the Coronavirus Capital Projects Fund program. Cause – DMPED did not have proper internal controls and policies and procedures in place to fulfill the FFATA reporting requirements. Recommendation – We recommend that DMPED evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations. These procedures should include a supervisory review of the report information before it is submitted to the System for Award Management (sam.gov) website. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DMPED concurs with the auditor’s findings and recommendations. DMPED will take steps to ensure full reporting compliance with federal awards. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-009 Prior Year Finding Number: N/A Compliance Requirement: Reporting – Common Origination and Disbursement System Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal Register, Volume 86, Number 119 and 34 CFR 690.83; FSA Handbook, technical references on Common Origination and Disbursement (COD) Reports can be found in the 2024-2025 COD Technical Reference in Volume VI, Section 6 outlines the following compliance requirements for originations records and disbursement records reporting to Common Origination and Disbursement (COD) System: Institutions submit Federal Direct Loan Program, Federal Pell Grant Program, and TEACH Grant origination records and disbursement records to the COD system. Origination records can be sent well in advance of any disbursements, as early as the institution chooses to submit them for any student the institution reasonably believes will be eligible for a payment. An institution follows up with a disbursement record for that student no earlier than (1) seven calendar days prior to the disbursement date under the Advance or Heightened Cash Monitoring 1 payment methods, or (2) the date of the disbursement under the Reimbursement or Heightened Cash Monitoring 2 Payment Method. The disbursement record reports the actual disbursement date and the amount of the disbursement. The U.S. Department of Education (the “ED”) processes origination and/or disbursement records and returns acknowledgments to the institution. The acknowledgments identify the processing status of each record: Rejected, Accepted with Corrections, or Accepted. Institutions must report student disbursement data within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data. Institutions may do this by reporting once every 15 calendar days, bi-weekly or weekly, or may set up their own system to ensure that changes are reported in a timely manner. Key items to test on origination records for the fiscal year are: award amount, enrollment date, verification status code (when the applicant is selected for verification), transaction number, cost of attendance, and the “Academic Start Date” and “Academic End Date”. Key items to test on disbursement records are disbursement date and amount. The information may be accessed by the institution for the auditor. Condition – During our testing, we noted the following issues: • For fourteen (14) of twenty-five (25) COD origination records tested, we identified certain instances in which key items (cost of attendance) for origination records were not correctly reported. • For six (6) of twenty-five (25) COD disbursement records tested, UDC did not report the disbursement to COD within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over COD disbursement and origination reporting from student financial assistance program. Cause – Insufficient internal control and administrative oversight with respect to COD disbursement and origination reporting. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that COD disbursement and origination reporting is performed accurately and timely. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-010 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Notification of Disbursement) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.165(a)(1)(2)(3) outlines the following compliance requirements for award disbursement notifications: (a) Notices. (1) Before an institution disburses title IV, HEA program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans. (2) Except in the case of a post-withdrawal disbursement made in accordance with Section 668.22(a)(5), if an institution credits a student ledger account with Direct Loan, Federal Perkins Loan, or TEACH Grant program funds, the institution must notify the student or parent of— (i) The anticipated date and amount of the disbursement; (ii) The student's or parent's right to cancel all or a portion of that loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement and have the loan proceeds or TEACH Grant proceeds returned to the Secretary; and (iii) The procedures and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, loan disbursement, TEACH Grant, or TEACH Grant disbursement. (3) The institution must provide the notice described in paragraph (a)(2) of this section in writing— (i) No earlier than 30 days before, and no later than 30 days after, crediting the student's ledger account at the institution, if the institution obtains affirmative confirmation from the student under paragraph (a)(6)(i) of this section; or (ii) No earlier than 30 days before, and no later than seven days after, crediting the student's ledger account at the institution, if the institution does not obtain affirmative confirmation from the student under paragraph (a)(6)(i) of this section. Condition – During our testing, we noted the following issues: • For twenty-three (23) of twenty-five (25) Title IV disbursements tested, UDC did not provide evidence of award letter communication to the students of the amount and type of Title IV funds the student could expect to receive, including how and when disbursements would be made, prior to making a disbursement of funds. • For eleven (11) out of twenty-five (25) direct loan disbursements tested, UDC did not send disbursement notification to the students/parents. • For two (2) out of twenty-five (25) direct loan disbursements tested, the disbursement notification sent to the students/parents was not performed within allowable timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over notification of disbursements compliance requirement. Cause – Insufficient administrative oversight with respect to the notification of disbursements compliance requirement. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures surrounding the disbursement of federal student aid to ensure compliance with the notification of disbursements requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-011 Prior Year Finding Number: 2024-012 Compliance Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students (Credit Balances) Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.164(c)(3)(i) and (h)(1)(2) outlines the following compliance requirements for Title IV credit balances: (c) Crediting a student’s ledger account. (i) An institution may include in one or more payment periods for the current year, prior year charges of not more than $200 for— (A) Tuition, fees, and institutionally provided room and board, as provided under paragraph (c)(1)(i) of this section, without obtaining the student's or parent's authorization; and (B) Educationally related goods and services provided by the institution, as described in paragraph (c)(1)(ii) of this section, if the institution obtains the student's or parent's authorization under Section 668.165(b). (h) Title IV, Higher Education Act (HEA) credit balances. (1) A title IV, HEA credit balance occurs whenever the amount of title IV, HEA program funds credited to a student's ledger account for a payment period exceeds the amount assessed the student for allowable charges associated with that payment period as provided under paragraph (c) of this section. (2) A title IV, HEA credit balance must be paid directly to the student or parent as soon as possible, but no later than— (i) Fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (ii) Fourteen (14) days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition – During our testing, we noted the following issues: • For six (6) of forty (40) credit balances selected for testing, the credit balance created by the disbursement of Title IV awards was not refunded to the student within the required 14-day timeframe. • For one (1) of forty (40) credit balances selected for testing, a prior year charge in excess of $200 was resolved using federal funds disbursed in current year. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not in compliance with the required federal guidelines over credit balances from student financial assistance. Cause – Insufficient internal control and administrative oversight with respect to the disbursement of federal awards. Recommendation – We recommend that UDC enhance its internal controls, policies and procedures to ensure that Title IV credit balances are paid timely to students. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-012 Prior Year Finding Number: 2024-013 Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 34 CFR Section 668.173(b)(1) outlines the following compliance requirements for Title IV refunds. (b) Timely return of title IV, Higher Education Act (HEA) program funds. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if— (1) The institution deposits or transfers the funds into the bank account it maintains under Section 668.163 no later than 45 days after the date it determines that the student withdrew. Condition – During our testing, we noted the following exception: • For one (1) of seven (7) students selected for Title IV refund calculation testing, the required Title IV refund was not adjusted in the U.S. Department of Education's Common Origination and Disbursement (COD) system within the required timeframe. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified requirements using a statistically valid sample. Effect – UDC was not compliant with the Return of Title IV Funds compliance requirements. Cause – Insufficient administrative oversight with respect to Return of Title IV Funds requirements. Recommendation – We recommend that UDC enhance its process surrounding the disbursement of federal student aid to ensure compliance with the Return of Title IV Funds requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-013 Prior Year Finding Number: 2024-014 Compliance Requirement: Special Tests and Provisions – NSLDS Reporting Program: U.S. Department of Education Student Financial Assistance Cluster ALN: 84.007, 84.033, 84.063, 84.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: University of the District of Columbia (UDC) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Institutions are required to report enrollment information under the Pell grant and the Direct and Federal Family Education Loan (“FFEL”) loan programs via the National Student Loan Data System (“NSLDS”) (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the Student Financial Assistance Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309; Perkins 34 CFR 674.19(f)). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (“NSLDSFAP”) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: • Office of Postsecondary Education Identification (OPEID) Number – This is the OPEID for the location that the student is actually attending. • Enrollment Effective Date – The date that the current enrollment status reported for a student was first effective. (See 4.4.2 of the NSLDS Enrollment Reporting Guide for the specific requirements for reporting the Enrollment Effective Date. Also see 4.4.3 of the NSLDS Enrollment Reporting Guide for additional guidance on effective dates for Withdrawal versus Graduation and Electronic Announcement titled – NSLDS Enrollment Reporting – Submission Dates, Effective Dates and Certification Dates, dated April 20, 2017, for additional information and examples at https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2017-04-20/general-subject-nslds¬enrollment-reporting-submission-dates-effective-dates-and-certification-dates.) • Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Certification Date – The Date enrollment certified by institution. At a minimum, institutions are required to certify enrollment every 60 days or every other month. Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: • OPEID Number – This is the OPEID for the location that the student is actually attending. • CIP Code – The Classification of Instructional Programs (CIP) is a set of codes that define fields of study. CIP Codes are maintained by ED's National Center for Education Statistics (NCES). They were most recently updated in 2020 and are usually updated every ten years. A listing of current CIP codes is available at: https://nces.ed.gov/ipeds/cipcode/resources.aspx?y=56. • CIP Year – Year for the corresponding CIP code. The CIP Year for the codes currently used by NSLDS is 2020. • Credential Level – Indicates the level of a credential the student will receive for the program the student is attending, for example undergraduate certificate, associate degree, or bachelor’s degree. (See 4.4.7 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting the Credential Level.) • Published Program Length Measurement – The institution identifies whether the Published Program Length is in days, weeks, or years. • Published Program Length - Published Program Length should be reported based on the definition of “normal time” to completion in the regulations at 34 CFR 668.41(a), • Program Begin Date – The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. (See 4.4.8 of the NSLDS Enrollment Reporting Guide for additional guidance.) • Program Enrollment Status – The student’s enrollment status as of the reporting date; full-time (F), three-quarter time (Q), half-time (H), less than half-time (L), leave of absence (A), graduated (G), withdrawn (W), deceased (D), never attended (X) and record not found (Z). (See 4.4.4 of the NSLDS Enrollment Reporting Guide for additional guidance on reporting graduated and withdrawn for the Campus-Level Record versus the Program Level Record and 4.4.10 for further guidance on Enrollment Status reporting at the Campus-Level Record and the Program-Level Record.) • Program Enrollment Effective Date – The date when the student's current program status first took effect. Condition – UDC did not submit an accurate status change notification or failed to submit timely notification to the NSLDS website for certain students who graduated, withdrew or had a change in their enrollment status (full time, half time or less than half time) during the year. BDO selected a random sample of forty (40) students used to evaluate both campus and program level enrollment reporting compliance requirements. For campus level enrollment, we noted the following exceptions: • For five (5) of forty (40) campus level records tested, UDC did not certify the students’ enrollment data within 60 days. • For four (4) of forty (40) campus level records tested, UDC did not accurately report the students’ enrollment effective date. • For three (3) of forty (40) campus level records tested, UDC did not correctly report the students’ enrollment status. For program level enrollment, we noted the following exceptions: • For four (4) of forty (40) program level records tested, UDC did not accurately report the program begin date. • For eleven (11) of forty (40) program level records tested, UDC did not accurately report the students’ enrollment effective date. • For two (2) of forty (40) program level records tested, UDC did not accurately report the students’ enrollment status. Questioned Costs – None. Context – This is a condition identified per review of UDC’s compliance with the specified enrollment requirements using a statistically valid sample. Effect – UDC is not in compliance with enrollment reporting requirements. Failure to promptly report accurate and timely changes in enrollment status may adversely impact the repayment status for student loan borrowers. Cause – Insufficient internal controls and administrative oversight with respect to enrollment reporting requirements. Recommendation – We recommend that UDC enhance its procedures and internal controls over enrollment reporting to ensure that significant data elements under both campus-level and program-level records are reported accurately and timely to NSLDS. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – UDC agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-014 Prior Year Finding Number: N/A Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Immunization Cooperative Agreements ALN: 93.268 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Health (DC Health) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.403, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented.” Condition – During our testwork over nonpayroll transactions for the Activities Allowed or Unallowed and Allowable Costs/Cost Principles, we noted that for one (1) out of forty-two (42) samples, the transaction was charged twice to the program. Total amount of nonpayroll transactions is $11,925,998, and the amount of exception is $95,827. Questioned Costs – Known amount is $95,827. Context – This is a condition identified per review of DC Health’s compliance with specified requirements using a statistically valid sample. Total amount of samples selected for testing amounted to $6,817,550. Effect – Lack of proper review of expenditures could result to unallowable costs charged to the program. Cause – DC Health does not have adequate controls in place to ensure that only allowable costs are charged to the program. Recommendation – We recommend that DC Health strengthen internal control procedures to ensure that expenditures are allowable, and that sufficient documentation is retained to support that allowability. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DC Health concurs with the finding. The expenditure in question was an allowable cost journalized to the grant. The error occurred when the journal was duplicated. To correct the issue, other allowable expenditures were journalized from the grant to local and therefore prevented a duplicate drawdown in PMS. Also note that the vendor did not receive duplicate payment. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-015 Prior Year Finding Number: 2024-016 Compliance Requirement: Eligibility; Special Tests and Provisions – Income Eligibility and Verification Sytem Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. For TANF, per 45 CFR Section 205.60 (a), “The State agency will maintain or supervise the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of financial assistance, and the use of any information obtained under Section 205.55, with respect to individual applications denied, recipients whose benefits have been terminated, recipients whose benefits have been modified, and the dollar value of these denials, terminations and modifications. Under this requirement, the agency will keep individual records which contain pertinent facts about each applicant and recipient. The records will include information concerning the date of application and the date and basis of its disposition; facts essential to the determination of initial and continuing eligibility (including the individual's social security number, need for, and provision of financial assistance); and the basis for discontinuing assistance.” Per 45 CFR Section 205.56(a)(1)(i), “The State agency shall review and compare the information obtained from each data exchange against information contained in the case record to determine whether it affects the applicant’s or the recipient’s eligibility or the amount of assistance.” Per 45 CFR Section 205.60 (a), “The State agency will maintain or supervise the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of financial assistance, and the use of any information obtained under Section 205.55, with respect to individual applications denied, recipients whose benefits have been terminated, recipients whose benefits have been modified, and the dollar value of these denials, terminations and modifications. Under this requirement, the agency will keep individual records which contain pertinent facts about each applicant and recipient. The records will include information concerning the date of application and the date and basis of its disposition; facts essential to the determination of initial and continuing eligibility (including the individual's social security number, need for, and provision of financial assistance); and the basis for discontinuing assistance.” Condition – During our testing over beneficiary eligibility compliance requirements of the Temporary Assistance for Needy Families (TANF) program, we selected a sample of sixty (60) beneficiaries in fiscal year 2025 to test DHS’ compliance with TANF eligibility requirements. There were a total of 56,211 payments in the population, with a total dollar amount of $43,036,388. We noted the following: • For three (3) out of sixty (60) samples, DHS was unable to provide support that would allow us to test that cash assistance was not provided to an individual during the 10-year period that began on the date the individual was convicted in Federal or State court of having made a fraudulent statement or representation with respect to place of residence. In addition, for these three (3) samples, DHS was unable to locate the customer's application that was submitted prior to the sample month tested. • For three (3) out of sixty (60) samples, DHS was unable to provide the most recent application form that was submitted by the customer prior to the month tested. We were therefore unable to determine whether cash assistance was provided to an individual who was deemed eligible to receive TANF benefits prior to the approval of the application by the Social Service Representatives (SSR). • For all six (6) of these samples above, we noted that the SSR did not ensure that all required information was received prior to approving the application. These exceptions happened due to inadequate review of the application for cash assistance by the SSR. The questioned costs for the above issues amounted to $44,618, which represents 10.50% of the total TANF federal benefits paid to the 60 sampled items of $425,045. In addition, while testing the same sixty (60) samples for the Special Tests and Provisions – Income Eligibility and Verification System compliance requirement, although all evidence provided supported the use of the Bendex system during the eligibility process, for one (1) of sixty (60) the application, which included an adult in the case, was not provided. Questioned Costs – Known amount is $44,618. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support eligibility determinations, ineligible beneficiaries may receive benefits under the TANF grant and DHS may make payments on behalf of those beneficiaries resulting in noncompliance with the eligibility requirements. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation supporting participant eligibility. Recommendation - We recommend that DHS strengthen its existing policies and procedures over the review and maintenance of appropriate documentation to ensure compliance with eligibility requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – The Division of Program Operations (DPO) of DHS acknowledges and agrees with the audit findings and related observations. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-016 Prior Year Finding Number: 2024-017 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. According to Title IV-A, Section 411 of the Social Security Act (the Act), 45 CFR 265.3, and the American Recovery and Reinvestment Act (ARRA) of 2009, (Public Law 111-5), each State must file an annual report containing information on the TANF program and the State’s maintenance-of-effort (MOE) program(s) for that year, including strategies to implement the Family Violence Option, State diversion programs, and other program characteristics. States are required to submit the ACF-196R report quarterly, beginning in Federal Fiscal Year (FFY) 2015, in lieu of the SF-425, Federal Financial Report (financial status). Each State files quarterly expenditure data on the State’s use of Federal TANF funds, State TANF MOE expenditures, and State expenditures of MOE funds in separate State programs. If a State is expending Federal TANF funds received in prior fiscal years, it must file a separate quarterly TANF Financial Report for each fiscal year that provides information on the expenditures of that year’s TANF funds. This form must be used for reporting regular TANF grant funds, Contingency Funds, and ARRA-Emergency Fund for TANF State Programs funds. See TANF-ACF-PI-2014-02, available at http://www.acf.hhs.gov/programs/ofa/resource/tanf-acf-pi-2014-02, for more information. Condition – During our test work over the quarterly ACF-196R report, we noted for Grant Identifying number 2501DCTANF/2501DCTAN3, the ACF-196R filed for the 4th quarter in fiscal year 2025 showed a variance of $164,659, between the cumulative amount reported on the ACF-196R amounting to $67,867,001, and the sum of federal and contingency funds as reported in the SEFA detail amounting to $67,702,342. DHS was unable to provide support for the variance. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure that correct amounts were reported and were properly reviewed, DHS may report incorrect amounts on the quarterly ACF-196R reports. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that the amounts on the ACF-196R were properly reported, and the reports were properly reviewed and approved. Recommendation - We recommend that DHS implement policies, procedures and controls that will enable accurate reconciliation between the data sources used in the preparation of the ACF-196R reports to ensure proper reporting of TANF expenditures. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS concurs with the finding. The SEFA submitted was correct, but the amount reported on the ACR-196 was incorrect because there was an undetected change in a formula in the workbook. This resulted in an error not being detected. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-017 Prior Year Finding Number: 2024-018 Compliance Requirement: Reporting; Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/ Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 261.60 (a), “A State must report the actual hours that an individual participates in an activity, subject to the qualifications in paragraphs (b) and (c) of this section and Section 261.61(c). It is not sufficient to report the hours an individual is scheduled to participate in an activity. (b) For the purposes of calculating the work participation rates for a month, actual hours may include the hours for which an individual was paid, including paid holidays and sick leave. For participation in unpaid work activities, it may include excused absences for hours missed due to a maximum of 10 holidays in the preceding 12-month period and up to 80 hours of additional excused absences in the preceding 12-month period, no more than 16 of which may occur in a month, for each work-eligible individual. Each State must designate the days that it wishes to count as holidays for those in unpaid activities in its Work Verification Plan. It may designate no more than 10 such days. In order to count an excused absence as actual hours of participation, the individual must have been scheduled to participate in a countable work activity for the period of the absence that the State reports as participation. A State must describe its excused absence policies and definitions as part of its Work Verification Plan, specified at Section 261.62. (c) For unsubsidized employment, subsidized employment, and OJT, a State may report projected actual hours of employment participation for up to six months based on current, documented actual hours of work. Any time a State receives information that the client's actual hours of work have changed, or no later than the end of any six-month period, the State must re-verify the client's current actual average hours of work, and may report these projected actual hours of participation for another six-month period. (d) A State may not count more hours toward the participation rate for a self-employed individual than the number derived by dividing the individual's self-employment income (gross income less business expenses) by the Federal minimum wage. A State may propose an alternative method of determining self-employment hours as part of its Work Verification Plan. (e) A State may count supervised homework time and up to one hour of unsupervised homework time for each hour of class time. Total homework time counted for participation cannot exceed the hours required or advised by a particular educational program.” Per 45 CFR Section 261.61 (a), “A State must support each individual’s hours of participation with documentation in the case file. In accordance with Section 261.62, a State must describe in its Work Verification Plan the documentation it uses to verify hours of participation in each activity.” According to the DC State Verification Plan, the D.C. Department of Human Services (DHS), Department of Human Services Monitoring Unit reviews and audits all documentation submitted by vendors reflecting the activities of recipients in TANF Employment program. This documentation includes time sheets, activity logs, school records, pay stubs, and verification of employment, work experience and on-the-job training. The Monitoring Unit completes this audit process to determine if sufficient documentation exists to substantiate reported time and attendance data, to warrant a payment to TANF Employment program vendors, and submission of countable hours for federal reporting purposes. The District projects hours of participation in unsubsidized, self-employment for six months or until the recipient's next scheduled recertification, whichever is sooner. Per 45 CFR Section 265.7 (a)-(c), “Each State’s quarterly reports (the TANF Data Report, the TANF Financial Report (or Territorial Financial Report), and the SSP-MOE Data Report) must be complete and accurate and filed by the due date.” For disaggregated data report, ‘a complete and accurate report’ means that: (1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems, and include correction of the quarterly data by the end of the fiscal year reporting period; (2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so); (3) The State reports data for all required elements (i.e., no data are missing); (4)(i) The State provides data on all families; or (ii) if the State opts to use sampling, the State reports data on all families selected in a sample that meets the specification and procedures in the TANF Sampling Manual (except for families listed in error); and (5) Where estimates are necessary (e.g., some types of assistance may require cost estimates), the State uses reasonable methods to develop these estimates. For an aggregated data report, “a complete and accurate report” means that: (1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems; (2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so); (3) The State reports data on all applicable elements; and (4) Monthly totals are unduplicated counts for all families (e.g., the number of families and the number of out-of-wedlock births are unduplicated counts).” 45 CFR Section 265.7 (g) states that “States must maintain records to adequately support any report, in accordance with 2 CFR Section 200.334 through 200.338.” Condition – During our test work over a sample of sixty (60) out of 5,549 participants for Special Tests and Provisions - Penalty for Failure to Comply with Work Verification Plan and Reporting, we noted: • For seven (7) instances, we noted that although the hours reported on the ACF-199 report met or exceeded the required hours, the hours reported did not agree with the average hours reported in CATCH, or were not supported by documentation (audited timesheets or work documentation). In addition, for three (3) of these instances, the supported hours did not meet the required hours. • For four (4) instances, we noted that the hours reported in the ACF-199 were less than the hours required; however, we noted that the customer was not sanctioned for work requirement non-compliance. In addition, for one (1) of these instances, the hours reported were not supported. • For thirteen (13) instances, we noted that the average hours reported in the ACF-199 were not properly supported. In addition, for eight (8) of these instances, the customer was not sanctioned for work requirement non-compliance. We further noted that for one (1) of these instances, additional support was provided but it was related to four (4) months after the sample selected and was not valid for the month being tested. • For two (2) instances, we noted that although participant work activity was adequately documented and properly supported by audited timesheets or work documentation support, the participant did not meet the work participation weekly hours requirement. In addition, for these samples, we noted that the hours reported on the ACF-199 report do not agree with the average hours in CATCH. • For four (4) instances, we noted that for a customer with unsubsidized employment, although the reported hours and the support met or exceeded the required hours, the reported hours on the ACF-199 report do not agree with the documentation provided (hours reported were less than actual support). • For one (1) instance, this customer was not found in CATCH, therefore there were no required hours included in CATCH. We reviewed the timesheet provided for one week during the month tested. We noted that the reported hours were not supported. • For one (1) instance, the hours reported for the Week 1 timesheet covered a two-week period that crossed two months. However, all the hours on the timesheet were improperly allocated to Week 1 of the month being tested instead of being allocated to the two weeks. We noted that the average hours reported on the ACF-199 report do not agree with the hours approved in CATCH, however, the average hours calculated using the correct hours agree with what was reported on the ACF-199 report. BDO noted that the approved hours for Week 1 in CATCH appear to be incorrect but the reported hours for the month appear to be correct. • For one (1) instance, the hours reported for one week did not agree with the hours on the approved hardcopy timesheet. As a result of the variance in the hours for that week, the hours reported did not agree with the recalculated hours, and the required hours were not met. The information tested in our sample represents the underlying data used in Reporting for the 1st and 4th quarters of fiscal year 2025. Consequently, DHS incorrectly reported data in the ACF-199 report for the 1st and 4th quarters of fiscal year 2025. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Data within the ACF-199 report may not be complete and accurate. Specifically, if the work participation data is not substantiated, or inconsistencies are noted, it may result in inaccurate data being reported and may lead to an incorrect ACF-199 report and could result in an incorrect allocation of Federal Funds to the state. Cause – Controls are not operating effectively over the documentation of work participation data to ensure that adequate evidence of the work participation is maintained. Recommendation - We recommend that DHS enforce existing policies and procedures and implement additional controls to ensure that adequate documentation is maintained to substantiate the work participation data reported in the ACF-199 report in accordance with the District of Columbia Work Verification Plan. We also recommend that DHS implement policies, procedures and controls that will enable an accurate reconciliation between the data sources used in the preparation of the ACF-199 report to ensure proper reporting of data elements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS agrees with the findings and will work with the DC Access System (DCAS) and Division of Innovation and Change Management (DICM) teams to mitigate the causes of the findings. These findings are mostly residual issues with the tables in DHS/ESA DCAS system. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-018 Prior Year Finding Number: 2024-019 Compliance Requirement: Special Tests and Provisions – Child Support Non-Cooperation Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 264.30 (a) (1) The State agency must refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency (i.e., the IV-D agency). (2) Referred individuals must cooperate in establishing paternity and in establishing, modifying, or enforcing a support order with respect to the child. Per 45 CFR Section 264.30 (c) The IV-A agency must then take appropriate action by: (1) Deducting from the assistance that would otherwise be provided to the family of the individual an amount equal to not less than 25 percent of the amount of such assistance; or (2) Denying the family any assistance under the program. Per the Code of the District of Columbia - Section 4–205.55. (a) The Mayor shall give timely and adequate notice in cases of intended action to discontinue, withhold, terminate, suspend, reduce assistance, or make assistance subject to additional conditions, or to change the manner or form of payment to a protective, vendor, or 2-party payment. (1) “Timely” means that the notice is postmarked at least 15 days before the date upon which the action would become effective, except as provided in Section 4-205.54(d). (2) “Adequate” means that the written notice includes a statement of what action the Mayor intends to take, the reasons for the intended action, the specific law and regulations supporting the action, an explanation of the individual’s right to request a hearing, and the circumstances under which assistance will be continued if a hearing is requested. Condition – During our compliance test work for the Special Tests and Provisions – Child Support Non-Cooperation compliance requirement, we tested sixty (60) out of a population of 534 child support cases referred by the Child Support Enforcement Division (CSED) within the DC Office of the Attorney General to the TANF program as having not cooperated with Child Support. We noted the following: • For ten (10) cases, we reviewed the customer's file noting that the customer was not sanctioned although requested by the DC Office of the Attorney General. We reviewed the customer's file and noted insufficient documentation explaining why customer was not sanctioned. DHS was unable to provide support to explain why the individual was not sanctioned. • For two (2) cases, we reviewed the District of Columbia Access System (DCAS) noting the amount the customer was sanctioned was 25% of the eligible amount. However, the letter sent to the customer in September 2025 did not reflect the upcoming Cost of Living Adjustment for the period starting October 2025; therefore, the benefit amount that was included in the letter was incorrect. • For one (1) case, we reviewed DCAS noting the amount the customer was sanctioned was 25% of the eligible amount. However, the letter sent to the customer did not reflect the correct sanction amount. • For one (1) case, we reviewed the sanction letter in DCAS noting that the action taken was accurate but not timely, by comparing the date the notice was printed and the date the sanction was effective to the Case Action Date submitted by CSED. We noted that the customer was sanctioned as requested by the DC Office of the Attorney General, but DHS - ESA was unable to locate documentation to explain why the customer was not sanctioned for the month of May 2025. The sanction started in June 2025. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support not imposing sanctions to individuals may result to noncompliance with TANF Child Support Non-Cooperation compliance requirements. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation supporting compliance with TANF Child Support Non-Cooperation compliance requirements. Recommendation - We recommend that DHS strengthen its existing policies and procedures over enforcement of sanctions and maintenance of appropriate documentation to ensure compliance with TANF Child Support Non-Cooperation compliance requirements. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS/ESA agree with the auditor’s findings regarding the lack of completion of requests from the Child Support Enforcement (CSE) to the TANF program to impose a child support on parents who have not cooperated with child support compliance requirements. The incomplete work was due to staff transitions occurring during the review period which impacted the oversight and productivity of DHS/ESA staff working on the child support sanction process. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-019 Prior Year Finding Number: 2024-020 Compliance Requirement: Special Tests and Provisions – Penalty for Refusal to Work Program: U.S. Department of Health and Human Services Temporary Assistance for Needy Families (TANF) ALN: 93.558 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 45 CFR Section 261.14 (a) and (b) “(a) If an individual refuses to engage in work required under section 407 of the Act, the State must reduce or terminate the amount of assistance payable to the family, subject to any good cause or other exceptions the State may establish. Such a reduction is governed by the provisions of Section 261.16. The State must, at a minimum, reduce the amount of assistance otherwise payable to the family pro rata with respect to any period during the month in which the individual refuses to work. The State may impose a greater reduction, including terminating assistance.” Condition – During our testing of Special Tests and Provisions – Penalty for Refusal to Work, we selected a sample of sixty (60) cases in fiscal year 2025 to test DHS’ compliance with specified requirements. Total population is comprised of 5,911 case numbers for individuals that received payments for months where they did not meet the work requirements. We noted that a customer must have four weeks of noncompliance, mandated communication from the TANF Employment and Education Program provider, and be given at least 15 days’ notice before a sanction could be imposed. Total dollar amount is $27,545,791. We noted the following: • For one (1) instance, there were no hours reported in CATCH for October 2024 through June 2025 and August to September 2025. Per review of DCAS the customer had hours recorded for July 2025 only. However, there was no sanction for this customer in DCAS for December 2024 to June 2025 and October 2025 going forward for the hours not worked in August to September 2025. DHS indicated that no action was taken after Sanction flag. DHS was unable to provide support to explain why the customer was not sanctioned. • For one (1) instance, there were no hours reported in CATCH for May 2025 through July 2025. Per review of DCAS there was no documentation to explain why there was no sanction for the month of July 2025. DHS was unable to provide support to explain why the customer was not sanctioned. • For one (1) instance, there were no hours reported in CATCH for February to April 2025 and no sanction imposed in April 2025. Per response from DHS-ESA/OPM "Customer was assigned to CATCH 3.0 (JP)". However, DHS was unable to provide support to explain why the customer was not sanctioned. Total payments made to these three (3) individuals during the periods in question was $25,151. Questioned Costs – Not determinable. Context – This is a condition identified per review of DHS’ compliance with specified requirements using a statistically valid sample. Effect – Without properly maintaining documentation to support exemptions or justifications for not imposing sanctions to individuals, individuals may be given full benefits instead of reduced federal benefits under the TANF program. In addition, miscoding of hours or amounts paid may result to providing inappropriate benefits to individuals. Cause – DHS did not consistently adhere to its established policies and procedures requiring it to maintain documentation to support exemptions or justifications for individuals who refuse to fulfill the minimum working requirements to receive or maintain benefits under the TANF program. In addition, controls are not operating effectively over the supervisory review of transactions posted in DCAS to ensure accuracy. Recommendation - We recommend that DHS enforce existing policies and procedures over review and maintenance of appropriate documentation to ensure compliance with Penalty for Refusal to Work compliance requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DHS agrees with the findings and will work within the Division of Customer Workforce Employment and Training (DCWET) team to mitigate the causes of the findings. These findings are mostly caused by inconsistency of caseload management practices. Another mitigating factor is attributable to glitches in information technology around the sanction process. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-020 Prior Year Finding Number: 2024-023 Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per 2 CFR Section 200.405, a cost is allocable to a Federal award if it is assignable to that award in accordance with the relative benefits received. In addition, under 2 CFR Section 200.403, allowable costs must be adequately documented. Per 2 CFR Section 200.430, charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated, and must be incorporated into the official records of the recipient or subrecipient. The regulation also allows certain alternative approaches when properly documented and approved by the appropriate Federal agency or cognizant agency, as applicable. Based on CFSA’s Human Resources Administration Issuance: HR-06-1 dated May 12, 2006, staff must seek and receive advance written approval prior to working overtime. It also indicates that in emergency situations requiring an immediate response, the employee shall make every reasonable attempt to obtain advance approval by an appropriate manager or supervisor. Per District Personnel Issuance No. 2018-00 (Annual Leave) effective April 21, 2018 “Using Annual Leave” - An employee may use accrued annual leave at any time during the leave year if they receive approval from their immediate supervisor or the agency head responsible for the employee’s timesheet. If an employee wishes to use their accrued annual leave, they must: 1. Submit a request in advance to use annual leave to their manager or supervisor. 2. Receive approval from the manager or supervisor; and 3. Record the approved leave taken on their timesheet in PeopleSoft. Per CFSA’s guidelines dated May 15, 2021, employees must file a written request within agency’s prescribed time limits to use sick leave. Employees should consult their agency for specific guidelines on how to request sick leave. If no specific guidelines exist, employees should submit their leave requests through PeopleSoft. For doctor’s appointment, employees must make sick leave requests at least 24 hours in advance for medical, dental, or eye examinations or treatments. Employees should also be prepared to submit supporting evidence of the appointment according to their agency’s policy. CFSA uses a Random Moment Study (RMS) to allocate the administrative costs to the Foster Care program. The study entails selecting a sample of social workers on a quarterly basis to participate in the RMS study where the social workers are required to notate what they were doing at the sample moment. Subsequently, the supervisors of these social workers review and validate their responses. Validation of the responses adds an extra layer of reliability to the data collected. It ensures that the information provided by social workers is accurate and reflective of their actual activities. This validation process helps maintain the integrity of the study and ensures that the results are trustworthy in making decisions when determining the RMS percentage utilization in the allocation of the administrative costs. Condition – The following issues were observed: 1. During our review of the Activities Allowed or Unallowed and Allowable Costs/Cost Principles, we noted that CFSA was unable to provide sufficient supporting documentation to substantiate the allocation methodology for three (3) of the sixty (60) non-payroll expenditure samples selected for testing. 2. During our review of the payroll process regarding the review and approval of time and attendance, we noted the following in our sample of sixty (60) payroll items: • For two (2) samples, CFSA failed to provide documentation evidencing the approval of overtime paid. • For thirteen (13) samples, CFSA failed to provide documentation evidencing the approval of scheduled sick leave and annual leave taken. In addition one (1) of the thirteen (13) samples was coded as scheduled sick leave; however, per documentation provided, it was indicated that the timesheet should have coded the time as military leave. BDO did not receive documentation showing approval for either military leave or scheduled sick leave. • For two (2) samples, the employee's response to the RMS moment sample was not validated by the supervisor. Questioned Costs – Not determinable. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – Without sufficient documentation to support the cost allocation methodology, CFSA cannot demonstrate that costs charged to the Foster Care program were allowable and properly allocated, increasing the risk of unallowable costs being charged to the federal award. Additionally, without adequate internal controls and procedures for record maintenance, there is a risk of disputes between the agency and its employees regarding the accuracy of pay, leave and overtime. Furthermore, supervisor validation was not completed and documented for two of the moments selected for testing. Although CFSA’s control of over-assigning moments mitigates the risk of not meeting the aggregate 10% validation requirement, the two deviations noted reduce assurance that the 10% validation requirement was met. Cause – CFSA did not have proper internal controls and policies and procedures in place to ensure that documentation supporting the cost allocation methodology was retained and readily available for review. Additionally, CFSA did not have proper internal controls and policies and procedures in place to ensure that authorization forms evidencing the preapproval of overtime, scheduled sick leave and annual leave were maintained. Furthermore, although CFSA maintains an established validation process, supervisor validation was not completed for two of the moments selected for testing. Recommendation - We recommend that CFSA strengthen its policies, procedures, and controls to ensure that costs are accurately reported and claimed, and that documentation supporting the cost allocation methodology is maintained and readily available to substantiate the amounts allocated to the Foster Care program. We also recommend that pre-authorization of overtime, scheduled sick leave and annual leave is maintained. Furthermore, we recommend that CFSA ensure that the validation control is consistently performed for all moments selected for validation. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with the findings of Condition 1 and Condition 2. For Condition 1, although CFSA provided documents (including invoices) requested by and provided by the Office of the Chief Information Officer (OCTO) for the sampled items referenced, OCTO was unable to provide the specific documentation requested by the auditors documenting the allocation methodology of the expenditures assigned to CFSA and used for Title IV-E claiming purposes. For Condition 2, bullet 3, CFSA would simply note that, as is denoted in our federally approved cost allocation plan, CFSA adheres to HHS’ requirements for statistical significance in its entire RMS operation. The standard for supervisor validation of random moments is 10% of all accepted moments. CFSA’s internal controls involve oversampling moments requiring validation, and it consistently hits the 10% validation requirement in the aggregate. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-021 Prior Year Finding Number: 2024-024 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 29 CFR Section 97.20(b)(2), Accounting records. “Grantees and sub grantees must maintain records which adequately identify the source and application of funds provided for financially assisted activities. These records must contain information pertaining to grant or subgrant awards and authorizations, obligations, unobligated balances, assets, liabilities, outlays or expenditures, and income.” Per 45 CFR Section 1356.30(b), “The Title IV-E agency may not approve or license any prospective foster or adoptive parent, nor may the Title IV-E agency claim Federal Financial Participation (FFP) for any foster care maintenance or adoption assistance payment made on behalf of a child placed in a foster home operated under the auspices of a child placing agency or on behalf of a child placed in an adoptive home through a private adoption agency, if the Title IV-E agency finds that, based on a criminal records check conducted in accordance with paragraph (a) of this section, a court of competent jurisdiction has determined that the prospective foster or adoptive parent has been convicted of a felony involving: (1) Child abuse or neglect; (2) Spousal abuse; (3) A crime against a child or children (including child pornography); or, (4) A crime involving violence, including rape, sexual assault, or homicide, but not including other physical assault or battery.” Per 45 CFR Section 1356.30(f), "In order for a childcare institution to be eligible for Title IV-E funding, the licensing file for the institution must contain documentation which verifies that safety considerations with respect to the staff of the institution have been addressed.” Furthermore, per 45 CFR Section 1356.21(a), “Statutory and regulatory requirements of the Federal foster care program, To implement the foster care maintenance payments program provisions of the Title IV-E plan and to be eligible to receive FFP for foster care maintenance payments under this part, a Title IV-E agency must meet the requirements of this section, 45 CFR 1356.22, 45 CFR 1356.30, and Parts 472, 475(1), 475(4), 475(5), 475(6).” Per CFSA policy 6008.1, “As part of the home study process, an agency shall ensure that each applicant and any other person eighteen (18) years of age or older residing in the home comply with the requirements for a criminal records check established by the Adoption and Safe Families Amendment Act of 2000, effective June 27, 2000, D.C. Law 13-136.” Condition – For the fiscal year 2025, the Foster Care program had total disbursements of $3,094,192 for 3,280 maintenance payments. We selected a sample of sixty (60) participants representing disbursed federal funds totaling $60,436 and noted the following deficiencies: • For one (1) of sixty (60) samples, CFSA was unable to provide valid provider license as required by CFR 1356.30 (b). • For two (2) of sixty (60) samples, CFSA did not provide a copy of the registry check which is part of the criminal records check required by CFSA policy 6008.1. • For two (2) of sixty (60) samples, CFSA did not provide background checks such as criminal record checks and fingerprint-based checks from the national crime information databases or check registry for all adults in the household as required by the District as detailed in CFSA policy 6008.1. These deficiencies represent 1% of the total disbursements tested. Questioned Costs – Known amount is $825. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – CFSA was not in compliance with the eligibility requirements of the Foster Care program. Cause – CFSA does not have adequate controls in place to ensure that the required eligibility documentation is maintained to evidence compliance with eligibility requirements. Recommendation - We recommend CFSA reevaluate and strengthen its existing policies and procedures over the review and maintenance of appropriate documentation to ensure compliance with eligibility requirements in accordance with the program. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with the finding. CFSA notes that bullets 2 and 3 of the condition are federal “State Plan” and local regulatory requirements (respectively) and therefore are not subject to questioned costs. Bullet 1 involved a IV-E payment made to a provider with a lapsed license. It was processed through CFSA’s previous management information system, FACES. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-022 Prior Year Finding Number: 2024-026 Compliance Requirement: Special Tests and Provisions – Payment Rate Setting and Application Program: U.S. Department of Health and Human Services Foster Care – Title IV-E ALN: 93.658 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Child and Family Services Agency (CFSA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Per CFSA’s internal policies and procedures, providers must submit quarterly reports within 45 days of the end of each Federal fiscal year quarter. Upon receipt of quarterly reports from the provider, the Business Services Administration Program Manager reviews each Expenditure Detail Spreadsheet for compliance, accuracy and reasonableness. Condition – Our assessment of the special tests and provisions requirement revealed that while the selected providers’ quarterly reports displayed no deficiencies, CFSA was unable to provide documentation evidencing the review and approval of the quarterly reports relating to all sixty (60) transactions that were tested. Questioned Costs – Not determinable. Context – This is a condition identified per review of CFSA’s compliance with specified requirements using a statistically valid sample. Effect – The absence of documentation specifying who reviews and approves the quarterly reports compromises accountability and creates ambiguity in identifying the responsible parties in instances of errors or discrepancies. Cause – CFSA does not have adequate controls in place to ensure that review and approval of provider’s quarterly reports are documented. Recommendation - We recommend CFSA strengthen its policies and procedures to address the review and approval process for the provider’s quarterly reports. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – CFSA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-023 Prior Year Finding Number: 2024-027 Compliance Requirement: Eligibility Program: U.S. Department of Health and Human Services Medicaid Cluster ALN: 93.775, 93.777, 93.778 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Department of Health Care Finance (DHCF)/Department of Human Services (DHS)/Economic Security Administration (ESA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Medicaid State Plan: Citation 42 CFR Section 431.17AT-79-29. Section 4.7 (Maintenance of Records) states, “The Medicaid agency maintains or supervises the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of medical assistance, and administrative costs and statistical, fiscal and other records necessary for reporting and accountability, and retains these records in accordance with Federal requirements. All requirements of 42 CFR 431.17 are met.” Economic Security Administration (ESA) Policy Manual, Section 1.3, “All eligibility criteria and clarifying information are documented on the Record of Case Action, form 1052. The case record should speak for itself. An outside reviewer shall be able to follow the chronology of events in the case be reading the narrative. All application documents including verification and correspondence must be date-stamped. For working recipients, the record should include the dates pay is received and how often the recipient is paid. When the recipient’s statement is the best available source, the record should include the application/recipient and agency efforts to verify the information. All address changes should be documented.” In accordance with 42 CFR Section 435.912(c)(3), Timeliness and performance standard requirements - Standard for new applications and transferred accounts. Except as provided in paragraph (e) of this section, the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed — (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 CFR Section 435.912 (c)(4) Standard for renewals. The redetermination of eligibility at a beneficiary's regularly scheduled renewal may not exceed the end of the beneficiary's eligibility period, except as provided in paragraphs (e) and (c)(4)(i) and (ii) of this section. (i) In the case of a beneficiary who returns a renewal form less than 30 calendar days prior to the end of the beneficiary's eligibility period, the redetermination of eligibility may not exceed the end of the month following the end of the beneficiary's eligibility period. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed— (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. 42 CFR Section 435.912 (c)(5) Standard for redeterminations based on changes in circumstances. Except as provided in paragraph (e) of this section, the redetermination of eligibility for a beneficiary based on a change in circumstances reported by the beneficiary or received from a third party may not exceed the end of the month that occurs — (i) 30 calendar days following the agency's receipt of information related to the change in circumstances, unless the agency needs to request additional information from the beneficiary; (ii) 60 calendar days following the agency's receipt of information related to the change in circumstances if the agency must request additional information from the beneficiary; or (iii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis — (A) 90 calendar days following the determination of ineligibility on the current basis, for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days following the determination of ineligibility on the current basis for all other beneficiaries. 42 CFR Section 435.912 (c)(6) Standard for redeterminations based on anticipated changes. The redetermination of eligibility for a beneficiary based on an anticipated change in circumstances may not exceed the end of the month in which the anticipated change occurs, except as provided in paragraphs (e) and (c)(6)(i) and (ii) of this section. (i) In the case of a beneficiary who returns information or documentation requested pursuant to Section 435.919(b)(6) less than 30 calendar days prior to the end of the month in which the anticipated change occurs, the redetermination of eligibility may not exceed the end of the month following the month in which the anticipated change occurs. (ii) In the case of a beneficiary who is determined ineligible on the basis for which they are currently receiving Medicaid (the applicable modified adjusted gross income standard described in Section 435.911(b)(1) and (2) or another basis) and for whom the agency is considering eligibility on another basis, the eligibility determination on the new basis may not exceed — (A) 90 calendar days for beneficiaries whose eligibility is being determined on the basis of disability; and (B) 45 calendar days for all other beneficiaries. Condition – During testing over beneficiary eligibility for the Medicaid benefits, we noted that the District’s Economic Security Administration (ESA) was unable to provide sufficient documentation to support the beneficiary’s eligibility determination during the fiscal year 2025 audit. Specifically, out of a sample of 132 participant files tested, we noted the following exceptions: • For four (4) participant files, ESA did not process the application within the required timeframe. The Department of Health Care Finance, as the State Medicaid Agency, lacks a quality control oversight system to ensure that eligibility documentation and verification is maintained to support the eligibility decision. Questioned Costs – Not determinable. Context – This is a condition identified per review of ESA’s compliance with specified requirements using a statistically valid sample. Effect – Lack of supporting documentation for program services and noncompliance with program requirements could result in disallowances of costs and participants could be receiving benefits that they are not entitled to receive under the program. Cause – DHCF and ESA did not appear to adhere to internal control procedures to ensure that applications are properly processed in accordance with Federal Regulations. Recommendation - We recommend that ESA strictly implement internal control procedures to ensure that documentation is maintained to support the beneficiary determinations. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – ESA concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-024 Prior Year Finding Number: 2024-030 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Years: 09/30/2022 – 09/29/2025 09/30/2024 – 09/29/2027 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal Funding Accountability and Transparency Act (FFATA) Reporting Compliance: In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025, onwards. FFATA reports are submitted no later than the month following the month in which this Federal award is made, and annually after that. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, 2 CFR Section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – During our testing of the reporting compliance requirement, we noted the following: • FFATA Reporting Compliance: During our testing of FFATA reporting, it was noted that reports were submitted late by the DBH program management due to staffing shortage. The FFATA reporting for all nine subawards selected for testing was submitted late, i.e., beyond the deadline of within 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: During our testing of the SEFA, we noted that DBH incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2025, DBH incurred $12.4 million in subrecipient expenditures for this program and incorrectly reported $11.7 million subrecipient expenditures on the preliminary SEFA. While the subrecipient expenditure amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with specified reporting requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure timely reporting and that correct amounts were reported and were properly reviewed as it relates to the Opioid STR program: • FFATA Reporting Compliance: Failure to submit FFATA reports within the deadline of 30 days of the subaward or subaward modification date results in noncompliance for the DBH program. • SEFA Reporting Compliance: The effect of the condition is that the SEFA was not accurately prepared. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that FFATA reports were submitted timely and the amounts on the SEFA were properly reported. Recommendation – We recommend the following: • FFATA Reporting Compliance: We recommend DBH to strengthen its internal control and procedures to ensure submission of FFATA reports within the deadline of 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: We recommend DBH to ensure that agency personnel receive proper training on subrecipient versus vendor determination; as well as review existing policies and procedures for preparing the SEFA to ensure that it is complete and accurate. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-025 Prior Year Finding Number: N/A Compliance Requirement: Special Tests and Provisions – Key Employees Program: U.S. Department of Health and Human Services Opioid STR ALN: 93.788 Award #: Various Award Years: 09/30/2022 – 09/29/2025 09/30/2024 – 09/29/2027 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.508(d) says an auditee must “provide the auditor with access to personnel, accounts, books, records, supporting documentation, and other information as needed for the auditor to perform the audit required by this part.” The grant agreements provide that the State must maintain certain key personnel. Key personnel are organization staff members or consultants/subrecipients who must be part of the project regardless of whether they receive a salary or compensation from the project. These individuals must make a substantial contribution to the execution of the project. Key personnel for this program are the Project Director, Project Coordinator, and Data Coordinator. The Project Director, Project Coordinator, and Data Coordinator cannot be the same person. No more than two people can share a position. The Project Director is responsible for oversight of the entire project, including overseeing, monitoring, and managing the award, with a level of effort of 100% (1.0 FTE). The Project Coordinator is responsible for the day-to-day operations of the project, with a level of effort of 100% (1.0 FTE). The Data Coordinator is responsible for all aspects of data collection and reporting, ensuring complete, accurate, and timely data entry into SPARS and/or other data systems as directed by SAMHSA. The Data Coordinator is also responsible for monitoring client-level intake and follow-up rates, to ensure that recipients are meeting the target numbers reported in the application. The level of effort is 100% (1.0 FTE) for all awards $4 million and above, and 50% (0.5 FTE) for all awards less than $4 million. Any changes to key personnel, including level of effort involving separation from the project for more than three months or a 25 percent reduction in time dedicated to the project, requires prior approval, and must be submitted as a post-award amendment. Condition – During our testing of the key personnel requirement, we noted that for all four (4) samples selected for testing, we were unable to obtain and review documentation to support that the key personnel met the level of effort on the awards as required by the grant agreement. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with specified requirements using a statistically valid sample. Effect – There is a risk that employees are working on the program that are not approved by the granting agency. Cause – Management has not established internal control policies and procedures to ensure that key personnel met the level of effort on the awards as required by the grant agreement. Recommendation – We recommend that DBH develop and implement policies, procedures and controls to ensure proper documentation of the required and actual time and effort from key personnel in accordance with grant requirements. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – DBH agrees with the findings and will put controls into place to resolve the issues. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-026 Prior Year Finding Number: 2024-036 Compliance Requirement: Reporting Program: U.S. Department of Health and Human Services Block Grants for Substance Use Prevention, Treatment, and Recovery Services ALN: 93.959 Award #: Various Award Years: 10/01/2022 – 09/30/2025; 09/01/2021 – 09/30/2025; 03/15/2021 – 03/14/2025 Government Department/Agency: Department of Behavioral Health (DBH) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal Funding Accountability and Transparency Act (FFATA) Reporting Compliance: In accordance with 2 CFR Part 170, Appendix A, under the Federal Funding Accountability and Transparency Act (FFATA), the department is required to collect and report information on each subaward or amendment of $30,000 or more in federal funds in the FFATA Subaward Reporting System (FSRS) or System for Award Management (sam.gov) website from March 8, 2025, onwards. FFATA reports are submitted no later than the month following the month in which this Federal award is made, and annually after that. In accordance with the requirements of 2 CFR Section 1402.300(b), the non-Federal entity is responsible for complying with all requirements of the Federal award. For all Federal awards, this includes the provisions of FFATA, which includes requirements on executive compensation, and also requirements implementing the Act for the non-Federal entity at 2 CFR Part 25 Financial Assistance Use of Universal Identifier and System for Award Management and 2 CFR Part 170 Reporting Subaward and Executive Compensation Information. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, 2 CFR Section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – During our testing of the reporting compliance requirement, we noted the following: • FFATA Reporting Compliance: During our testing of FFATA reporting, it was noted that reports were submitted late by the DBH program management due to staffing shortage. The FFATA reporting for all four subawards selected for testing was submitted late, i.e., beyond the deadline of within 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: During our testing of the SEFA, we noted that DBH incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2025, DBH incurred $1.2 million in subrecipient expenditures for this program and incorrectly reported $1.4 million subrecipient expenditures on the preliminary SEFA. While the subrecipient expenditure amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of DBH’s compliance with specified reporting requirements using a statistically valid sample. Effect – Without proper internal controls and policies and procedures in place to ensure timely reporting and that correct amounts were reported and were properly reviewed as it relates to the Block Grants for Substance Use Prevention, Treatment, and Recovery Services program: • FFATA Reporting Compliance: Failure to submit FFATA reports within the deadline of 30 days of the subaward or subaward modification date results in noncompliance for the DBH program. • SEFA Reporting Compliance: The effect of the condition is that the SEFA was not accurately prepared. Cause – Management did not have proper internal controls and policies and procedures in place to ensure that FFATA reports were submitted timely and the amounts on the SEFA were properly reported. Recommendation – We recommend the following: • FFATA Reporting Compliance: We recommend DBH to strengthen its internal control and procedures to ensure submission of FFATA reports within the deadline of 30 days of the subaward or subaward modification date. • SEFA Reporting Compliance: We recommend DBH to ensure that agency personnel receive proper training on subrecipient versus vendor determination; as well as review existing policies and procedures for preparing the SEFA to ensure that it is complete and accurate. Related Noncompliance – Noncompliance. Views of Responsible Officials and Planned Corrective Actions – The DBH Office of the Chief Financial Officer (OCFO) concurs with this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.

Finding Number: 2025-027 Prior Year Finding Number: N/A Compliance Requirement: Reporting Program: U.S. Department of Homeland Security COVID-19 – Disaster Grants - Public Assistance (Presidentially Declared Disasters) ALN: 97.036 Award #: Various Award Year: 10/01/2024 – 09/30/2025 Government Department/Agency: Homeland Security and Emergency Management Agency (HSEMA) Criteria - The Uniform Guidance in 2 CFR Section 200.303 requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Uniform Guidance in 2 CFR Section 200.302(a), Financial Management, states that each state must expend and account for the federal award in accordance with state laws and procedures for expending and accounting for the state’s own funds. In addition, the state’s and the other non-federal entity’s financial management systems, including records documenting compliance with federal statutes, regulations, and the terms and conditions of the federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the federal statutes, regulations, and the terms and conditions of the federal award. Schedule of Expenditures of Federal Awards (SEFA) Reporting Compliance: Requirements, Cost Principles, and Audit Requirements, 2 CFR Section 200.510(b) states the auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. Condition – During our testing of federal reporting and the Schedule of Expenditures of Federal Awards (SEFA), we noted that the cumulative federal expenditures reported on two (2) quarterly Federal Financial Report (SF-425) did not reconcile the total expenditures claimed on the SEFA for the life of the award. Specifically, the SF-425 submitted for the period ended September 30, 2025 reported a cumulative total of approximately $924 million, whereas the SEFA recorded lifetime expenditures of approximately $1.051 billion, resulting in an unreconciled variance of approximately $127 million. Additionally, during our testing of the SEFA, we noted that HSEMA incorrectly reported the value of subrecipient expenditures included within the subrecipient expenditure column. For the year ended September 30, 2025, HSEMA had a negative $0.7 million in subrecipient expenditures for this program and incorrectly reported $37.9 million subrecipient expenditures on the preliminary SEFA. While the subrecipient expenditure amount was not accurate, the total expenditures amount was accurately reported. The error in the subrecipient expenditures amount was subsequently identified and corrected as a result of the audit process. Questioned Costs – None. Context – This is a condition identified per review of HSEMA’s compliance with reporting requirements. Effect – Failure to properly review and present expenditures can result in noncompliance with reporting requirements. Cause – HSEMA did not comply with their policies and procedures to ensure accuracy of the SEFA and other reports necessary to meet compliance requirements. Recommendation – We recommend that HSEMA adheres to instituted policies and procedures to ensure the accuracy of the SF-425 and the SEFA. Related Noncompliance – Material noncompliance. Views of Responsible Officials and Planned Corrective Actions – HSEMA agrees with the conditions and recommendations of this finding. The District’s corrective action is described in the Management’s Corrective Action Plan included as Appendix B of the attached Management’s Section.