Audit 408197

STATEWIDE COST ALLOCATION PLAN Federal Cognizant Agency: U.S. Department of Health and Human Services (HHS) State Fiscal Year: 2025 Federal Award Number: Not Applicable Administered by: Rhode Island Department of Administration (DOA), Office of Accounts and Control (OAC) Compliance Requirement: Allowable Costs/Cost Principles DOCUMENTATION OF FUNDING MECHANISMS WITHIN THE STATEWIDE COST ALLOCATION PLAN Documentation of the funding mechanism for grants management services within the Statewide Cost Allocation Plan can be improved. Criteria: Consistent with Uniform Guidance cost principles, allocated centralized costs to federal programs are required to be included in the State’s statewide cost allocation plan (SWCAP). This plan is submitted annually for approval by the State’s federal cognizant agency, the U.S. Department of Health and Human Services. The SWCAP agreement includes the approval of billed costs, charges for services that are billed in accordance with rates established by the State and approved by the federal government as part of the SWCAP agreement. Condition: While the costs for statewide grants management services appear to be included in the allocated cost section of the SWCAP, the State is allocating those costs to federal programs based on a “billed” methodology. The methodology for these services assesses departments and agencies based on a two-tiered calculation: first, a per license fee for users of the State’s grants management system, and secondly, an assessment to cover other grants management unit costs applied to the respective departments based on a proportionate share of total federal expenditures, excluding certain programs. We were unable to determine whether the mechanism used to assess the costs related to statewide grants management services across departments and agencies during fiscal 2025 was in accordance with the most recently approved statewide cost allocation plan (fiscal 2023). Cause: The State did not include the grants management services as part of its billed costs in the most recent federally approved SWCAP agreement. Effect: Centralized costs were allocated to several federal programs without an approved cost allocation methodology required by the Uniform Guidance. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-030a Submit cost allocation methodology for grants management services allocated to federal programs as part of billed costs in the statewide cost allocation plan. 2025-030b Ensure revised cost allocation methodology is also submitted for prior fiscal years in which the grants management services were assessed as billed costs.

SNAP CLUSTER – 10.551, 10.561 Federal Awarding Agency: U.S. Department of Agriculture (USDA); Food and Nutrition Service (FNS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 244RI405S2514; 254RI405S2514 Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – EBT Reconciliation SNAP EBT RECONCILIATIONS Controls over SNAP EBT reconciliations require improvement. Criteria: Federal regulations require agencies participating in the Supplemental Nutrition Assistance Program (SNAP) to maintain accurate and complete records of program transactions. 7 CFR §274.4(a) requires that agencies perform reconciliations to ensure that benefit issuance and redemption records are accurate and agree with agency accounting records. Reconciliations must promptly investigate and resolve discrepancies, undergo supervisory or independent review, and include sufficient documentation to demonstrate compliance with federal requirements and the proper management and safeguarding of federal funds. Condition: The agency’s Electronic Benefits Transfer (EBT) reconciliations contained formulaic errors that resulted in misstatements of balances. In addition, unreconciled balances were carried forward from prior days without sufficient investigation or resolution. The agency failed to prepare reconciliations for funds remaining in the system, and supervisory review of these reconciliations was not conducted. Cause: Staff responsible for reconciliations did not consistently apply proper procedures and processes were not adequate to ensure discrepancies were resolved and documented in a timely manner. Formal review procedures were not established. Effect: Potential for discrepancies indicative of overpayments or duplicative benefit issuances going undetected by management. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-031a Implement procedures to ensure EBT reconciliations are accurate and calculations are verified. 2025-031b Investigate and resolve all unreconciled balances promptly. 2025-031c Establish formal supervisory review process and documentation of review.

UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Rhode Island Department of Labor and Training (DLT) Compliance Requirement: Eligibility CONTROLS OVER UNEMPLOYMENT INSURANCE BENEFIT PAYMENTS Controls to evaluate applicant work search requirements needs to be improved to detect noncompliance. Background: Individuals applying for unemployment benefits must comply with certain eligibility requirements to qualify for and maintain benefits through the program. States need to rely on systems and technology to administer unemployment insurance (UI) programs and ensure that individuals meet the various program requirements to receive benefits. The current system used by DLT to process UI benefits utilizes outdated technology. This legacy system is mainframe-based and has reached end of life with a need for replacement. The State utilizes a “cloud-based” front-end application as the user interface for administering UI benefit applications and to validate applicant identity and prevent program fraud. Upon application completion, required applicant data flows to the UI legacy system for benefit administration. The legacy benefit administration and payment system lacks the integration and controls inherent in modernized unemployment insurance systems and represents a risk to business continuity. During fiscal year 2025, benefit payments exceeded $228 million. DLT maintains a BAM program as required by federal regulations as a quality control system designed to assess the accuracy of UI benefit payments and denied claims. Using a statistical sampling model, the program estimates error rates (i.e., number of claims improperly paid or denied, and the dollar amounts of benefits improperly paid or denied) by projecting the results from payment and denial reviews. Criteria: Management is responsible for establishing and maintaining effective internal controls to process and disburse unemployment insurance benefits consistent with State and federal program requirements. The structure of the federal-state UI program partnership is based on federal statute (20 CFR Chapter V); however, it is implemented through state law. State responsibilities include: (1) establishing specific, detailed policies and operating procedures which comply with the requirements of federal laws and regulations; (2) determining the state UI tax structure; (3) collecting state UI contributions from employers (commonly called “unemployment taxes”); (4) determining claimant eligibility and disqualification provisions; (5) making payment of UI benefits to claimants; (6) managing the program’s revenue and benefit administrative functions; (7) administering the programs in accordance with established policies and procedures; and (8) enacting state unemployment compensation (UC) law that conforms with federal UC law and that state law and operations substantially comply with federal law. State UI regulations (RI Code of Regulations) specific to our findings on eligibility include the following: • Title 260, Chapter 40, Income Support, Subchapter 05 – Unemployment and Temporary Disability Insurance, Section 1.18(F) – “Every claimant shall make such personal efforts to find suitable work as are customarily made by persons in the same occupation or in any other occupation for which the claimant is reasonably suited, commensurate with current economic conditions. These efforts include but are not limited to: 1) Registering for work with the EmployRI, 2) Conducting an active, independent work search with at least three (3) work search contacts in each week that benefits are claimed and maintain a written record of the work search, 3) Submitting a weekly work search to the department as prescribed by the director and as indicated in the Department of Labor and Training’s guidelines for an active and independent search for work, 4) Posting a résumé on the Employment Services’ online job seeker tool kit and inquiring upon any job opportunities presented by the department, 5) Completing a skills review or similar activity through Employment Service as prescribed by the Director, and 6) Registering on the Virtual Recruiter or similar tool through Employment Service as prescribed by the Director.” • Section 1.18 (G) – “The Director has discretion in determining whether to require one or all activities identified in §1.18(F)(4), (5), and (6) of this Part.” • Section 1.18 (M) – “An individual who fails to provide any documentation requested by the Department or fails to comply with an instruction given by the Director or his/her designee shall be denied benefits for the week(s) in which such failure occurs and until the individual complies unless the reason for such failure to comply with the Department’s requirements is based upon good cause as shall be determined by the Director.” Applicants that do not comply with program work search requirements should be referred to DLT’s Central Adjudication Unit. Condition: While our testing found that UI payments complied with most program eligibility requirements, noncompliance with certain requirements was noted. We tested a random sample of 60 individual benefit payments totaling $27,092 in fiscal 2025. As part of our testing, we evaluated applicant compliance with job search activities (e.g., résumé posting, completing a skills review, registering on the Virtual Recruiter or similar tool) required within UI policies and procedures. Our testing identified 1 exception in our sample of 60 (1.7%) that was not registered in the EmployRI system and determined to be noncompliant with program work search requirements (sample item - $610, questioned costs of benefits paid during fiscal 2025 totaled $9,760). Using the population of UI payments sampled, we project likely questioned costs to approximate $5.2 million. DLT indicated that the error resulted from the department’s failure of the automated EmployRI registration and not the applicant. From an audit perspective, the State’s lack of monitoring and ability to detect when this critical control is not performed is deemed a control weakness relating to eligibility. DLT does not mandate that other job search activities be completed in addition to the automatic applicant registration which was consistent with our test results. While meeting minimum compliance under the State’s work search requirements, the automated registration without applicant follow-up and use of the functionalities of EmployRI limits its benefits as a work search tool. In addition to the results above, DLT’s BAM program identified significant noncompliance with UI claimant job search requirements. DLT’s reported BAM program results for the State fiscal year 2025 reporting period cited noncompliance with work search activities in 32% of the cases reviewed. While DLT’s current policies and processes ensure material compliance with federal regulations regarding work search requirements, they could be enhanced to more effectively achieve the program objectives intended by the UI program. In conjunction with our testing, we noted a control deficiency relating to the documentation of Social Security Numbers for applicant dependents. In our sample, we noted one case where Social Security Numbers were not included in the UI system for reported dependents. Although DLT was subsequently able to provide documentation of Social Security Numbers for the dependents, the UI system lacks systemic controls to prevent benefit payments when Social Security Numbers are not reported in the case record. When documenting our understanding of certain State UI policies on file with the Secretary of State regarding work search requirements (e.g., submission of weekly work search, résumé posting requirements), we noted certain inconsistencies between those policies and the UI claimant guidance available on the DLT website. These discrepancies should be addressed to ensure guidance and policy are aligned. Beyond the above control considerations, DLT’s current mainframe system has reached end of life and poses significant business continuity risks to UI benefit operations. The State’s planning to modernize DLT’s systems is underway and should consider how enhanced and more integrated system controls over eligibility (including monitoring of work search activities) can be employed. Cause: The lack of integration between the current mainframe and other support applications (i.e., Onbase imaging and EmployRI systems) limits DLT’s ability to implement automated controls to enhance compliance with certain UI requirements. DLT does not have adequate controls in place to detect noncompliance with work search requirements (i.e., EmployRI registration). In addition, current processes are not reducing significant noncompliance rates with work search requirements cited by DLT’s BAM processes. Effect: UI benefits paid to individuals who did not comply with program eligibility requirements, specifically work search requirements. Questioned Costs: $9,760 Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-034a Implement compensating controls to identify noncompliance with UI eligibility requirements. 2025-034b Ensure that ongoing considerations for the modernization of the unemployment benefit program administration system maximize automated processes designed to enhance controls over eligibility requirements. 2025-034c Ensure that official State UI policies and procedures on file with the Secretary of State relating to work search requirements are consistent with UI claimant guidance available on DLT’s website.

UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Rhode Island Department of Labor and Training (DLT) Compliance Requirement: Special Tests and Provisions – UI Program Integrity - Overpayments UNEMPLOYMENT INSURANCE PROGRAM INTEGRITY – OVERPAYMENTS The Department of Labor and Training (DLT)’s UI system does not impose penalties on overpayments due to fraud as required by federal regulations. The system also does not prohibit relief from charges to an employer’s Unemployment Compensation (UC) account when the overpayment results from the employer’s failure to respond timely or adequately to a request for information. Criteria: Federal law provides that (1) States are required to impose a monetary penalty (not less than 15%) on claimants whose fraudulent acts resulted in overpayments and deposit the funds in the State’s account in the Unemployment Trust Fund, and (2) States are prohibited from providing relief from charges to an employer’s UC account when overpayments are the result of the employer’s failure to respond timely or adequately to a request for information. In compliance with federal law (42 USC §503(a)(11), State Laws), the State enacted these requirements into State law effective October 1, 2013, including a 15% penalty on overpayments due to claimant fraud (RIGL §28 42-62.1(a)(4)) and a prohibition on relieving the employer’s account of charges relating to any benefit overpayments made if the employer was at fault for failure to respond timely or adequately to a DLT request for information relating to the claim (RIGL §28-43-3(2)(viii)). Condition: During fiscal 2025, DLT was not properly identifying and handling overpayments due to system limitations, including, as applicable, assessing the 15% penalty on claimants who commit fraud, and not relieving an employer’s account of charges for overpayments when their untimely or inaccurate responses cause improper payments. Overpayments must be established and communicated to the recipient to initiate collection. We tested a random sample of 40 individuals with overpayments totaling $100,159. Of the 40 individuals tested, 9 were fraud claims totaling $20,987 with federally mandated (15%) penalties, (questioned costs $3,148). Using the population of existing 2025 overpayments, we project likely questioned costs to approximate $509,635. DLT is aware of the requirement and the need for programming modifications to its current system or planned modernization. Cause: DLT has not implemented the UI system programming required to impose penalties for overpayments due to fraud. DLT has no procedures currently in place to materially comply with federal regulations for program integrity overpayments. Effect: Material noncompliance with Federal and State laws as well as lost revenue on penalties not assessed. Questioned Costs: $3,148 Valid Statistical Sampling: Yes RECOMMENDATION 2025-035 Implement procedures to: (1) impose and collect a 15% penalty on benefit overpayments of claimants who commit fraud (RIGL §28-42-62.1(a)(4)) and (2) prohibit providing relief to an employer account when an overpayment is the result of the employer’s failure to respond timely or adequately to a request for information by the State agency (RIGL §28- 43-3(2)(viii)).

UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Rhode Island Department of Labor and Training (DLT) Compliance Requirement: Reporting UNEMPLOYMENT INSURANCE PROGRAM REPORTING The Department of Labor and Training (DLT) should improve internal controls over required Unemployment Insurance Program reports to ensure that the information is reported accurately and timely. Criteria: U.S. Department of Labor’s Employment and Training Administration (ETA) administers federal government job training and worker dislocation programs, federal grants to states for public employment service programs, and unemployment insurance benefits. Management is responsible for establishing and maintaining effective internal controls to produce and submit the following ETA reports in accordance with ETA’s requirements: • ETA 2112 – The report is due the 1st day of the second month following the month of reference and will be transmitted electronically. • ETA 9050, 9052, and 9055 – The reports are due to the ETA National Office on the 20th of the month following the month to which the data relates. This report will be transmitted electronically. • ETA 9130 – The report is due 45 days after the end of the quarter. • ETA 191 – The report will be transmitted electronically to the National Office by the 25th of the month following the close of the quarter. • ETA 2208A – The report is due 30 days after the end of the quarter. Condition: DLT’s internal control procedures were not sufficiently effective to ensure that ETA reports were submitted timely and that a documented secondary review was performed to ensure accuracy. DLT is responsible for submitting ETA reports monthly (ETA reports 2112, 9050, 9052, 9055) and quarterly (ETA reports 9130, 191, and 2208A). We tested a total of 22 submissions of the ETA reports. • 4 of 22 (18.2%) reports tested were submitted beyond the due date. • 17 of 22 (77.3%) reports tested were not signed by a manager/reviewer. • 1 of 22 (4.5%) reports tested was inaccurate. An ETA 9130 report overstated expenditures by $8,330. Cause: DLT has failed to segregate duties regarding preparation and review/submission of reports. Reconciliations were not performed timely to identify issues with expenditures reported on the ETA reports. Effect: Noncompliance with reporting deadlines and errors in expenditures reported. Errors in reports went undetected without a proper review process. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-036a Implement procedures for a documented secondary review of all reports submitted. Establish deadlines for preparation and review to ensure timely submission. 2025-036b Amend the ETA 9130 report to correct expenditures reported.

UNEMPLOYMENT INSURANCE – 17.225 Federal Awarding Agency: U.S. Department of Labor (DOL), Employment and Training Administration Federal Award Fiscal Year: Not Applicable Federal Award Number: Not Applicable – Direct Payments with Unrestricted Use Funded through U.S. Treasury Trust Fund Administered by: Rhode Island Department of Labor and Training (DLT) Compliance Requirement: Special Tests and Provisions – Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) UNEMPLOYMENT INSURANCE (UI) PROGRAM – WPRS AND RESEA The United States Department of Labor (DOL) has found the Rhode Island Department of Labor and Training (DLT) to be non-compliant with the WPRS program. A corrective action plan was in place during fiscal year 2025. DLT’s RESEA program activities could be enhanced by mandating subsequent RESEA activities. Background: The WPRS and RESEA programs serve as the Unemployment Insurance’s (UI) primary programs that facilitate the reemployment needs of UI claimants. WPRS, which is mandated by Section 303(j) of the Social Security Act, is designed to identify UI claimants who are most likely to exhaust their benefits and need reemployment assistance to return to work, and refer them to appropriate reemployment services, such as: job search and job placement assistance; counseling; testing; provision of occupational and labor market information; and assessments. RESEA is authorized by Section 306 of the Social Security Act to address individual reemployment needs of Unemployment Compensation (UC) claimants and to prevent and detect UC improper payments. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. The purposes of the RESEA program are identified in Section 306(b) of the SSA: (1) To improve employment outcomes of UC recipients and reduce the average duration of UC receipt through employment; (2) To strengthen program integrity and reduce improper UC payments through the detection and prevention of such payments to ineligible individuals; (3) To promote alignment with the Workforce Innovation and Opportunity Act’s (WIOA) broader vision of increased program integration and service delivery for job seekers, including UC claimants; and (4) To establish RESEA as an entry point for UC claimants into other workforce system partner programs. Criteria: For WPRS, Unemployment Insurance Program Letter (UIPL) No. 41-94 requires, “State agencies establish and utilize a system of profiling ‘all new claimants for regular compensation’ (i.e., regular UI) that ‘identifies which claimants will be likely to exhaust regular compensation and will need job search assistance services to make a successful transition to new employment.’” Additionally, UIPL No. 10-22 requires states take the following actions: (1) “Evaluate all new UC claimants to identify those who are most likely to exhaust UC, refer such individuals to reemployment services, and collect follow-up information related to employment outcomes for these individuals; this is known as the WPRS program.” (2) “Select UC claimants identified as most likely to exhaust UC in accordance with Section 303(j), SSA, for participation in the RESEA program will have met the WPRS requirements and does not need to provide a separate WPRS program.” (3) “Do not serve individuals identified as most likely to exhaust in accordance with Section 303(j), SSA, as part of their RESEA program, must operate a separate WPRS program to serve these claimants. States operating separate WPRS programs under Section 303(j), SSA, may not use funds appropriated for RESEA activities to administer a WPRS program.” A work search exemption is granted for adult basic education or vocational training per RIGL §28-44-60: “(a) Notwithstanding any provisions of this title to the contrary, a claimant shall not be ineligible for benefits because of his or her regular attendance, whether full-time or part-time, in an adult basic education or a vocational training program as approved by the director and as defined in § 16-63-5(1) and (2).” For RESEA, the DOL provides guidance and program requirements in the form of Training and Employment Guidance Letter (TEGL) for the administration of the RESEA program. Per TEGL NO. 11-23, federal guidance indicate the following is required when administering the RESEA program: “Minimum requirements for a subsequent RESEA. The subsequent RESEA is considered “completed” when, at a minimum, all of the following services have been provided: (1) A UC eligibility review that is conducted on a one-on-one basis, including review of work search activities (if such activities have not been waived) and referral to adjudication if an issue or potential issue(s) is identified; and (2) Review of the claimant’s activities to determine if additional assistance is needed to support the claimant’s return to suitable work at the earliest possible date. Additionally, if the claimant is required to search for work as a condition of UC eligibility, the state should provide any additional assistance necessary to support the claimant’s compliance with the state’s work search requirements.” Condition: DLT's WPRS profiling selection strategy does not include factors used to identify claimants based on their likelihood of exhausting UC benefits. The current approach of randomization satisfies RESEA requirements but cannot be used to simultaneously satisfy WPRS. DLT is not complying with federal profiling requirements of WPRS. Our review of DLT’s RESEA program administration found that while DLT requires selected applicants to participate in an initial RESEA orientation, it does not mandate any RESEA follow-up activities as encouraged by federal regulations. While DLT appears to minimally comply with federal requirements for RESEA activities based on State plan documentation provided, its effectiveness in meeting the federal intent of the program requirements would be enhanced by mandating certain RESEA subsequent activities in conjunction with the program administration. Such follow-up activities with those referred to the program would also provide additional evaluation of the applicant’s work search efforts, in addition to BAM processes previously noted. Cause: DLT has not developed a model to ensure claimants most likely to exhaust UC are identified as required for the WPRS program. Effect: Noncompliance with RESEA and WPRS program requirements. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-037a Enhance RESEA activities by mandating subsequent activities be performed by referred applicants beyond the initial orientation to improve overall program participation and effectiveness. 2025-037b Modify the current claimant selection model to ensure claimants most likely to exhaust UI benefits are identified as instructed in the DOL WPRS corrective action plan.

EMERGENCY RENTAL ASSISTANCE PROGRAM – 21.023 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: ERAE0006 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Compliance Requirement: Reporting PERFORMANCE REPORTING Controls over reporting were not adequate to verify the accuracy of certain data reported by the component agency. Background: The Pandemic Recovery Office has subgranted with the Rhode Island Housing and Mortgage Finance Corporation (RI Housing), a component unit of the State, to administer certain aspects of the Emergency Rental Assistance (ERA) program. Certain required data elements, including a portion of program expenditures and key demographic information, are generated at RI Housing and reported back to the PRO for inclusion in the required program reporting. Criteria: The U.S. Treasury has prescribed financial and performance reporting requirements for pandemic recovery programs through electronic submission. Reporting requirements for ERA include certain financial and demographic information to showcase the use of funds to aid eligible participants. Condition: Adequate procedures were not in place during fiscal 2025 to verify the accuracy and consistency of information provided by RI Housing prior to its inclusion in the ERA Compliance Report. Further, key demographic information was found to be inconsistently reported and required modification. The Pandemic Recovery Office, subsequent to year-end and in conjunction with the program closeout during fiscal 2026, performed procedures to verify the demographic information reported by RI Housing. Demographic data in subsequent reports in fiscal 2026 reflected modifications requested by the PRO as a result of its review. Cause: Lack of adequate guidance to and oversight of information provided by the component unit agency. Effect: Reports may not be accurate for all required information. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-038 Resubmit corrected reports, as needed.

EMERGENCY RENTAL ASSISTANCE PROGRAM – 21.023 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: ERAE0006 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: SLFRP0136 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Compliance Requirements: Subrecipient Monitoring; Allowable Costs/Cost Principles SUBRECIPIENT PAYMENTS AND MONITORING Subrecipient monitoring procedures were insufficient to ensure subrecipient audit reports are obtained and reviewed. Monitoring procedures were not in place to ensure adequate documentation was obtained regarding the use of payment advances. Background: The Pandemic Recovery Office, as the administering agency of both the Emergency Rental Assistance Program (ERA) and the State Fiscal Recovery Fund (SFRF), executes memoranda of understanding with the various departments and agencies to conduct projects under the allowable uses of the program. The departments and agencies then often execute subawards within the scope of the specific project. In fiscal 2025, expenditures related to these subawards were primarily executed by the Executive Office of Housing. Criteria: 2 CFR §200.332(e) Requirements for pass-through entities requires that all pass-through entities must “monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” That monitoring must include (1) reviewing financial and performance reports, (2) following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award, and (4) resolving audit findings specifically related to the subaward. Uniform Guidance cost principles dictate that, in order to be allowable under Federal awards, costs must be adequately documented (2 CFR §200.403(g)). 2 CFR §200.332(b)(1) requires that subawards clearly identify certain federal award identification information to the subrecipient. Condition: For SFRF, our sample consisted of 34 subawards executed with 20 unique subrecipients. For ERA, our sample consisted of 29 subawards executed with 15 unique subrecipients. In fiscal 2025, subrecipient Single Audit Reports were not obtained and reviewed by the pass-through entity for 19 of the 20 SFRF subrecipients or any of the 15 ERA subrecipients. Note: Between ERA and SFRF, there were 27 unique subrecipients; eight subrecipients received funding from the Executive Office of Housing under both programs. Subrecipients noted under both programs were issued separate subawards for ERA and SFRF. As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each sampled subrecipient to identify if there were any findings reported. While we did not note any findings related to the subawards sampled (i.e. no findings reported on ERA or SFRF), we did note several subrecipient entities with findings reported on internal control over financial reporting and/or internal control over compliance with federal awards on other programs that could be of interest to the pass-through entity in evaluating the level of monitoring necessary for each subrecipient. Additionally, many of these subrecipients receive funding on a periodic basis. Of 34 SFRF subrecipient payments reviewed, 4 were payment advances to subrecipients for which no additional documentation or reconciliation was available to support subrecipient expenditures related to those prepayments. We noted several other subrecipient reimbursement payments for SFRF that were lacking adequate support for the expenditures being reimbursed. We did not note any deficiencies in the review of reimbursement requests for ERA. The Executive Office of Housing (responsible for 32 of the 34 sampled subawards and 18 of the 20 subrecipients under SFRF and all subawards under ERA) made several improvements to its subrecipient monitoring procedures in fiscal year 2026, including periodic site visits (depending on the nature of the project) and requiring subrecipients to submit their Single Audit Report or financial audit report when requesting annual funding. Monitoring deficiencies in fiscal 2025 were significantly impacted by organization restructuring and related resource constraints. We also noted several subawards that were missing certain required federal award identifying information; subawards include an appendix that details the required information. For ERA, we noted 1 subaward that appeared to include the incorrect entity name in the appendix, 1 subaward that was missing the Federal Award Identification Number (FAIN), Assistance Listing Number (ALN), and program title, and 2 instances where a subrecipient had differing Unique Entity IDs (UEIs) between their respective subawards. For SFRF, we noted 4 subawards that did not include the UEI, 3 subawards that did not include the FAIN, 5 subawards that did not include the ALN and program title, and 6 subawards that did not include the federal award date. Cause: Subrecipient monitoring procedures are not in place to ensure audit reports are reviewed and management decisions are issued, as required by Uniform Guidance. Other monitoring procedures were inadequate to ensure that subrecipients appropriately utilized the funds provided to support program objectives. Effect: Noncompliance with program guidelines and/or federal regulations at the subrecipient level could go undetected and unresolved. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-039a Enhance internal control procedures to ensure timely review of audit reports and issuance of management decisions in accordance with Uniform Guidance. Ensure review of reports is adequately documented, including notation of findings unrelated to the subaward, which could have an indirect impact on the administration of the subaward. 2025-039b Enhance controls to ensure adequate documentation of monitoring procedures performed and support for subrecipient expenditures is obtained. Document any meetings and/or conversations with the subrecipients and discussion had therein. 2025-039c Continue to strengthen and improve subrecipient monitoring procedures to ensure subrecipient compliance with terms and conditions of the grant award and subaward. 2025-039d Enhance controls to ensure all award identifying information required by 2 CFR §200.332(b)(1) is accurately included in the subaward.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: SLFRP0136 Pass-through Entity: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Administered by: Rhode Island Commerce Corporation (RICC) Compliance Requirement: Procurement, Suspension and Debarment RHODE ISLAND COMMERCE CORPORATION – IMPROVE INTERNAL CONTROLS AND COMPLIANCE WITH PROCUREMENT Criteria: Per Uniform Guidance (2 CFR §200.327 and 2 CFR Part 200, Appendix II), all contracts made by non-federal entities under federal awards must contain specific provisions as applicable, such as those for equal employment opportunity, Davis-Bacon, termination for cause, compliance with laws and regulations, and others. These provisions are required to ensure compliance with federal program requirements for procurement. Condition: During testing of contracts for the American Rescue Plan Act (ARPA) program, we noted that contracts selected for testing did not contain all the required provisions outlined in Appendix II to 2 CFR Part 200. While services were otherwise procured appropriately, documentation of the required contract clauses was not consistent across all contracts selected for review. Cause: The Corporation’s procurement processes did not include sufficient controls to ensure that all federally required contract provisions were incorporated into every contract funded with federal awards. Effect: Lack of inclusion of all required federal contract provisions increases the risk of noncompliance with Uniform Guidance and could lead to disputes or enforcement issues if regulatory or compliance matters arise. No questioned costs were identified, as the services procured were determined to be allowable and otherwise appropriate. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-040 The Corporation should enhance its procurement procedures to ensure all contracts funded by federal awards include every provision required by Appendix II to 2 CFR Part 200 as applicable. Regular review of contract templates and procurement checklists should be implemented to support compliance.

CORONAVIRUS CAPITAL PROJECTS FUND – 21.029 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2022-2027 Federal Award Number: CPFFN0169 Administered by: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Compliance Requirement: Subrecipient Monitoring REVIEW OF SUBRECIPIENT AUDIT REPORTS Review of subrecipient audit reports under the Coronavirus Capital Projects Fund can be enhanced to provide detailed documentation of deficiencies that directly or indirectly impact the subawards. Background: Under the Coronavirus Capital Projects Fund (CPF), the State awarded funding to cities and towns to invest in multipurpose community facility projects that directly and jointly enable work, education, and health monitoring. Twenty-one facility projects were awarded to eighteen municipalities across the State. Criteria: 2 CFR §200.332(e) Requirements for pass-through entities requires that all pass-through entities must “Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” That monitoring must include (1) reviewing financial and performance reports, (2) following up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means, (3) issuing a management decision for audit findings pertaining to the Federal award, and (4) resolving audit findings specifically related to the subaward. Condition: The PRO obtained and documented its review of subrecipient audit reports during fiscal 2025, however, the review did not document the pertinent information related to the CPF subawards. This would include the amount of CPF expenditures, whether the program was audited as major, if any findings were reported and any management decisions issued from PRO if findings existed specific to the subaward. Additionally, any other reported findings that could have an indirect impact on the subrecipient’s administration of the CPF subawards (e.g., a finding on cash management related to a different federal award could indicate an underlying issue that may affect CPF) were not documented. As part of our testing, we performed an independent review of Single Audit Reports submitted to the Federal Audit Clearinghouse (FAC) for each subrecipient to identify if there were any findings reported. No findings were reported on CPF subawards and therefore, no additional follow-up was necessary from the PRO as the pass-through entity. Cause: The scope of subrecipient audit report reviews did not focus on the subaward or other aspects related to the administration of federal programs. Effect: Lack of thorough review could result in reported findings related to CPF subawards not being resolved, as required by Uniform Guidance. Lack of documentation of other findings could impact extent of other monitoring procedures to mitigate risks that may indirectly impact CPF subawards. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-042 Improve documentation of subrecipient audit report reviews to include notation of whether any findings pertained to the CPF subaward that require issuance of a management decision in accordance with Uniform Guidance and whether any other findings reported could indirectly impact the administration of the subaward.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – 21.027 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2021 to 2025 Federal Award Number: SLFRP0136 Pass-through Entity: Rhode Island Department of Administration (DOA), Pandemic Recovery Office (PRO) Administered by: Rhode Island Commerce Corporation (RICC) STATE SMALL BUSINESS CREDIT INITIATIVE TECHNICAL ASSISTANCE GRANT PROGRAM– 21.031 Federal Awarding Agency: U.S. Department of the Treasury (TREAS) Federal Award Fiscal Years: 2024 to 2027 Federal Award Number: SSBCI-21031-0038 Pass-through Entity: Rhode Island Executive Office of Commerce (EOC) Administered by: Rhode Island Commerce Corporation (RICC) Compliance Requirement: Other RHODE ISLAND COMMERCE CORPORATION – DOCUMENT POLICIES AND PROCEDURES OVER FEDERAL AWARDS Criteria: Uniform Guidance (2 CFR Part 200) requires non-federal entities administering federal awards to establish and maintain written policies and procedures to address all requirements specified in the regulations, including but not limited to internal controls, determination of allowable costs, procurement, subrecipient monitoring, financial management, and reporting. Condition: During our audit, we noted that the Corporation did not have formal policies and procedures in place covering all requirements of Uniform Guidance as specified in 2 CFR Part 200. Certain elements, such as procurement conflict of interest, property and equipment management, internal control, and other compliance areas, were not addressed in written policies or documented procedures. Cause: The Corporation has not developed comprehensive written policies and procedures to address all compliance requirements under Uniform Guidance. Effect: The absence of complete written policies and procedures for all elements under Uniform Guidance increases the risk of noncompliance with federal requirements, reduces consistency in federal program administration, and limits transparency and accountability. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-041 The Corporation should develop and implement comprehensive written policies and procedures that address all major compliance requirements under Uniform Guidance (2 CFR Part 200). Periodic review and updates should be performed to ensure ongoing compliance.

EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) IMMUNIZATION COOPERATIVE AGREEMENTS – 93.268 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2025 Federal Award Number: NH23IP922618 Administered by: Rhode Island Department of Health (RIDOH) DRINKING WATER STATE REVOLVING FUND – 66.468 Federal Awarding Agency: Environmental Protection Agency Federal Award Fiscal Years: 2022-2030 Federal Award Numbers: 99126120, 99126122, 99126E22, 99126S22, 99126L22, 99126123, 99126E23, 99126S23, 99126121and 99126L23 Pass-through Entity: Rhode Island Infrastructure Bank (RIIB) Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Allowable Costs/Cost Principles TIME AND EFFORT REPORTING RIDOH controls over time and effort reporting are lacking to ensure accurate allocations and reimbursements from federal programs. Background: RIDOH has built and implemented a complex time-reporting system using internal worksheets for employees to allocate time spent on various activities during the pay periods. Reconciliations of the hours worked versus the hours charged to the State’s payroll and accounting systems are performed quarterly. Recorded amounts are adjusted quarterly (using quarterly variance reports prepared using a spreadsheet application) accordingly to ensure charges to the federal programs are consistent with actual time worked on the various programs. Criteria: 45 CFR §75.430(i)(1) and 2 CFR §200.430(g)(1) require that “Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed.” Condition: Our testing of personnel costs and payroll allocation controls identified a variety of documentation discrepancies and control deficiencies for the ELC, Immunization, and DWSRF programs. As part of our testing, we determined a complete population of RIDOH personnel by payroll period that we reconciled to the State accounting system to validate the completeness of payroll costs charged directly to the programs. For each program tested, we randomly selected 40 distinct RIDOH employee time reporting periods (2-week periods with weekly timesheets) to test the accuracy and completeness of time and effort reporting. For each employee selected, we verified that the time reported for the period selected agreed to RIDOH’s internal worksheets that supported the personnel cost allocation adjustments made by RIDOH. Once the employee time was verified, we determined if the adjustment required for that employee to adjust the respective allocation of personnel costs to the program agreed to the adjustments posted to the State accounting system. These procedures noted the following: • Our procedures commonly noted discrepancies between required adjustments per the quarterly variance report and the actual adjustments posted in the accounting system. We noted exceptions in 39 of the 120 adjustments (33%) selected for testing, which were provided to RIDOH to research and make any necessary corrections. The actual amount of personnel expenditures incorrectly allocated to federal programs remained undetermined as RIDOH efforts to review the adjustments and reported discrepancies remained incomplete. • To evaluate the significance of potential personnel misstatements by program, we conducted analytical procedures of personnel expenditures charged in fiscal 2024 where audit work performed found that personnel expenditures charged to the program were supported by RIDOH. Our analytical procedures found that personnel expenditures charged to the ELC, Immunization, and DWSRF programs in fiscal 2025 were reasonably consistent as a percentage of total program expenditures with fiscal 2024. We relied on this analysis, and other considerations, to conclude that while RIDOH made clerical errors when adjusting payroll allocations amongst federal grants, the amount of likely personnel expenditures improperly allocated to these programs in fiscal 2025 was not deemed to be material to the programs as a whole. • Our review of sampled timesheets (240 weekly timesheets) in conjunction with time and effort reporting noted isolated instances where timesheet documentation and/or supervisory review and approval were deficient. Cause: Current policies and procedures were ineffective to ensure amounts claimed and reimbursed by Federal programs for personnel costs were reflective of the actual work performed on the various programs/projects listed. Personnel changes, in conjunction with a lack of documented policies and procedures, during fiscal 2025 contributed to the difficulties in adjusting personnel cost allocations cited above. Effect: Personnel costs reimbursed from Federal awards could be unallowable due to insufficient support and/or improper allocation. Questioned Costs: Undetermined Valid Statistical Sample: Yes RECOMMENDATIONS 2025-043a Enhance reporting of time and effort for general timesheet category activities to improve documentation and support for personnel costs charged to Federal programs. RIDOH should explore capabilities in the State’s new ERP system to allow for direct charging of personnel costs through time and effort reporting directly in the ERP. 2025-043b Ensure all payroll allocation adjustments are supported by complete, accurate, and independently verifiable documentation. 2025-043c Review all payroll allocation entries that were not supported by RIDOH’s internal worksheets and determine if additional adjustment of personnel costs to federal programs is required.

EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) IMMUNIZATION COOPERATIVE AGREEMENTS – 93.268 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2025 Federal Award Number: NH23IP922618 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Cash Management CONTROLS OVER CASH MANAGEMENT REQUIREMENTS RIDOH controls over cash management are lacking to ensure records and support are accurate, complete, and in compliance with federal requirements. RIDOH could not provide adequate supporting documentation for several drawdowns made during fiscal 2025. Background: RIDOH has constructed comprehensive workbooks, Uniform Grant Spreadsheets (UGS) / Monthly Federal Grants Tracking (MFGT), to assist in monitoring award activity throughout the period of performance. Agency staff populate the UGS/MFGT workbooks with transactional information (expenditures) from the State’s accounting system. Accounting details maintained in the UGS are utilized to reconcile and determine the amounts available for proper cash drawdowns. RIDOH has historically performed federal funding draws for the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) and Immunization Cooperative Agreements (Immunization) programs monthly. During fiscal 2025, RIDOH, on occasion, drew down funds during the month due to concerns over funding availability by the federal government to ensure that resources were available to sustain current program operations. Criteria: Federal regulation 2 CFR §200.305(b) requires recipients of federal awards to minimize the time elapsing between the transfer of federal funds from the federal government and the disbursement of those funds for program purposes. Reimbursement requests must be supported by allowable expenditures incurred under the federal award, and recipients are required to maintain adequate records to demonstrate compliance with federal cash management requirements. Condition: Internal control over cash management was insufficient to ensure compliance with federal regulations. Populating UGS spreadsheets is a manual process and lacks the required access, data integrity, and other monitoring controls necessary to ensure the accuracy of the recorded activity and subsequent calculations contained within. Additionally, these tracking tools are not designed to accurately track and record the required support for drawdowns outside the scheduled monthly payment requests. Cash drawdown records were not adequately maintained, limiting our ability to substantiate RIDOH’s drawdown requests through supporting documentation or the State’s accounting system. As part of our sample testing, we noted the following: • For the ELC program, 3 out of a sample of 13 (23%) lacked adequate support for drawdowns, 1 of which included a mid-month drawdown inclusive of future expenditures. • For the Immunization Cooperative Agreements program, 7 out of a sample of 12 (58%) lacked adequate support for drawdowns, 4 of which included mid-month drawdowns inclusive of future expenditures. Attempts to reconcile unsupported drawdown amounts with RIDOH were unsuccessful. While RIDOH was unable to specifically detail the expenditures incurred in support of a large percentage of draws, the supporting documentation for several draws indicated that projected future expenditures were included in some amounts drawn. Our audit results noted a significant percentage of drawdowns without adequate supporting documentation that we deemed to represent material noncompliance for both ELC and Immunization with federal requirements for cash management. In support of our finding that RIDOH drew down federal funds in advance of expenditure disbursement, the State’s monitoring in relation to the Cash Management Improvement Act also identified the ELC program as having drawn federal funds in excess of reported expenditures during the year. The State’s monitoring reported excess cash on hand for the ELC program collectively for 3 days during fiscal 2025. A review of the individual accounts in the State accounting system representing the various grants incorporated under the collective program noted a large number of individual grant awards where federal revenue far exceeded the expenditures reported for those accounts. The underlying accounting detail suggests that RIDOH was not reconciling its federal accounts in a timely manner to ensure that grants were not being overdrawn. Several federal accounts were reporting overdrawn funds at year-end in need of reconciliation. Cause: RIDOH did not establish and maintain adequate controls to ensure that federal reimbursement requests were supported by expenditures incurred at the time of the drawdown and that sufficient documentation was retained to support the amounts requested. Deficiencies in internal controls coupled with the use of estimates and spending projections, resulted in unsupported and excessive draws deemed noncompliance with federal cash management requirements. Personnel changes, in conjunction with a lack of documented policies and procedures, during fiscal 2025 contributed to cash management difficulties cited above. Effect: Noncompliance with federal requirements, specifically 2 CFR §200.305(b), for cash management going undetected by program management. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-044a Document and implement formal policies and procedures over federal drawdowns to ensure compliance with federal regulations. 2025-044b Reconcile grant awards reporting excess cash drawdowns at June 30, 2025, and adjust amounts accordingly to ensure accurate grant award tracking for the ELC and Immunization programs.

EPIDEMIOLOGY AND LABORATORY CAPACITY FOR INFECTIOUS DISEASES (ELC) – 93.323 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2027 Federal Award Number: NU50CK000519 Administered by: Rhode Island Department of Health (RIDOH) IMMUNIZATION COOPERATIVE AGREEMENTS – 93.268 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2019 to 2025 Federal Award Number: NH23IP922618 Administered by: Rhode Island Department of Health (RIDOH) Compliance Requirement: Reporting CONTROLS OVER FEDERAL FINANCIAL REPORTING REQUIREMENTS RIDOH controls are insufficient to ensure complete and accurate program reporting requirements. RIDOH did not complete 37% of the required federal reports for the ELC program and was unable to provide adequate supporting documentation for certain federal reports required for the ELC and Immunization programs for fiscal 2025. Criteria: Federal regulation 45 CFR §75.341, requires the Federal Financial Report (FFR), SF-425A, to be submitted on an annual basis in accordance with the terms and conditions of the Federal award. Recipients must submit FFRs to the U.S. Department of Health and Human Services (HHS) Centers for Disease Control and Prevention no later than 90 days after the end of the reporting period and final FFRs within 120 days after the end of the period of performance. FFRs are to be complete, accurate and the amounts reported able to be substantiated by the entity’s accounting records. In addition, the report is designed to capture key financial data for a grant award, such as the amount of Federal funds disbursed and spent so far. Condition: We noted deficiencies in RIDOH's controls over the preparation, support, and submission of required FFRs for the ELC and Immunization programs, specifically: • RIDOH was unable to substantiate expenditure amounts recorded on the FFR for the ELC Core award and its supplements. In addition, testing specific to the ELC program noted 13 of 35 (37%) required FFR submissions for fiscal year 2025 had not been submitted. Although RIDOH indicated that the outstanding FFRs were in the process of being prepared and submitted, the reports remained delinquent beyond the applicable federal reporting deadlines. • Testing specific to the Immunization program noted that 5 of 10 (50%) required FFR submissions could not be adequately supported with detail in the State's accounting system. Specifically, expenditures reported on the FFRs related to multiple overlapping grant awards and reporting periods. RIDOH relies upon Uniform Grant Spreadsheets (UGS) to accumulate and report expenditures; however, the UGS did not provide sufficient detail to distinguish expenditures among the applicable awards or reporting periods. As a result, we were unable to reconcile reported expenditures to the State's accounting system in detail and could not verify the accuracy of amounts reported on the affected FFRs. RIDOH was researching exceptions noted during testing and determining if report revisions are needed. We deemed the audit results noted above to be material noncompliance with program reporting requirements for the ELC (37% of required reports were not filed) and Immunization programs (lack of support for expenditures reported on 50% of the reports filed). Further, RIDOH’s lack of procedures to reconcile federal reporting to the State accounting system represents a material weakness in internal control over federal reporting. Cause: RIDOH currently utilizes workbooks, Uniform Grant Spreadsheets (UGS), to track federal expenditures during the term of the award. Information reported on the annual FFRs is compiled using the cumulative information within the UGS. There is a lack of sufficient control over access and data integrity to ensure that the underlying transactional account details within RIDOH’s UGS are complete and accurate. The UGS are not reconciled on a routine basis to ensure consistency with the State’s financial accounting system’s detail, and management’s review of the required SF-425A reports was insufficient to identify inaccuracies in amounts reported. Personnel changes, in conjunction with a lack of documented policies and procedures, during fiscal 2025 contributed to reporting difficulties cited above. Effect: Material noncompliance with federal reporting requirements. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-045a Enhance internal control over the UGS to ensure the accuracy and integrity of cumulative financial information used in generating required Federal financial reports. 2025-045b Reconcile the details contained within the UGS to the underlying transactional information recorded in the State’s accounting system, to verify that amounts reported within the required SF-425A forms are complete and accurate. 2025-045c Amend FFRs submitted during fiscal 2025 with inaccurate expenditures reported and complete and submit overdue FFRs.

TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY DETERMINATIONS IN THE TEMPORARY ASSISTANCE FOR NEEDY FAMILIES (TANF) PROGRAM Internal controls are lacking to ensure that TANF eligibility is supported by documentation required by program regulations. Background: RIBridges is the State’s federally approved integrated eligibility system used to manage multiple health care and human service programs. It was designed to allow for enhanced client accessibility and provide for periodic validation of client attested data through multiple electronic interfaces. Criteria: Federal regulation 45 CFR §260.20 requires the TANF program to serve needy families. Rhode Island regulation sets the specific criteria to determine if a family qualifies for assistance, consistent with federal regulations and requirements. Federal regulation 45 CFR §205.60(a) requires the State agency to maintain records to support eligibility, including facts to support the client’s need for assistance. The State’s policies and procedures require that documentation used to verify eligibility is maintained in the case file. Federal regulations define appropriate sources of documentation to verify TANF applicant data when determining TANF eligibility, including proof of residency. According to the RI State plan, acceptable documentation for proof of residency includes rental receipts, lease agreements, utility bills, medical bills, bank statements, payroll statements, mortgage statements, car registrations, city or town tax statements, and/or school records. State regulation 218-RICR-20-00-2 requires TANF recipients to have a redetermination of eligibility at least once every 12 months, and whenever a significant change occurs. Condition: Documentation in RIBridges was insufficient to support eligibility in certain cases tested. When evaluating exceptions relating to case documentation deficiencies, questioned costs and consideration of material noncompliance with eligibility requirements are based on documentation of critical household eligibility factors (income, residency, citizenship, valid Social Security Number, birth certificates). If documentation omission was isolated in a case record and did not impact the substantial eligibility of the household, it was treated as an exception for control deficiency considerations only. For State fiscal year (SFY) 2025, we tested a sample of 60 cases (sampled on a monthly benefit payment). Documentation deficiencies for critical eligibility requirements were noted in 21.7% of the cases we tested. Questioned costs of $47,032 were calculated by totaling all monthly payments disbursed during fiscal 2025 for sampled cases in which eligibility was either unsupported, incorrectly determined or continued despite reason for discontinuance (i.e. incomplete recertification). Total SFY 2025 TANF payments for the cases sampled totaled $384,511, resulting in a benefit issuance error rate of 12.2% projected over the total benefit population of $31.6 million. Based on our test results, we estimated likely questioned costs of $3.9 million or 3.8% of total program expenditures. While our projected questioned costs did not rise to the level of material noncompliance for TANF eligibility requirements, significant noncompliance is resulting from documentation deficiencies. The following exceptions resulted in eligibility being unsupported by case records. Note that an individual case may have more than one noted error (15 total exceptions relating to 13 unique cases – 21.7% error rate): • 4 of 60 (6.7%) cases in which the required documentation supporting household residency was not maintained in the electronic case file. • 10 of 60 (16.7%) cases in which signed recertification documents were not scanned and maintained in the electronic case file. • 1 of 60 (1.7%) cases in which the initial benefit application (DHS-2) was not scanned and maintained in the electronic case file. In addition to the noncompliance issues identified above, we identified 7 of 60 (11.7%) case files that did not contain identification documents or other supporting case information for all household members. These deficiencies represented nonconformance with the established eligibility process and/or control procedures, however, they were not deemed to represent ineligible benefit payments. While applicant attested information in most cases supported applicant eligibility for TANF, the lack of required critical supporting documentation and the significant number of other documentation deficiencies noted were deemed to be a material weakness in internal control over TANF eligibility. Our consideration of compliance also included the eligibility testing results noted in Finding 2025-053 relating to Child Care provider payments, which are partly funded by TANF. Although DHS’s inability to identify federal program funding source at a provider payment level required actual questioned costs to be reported specific to the Child Care program, we estimated that likely questioned costs relating to Child Care provider payments funded by TANF totaled $1.4 million. Our evaluation of eligibility results for benefit payments in these findings, while deemed significant, were not deemed to represent material noncompliance with TANF eligibility requirements. Cause: Lack of supporting documentation included in the TANF case record (file) and insufficient procedures to ensure that critical case documentation is included in the case record prior to eligibility approval for the applicant. Effect: Noncompliance with TANF eligibility requirements and/or documentation requirements mandated by DHS policy. Ineligible benefit payments claimed to the TANF program. Questioned Costs: $47,032 Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-046 Improve policies and procedures to ensure that all required eligibility compliance requirements for TANF are documented within RIBridges.

TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – Income Eligibility and Verification System INCOME ELIGIBILITY AND VERIFICATION SYSTEM Internal controls were lacking in ensuring that Income Eligibility Verification (IEVS) data was run and processed timely to determine whether it affects the recipient's eligibility or the amount of assistance received. Background: RIBridges, the State’s integrated eligibility system, interfaces with various electronic data exchanges in determining the initial and subsequent continuance of eligibility. The State utilizes information, most notably, wage and unemployment income (UI), obtained from the State Wage Information Collection Agency (SWICA), the Rhode Island Department of Labor and Training (DLT), and the federal Beneficiary & Earnings Data Exchange (BENDEX), in addition to other data sources to comply with IEVS. Criteria: 2 CFR §200.303 requires that a non-federal entity must “establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in ‘Standards for Internal Control in the Federal Government’ issued by the Comptroller General of the United States or the ‘Internal Control-Integrated Framework’ issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Federal regulation 45 CFR §205.55 requires that “each state shall participate in the Income Eligibility and Verification System (IEVS) required by Section 1137 of the Social Security Act as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. Specifically, the state is required to request and obtain information as follows (42 USC 1320b-7; 45 CFR §205.55): (a.) Wage information from the state Wage Information Collection Agency (SWICA) should be obtained for all applicants at the first opportunity following receipt of the application, and for all recipients on a quarterly basis. (b.) Unemployment Compensation (UC) information should be obtained for all applicants at the first opportunity, and in each of the first three months in which the individual is receiving aid. This information should also be obtained in each of the first three months following any recipient-reported loss of employment. If an individual is found to be receiving UC, the information should be requested until benefits are exhausted. (c.) All available information from the Social Security Administration (SSA) for all applicants at the first opportunity. (d.) Information from the US Citizenship and Immigration Services and any other information from other agencies in the state or in other states that might provide income or other useful information. (e.) Unearned income from the Internal Revenue Service (IRS).” 45 CFR §205.55 provides that the State shall review and compare the information obtained from each data exchange against information contained in the case record to determine whether it affects the applicant's or the recipient's eligibility or the amount of assistance within 45 days. Condition: DHS did not outline within its TANF state plan how it complies with Section 1137 of the Social Security Act, as amended, as it relates to IEVS requirements. As part of our testing, we sampled 25 newly enrolled/added cases and determined if information was obtained from external data exchanges (SWICA, DLT UI & BENDEX) for all applicants at the first opportunity, and within 45 days of application as defined by federal regulations. The following errors were noted in our testing (note that an individual case may have more than one error): • 8 new cases not run against SWICA interface data within 45 days of application; • 7 new cases not run against BENDEX interface data within 45 days of application; and • 6 new cases not run against DLT UI interface data within 45 days of application. While income verifications were eventually performed in the cases reviewed, three of the errors noted above exceeded 175 days before verification was performed. Additionally, as part of eligibility compliance testing, we determined whether ongoing data exchange interfaces were performed, verified and processed by the agency for individuals already receiving benefits. • 2 of 60 cases where SWICA information was identified and not verified, processed, or added to the eligibility case file timely. While our testing found the IEVS processes to be operating during fiscal 2025, substantial delays in initial data verification and follow-up on data identified by periodic revalidation processes were noted in a significant percentage of cases reviewed. We considered the high percentage of untimely verifications to represent a material weakness in controls over eligibility as ineligible benefits could be expended for significant periods of time without detection. Cause: Absence of IEVS procedures documented within the TANF state plan. Lack of supporting documentation in the case record and insufficient procedures to ensure that income interfaces are run against client information prior to and during eligibility periods. Effect: Noncompliance with TANF IEVS requirements mandated by federal regulations. Improper or incorrect benefit payments could be claimed to the TANF program. Questioned Costs: Undetermined Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-047a Conduct a review of the TANF state plan and update it to include detailed procedures for utilizing IEVS interfaces and incorporating the resulting information into eligibility determinations. 2025-047b Ensure that income data interfaces are properly executed and that the information obtained is used to make timely benefit eligibility determinations.

TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Reporting ACF-199 REPORTING INACCURACIES DHS failed to update its ACF-199 reporting process to reflect changes in reporting instructions. Reported ACF data elements were unsupported by case/client information. Criteria: Under 42 USC §611, states must submit TANF program data in accordance with reporting instructions established by the Department of Health and Human Services. The Administration for Children and Families (ACF) official TANF reporting guidance requires states to adhere to prescribed data definitions, element codes, formatting rules, and validation criteria for ACF‑199 submissions. States must ensure completeness, accuracy, and conformity with federally mandated reporting standards. Condition: During our review of the State’s TANF reporting processes, we identified that the ACF-199 quarterly data files submitted to ACF contained incorrect coding for several required data elements when compared to case information in RIBridges, the State’s eligibility system. We tested a sample of 25 cases reported in the ACF-199 for key line items and noted the following reporting discrepancies (note that an individual case may have more than one noted error): • Item 12 – Type of Family for Work Participation – 1 error • Item 17 – Receives Subsidized Child Care – 2 errors • Item 39 – Parents with a Minor Child – 10 errors • Item 48 – Work-Eligible Individual Indicator – 1 error • Item 49 – Work Participation Status – 2 errors • Items 50-62 – Work Participation Activities – 2 errors Separate analysis relating to procedures performed over earmarking identified 14 individuals reported in the ACF-199 data as having received assistance more than the allowable 60 months and were incorrectly coded as non-hardship exemptions. It was also determined that new guidance for coding definitions from ACF was not implemented by the agency and that supervisory review of the reports by agency personnel was not performed prior to submission to ACF. Cause: Deficiencies were due to inadequate internal controls over federal reporting. Agency staff did not update the system to reflect current federal coding guidelines. Formal review procedures were not established by the agency. Effect: Inaccurate or noncompliant coding increases the risk of inaccurate data reporting to ACF. Failure of oversight by the agency can result in federal penalties to the program including a reduction in the grant amount. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-048a Implement procedures to ensure ACF-199 reports are accurate and comply with federal coding guidelines. 2025-048b Establish a documented quality assurance review process for the ACF-199 reports prior to submission.

TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan WORK VERIFICATION PLAN NONCOMPLIANCE DHS is not currently in compliance with federal regulations relating to the State’s approved Work Verification Plan. Background: DHS’s approved Work Verification plan documents the State’s internal controls over ensuring the accuracy of work verification data submitted as part of the ACF-199 report. Noncompliance with federal regulations over work verification may result in federal action to impose a penalty. Criteria: 45 CFR §261.62 requires the State to verify the accuracy of work participation data. 45 CFR §261.63(c) requires the State to submit amendments to its work verification plan for (1) procedural changes for verification of work activities or (2) changes in internal controls for ensuring consistent measurement of the work participation rate. 45 CFR §261.65 requires the state to maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of data used in calculating work participation rates. Condition: Our review of DHS procedures relating to Work Verification Plan requirements noted the following deficiencies: • The State has not submitted an amended Work Verification Plan to ACF for approval reflecting the material changes in current procedures performed by the agency in verifying work participation. The existing plan continues to include documentation of operations relating to the previous eligibility system and is not representative of current processes employed by DHS. • The internal controls documented in the State’s Work Verification Plan provide that DHS performs a monthly review of sampled cases to ensure work verification procedures are properly followed. During our audit, we randomly selected 3 months to obtain documentary evidence of the controls operating as described, however, DHS was unable to provide any evidence of the control activities having been implemented and performed. • As we reported in Finding 2025-048, we identified 2 errors in the accuracy of reported worker participation data. Such inaccuracies support the need for improved controls over reported data to ensure that required data is accurately reported to the federal government. Cause: DHS did not submit an amended Work Verification Plan for approval as required and did not implement the control activities as documented. Effect: Noncompliance with federal regulations. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-049a Amend the existing Work Verification Plan to reflect current procedures and operations performed by the agency in ensuring the validity of work participation data and submit to ACF for approval. 2025-049b Implement internal controls as documented in the State’s Work Verification Plan.

TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Reporting FEDERAL FUNDING ACCOUNTABILITY AND TRANSPARENCY ACT (FFATA) Subawards were not reported timely in accordance with federal regulations. Controls over reporting of subawards to a federal transparency website can be enhanced to ensure accurate reporting in compliance with the requirements of FFATA. Criteria: Subaward reporting under the Federal Funding Accountability and Transparency Act (FFATA) requires the awarding agency to report subawards in the Federal Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made (2 CFR Part 170, Appendix A, Award Term, Reporting Requirements). Condition: DHS did not report subaward information in the FSRS in a timely manner. Our testing of subaward reporting for compliance with FFATA reporting requirements are detailed in the following tables: [See Schedule of Findings & Questioned Costs for Tables] Cause: DHS lacks monitoring controls to ensure that subawards are reported timely in accordance with FFATA requirements. Effect: Noncompliance with FFATA reporting requirements. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-050 Implement monitoring controls to ensure that subaward information is submitted timely in accordance with FFATA reporting requirements.

TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Reporting DHS FINANCIAL REPORTING Misstatements identified in quarterly financial reports. Background: ACF requires separate financial reports in place of the SF-425 for both CCDF and TANF. The ACF-696 quarterly report provides information on CCDF expenditures to ensure compliance with federal spending requirements. The TANF ACF-196R reports quarterly expenditure data on the use of federal TANF funds, State TANF Maintenance of Effort (MOE) and State expenditures. Criteria: Per 45 CFR §265.7(b)(1) the requirements for the TANF Financial Report to be “a complete and accurate report” means that the reported data accurately reflect information available to the State in case records, financial records, and automated data systems. Per 45 CFR §98.65(g) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended. Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Ineffective controls over financial reporting to ensure complete and accurate program information is reported to the federal grantor. As part of our audit testing, we randomly selected two quarters and reviewed all submitted reports for open grants during the selected period. Our review noted the following: 1) ACF-196R: Our review of the TANF Financial Reports for the quarter ending December 31, 2024, for grant year 2023, found that the Department of Human Services (DHS) did not accurately report certain amounts, specifically, line item 11.b. Pre-Kindergarten/Head Start – DHS overstated reported expenditures by $1,411,129. 2) ACF-696: Our review of the CCDF Financial Reports found that the DHS did not accurately report certain amounts on the CCDF Financial Reports. Most notably, misstatements in the quarter ending March 31, 2025 included: • Line Item 1 Mandatory Funds Total – expenditures overstated by $1,135,189. • Line Item 1 Matching Funds Total – expenditures overstated by $2,635. • Line Item 1 MOE Total – expenditures understated by $475,489. Additional discrepancies were noted in the report for the quarter ending June 30, 2025 and DHS reconciliations of variances reported for Matching and Discretionary Funds remained ongoing. Cause: Inadequate review of the report compilation process and lack of reconciliation between costs reported in the financial reports to the underlying detail in the State’s accounting system for the period being reported. Effect: Inaccurate reporting and noncompliance with federal regulations. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-051a Reconcile reported federal expenditures to the corresponding accounting detail. 2025-051b Implement adequate review controls to ensure accurate and timely financial reporting. 2025-051c Amend the ACF-196R and ACF-696 reports to correct expenditures reported.

CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Cost Sharing (including Matching), Level of Effort, Earmarking INTERNAL CONTROL OVER EARMARKING COMPLIANCE REQUIREMENTS DHS’s internal controls over earmarking compliance requirements were deemed ineffective. Criteria: Federal regulation 45 CFR §98.50(b) and (d) provides the minimum and/or maximum amount/percentage of CCDF funds to be used for specified activities such as administrative costs and improvement in the quality of child care services. 2 CFR §200.303(a) requires recipients and subrecipients of federal assistance to establish, document, and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Internal controls over compliance with earmarking requirements were found to be deficient. On a quarterly basis, the Department of Human Services (DHS) aggregates program expenditures to track and monitor the agencies’ compliance with specific CCDF earmarking requirements. The deficiencies noted in Finding 2025 051 detail the misstatements relating to reported expenditures in federal reports that also impacted DHS’s ability to effectively evaluate compliance with earmarking requirements. Reporting inaccuracies were largely determined to be caused by the inclusion of program activity outside of the reporting period. Although we ultimately determined that DHS complied with earmarking requirements using accurate expenditures for the period, DHS’s procedures were deemed ineffective to ensure that only applicable program expenditures were included in calculations of the minimum/maximum amount of funds used for specified activities. Cause: DHS staff were unaware of errors in reports/expenditure detail used to calculate compliance with earmarking requirements. Effect: Inaccurate or incomplete data used in calculations to monitor compliance with earmarking requirements may result in the agency incorrectly determining compliance. Possible noncompliance with federal regulations may result in questioned costs. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-052 Implement adequate review procedures over underlying expenditures utilized within calculations for evaluating compliance with earmarking requirements.

CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Eligibility CONTROLS OVER CHILD CARE ELIGIBILITY AND PROVIDER PAYMENTS System controls over income validation within RIBridges require improvement. Controls over provider disbursements of Child Care Assistance Program (CCAP) funds for the Child Care Educators and Child Care Staff Pilot program were lacking to prevent duplicate disbursements. Background: RIBridges is the State’s federally approved Integrated Eligibility System (IES) used to manage multiple health care and human service programs. It is designed to allow for integrated eligibility across programs, enhanced client accessibility, and provide for periodic validation of client attested data through multiple electronic interfaces. RIBridges determines eligibility for a child care subsidy and the amount of parental co-pay based on family income and family size. Payments to licensed child care providers are made through RIBridges. RIBridges is the official source of recipient eligibility documentation for the child care program. During fiscal 2024, the State rolled out the Child Care Educators and Child Care Staff Pilot program which expands income eligibility up to 300% the Federal Poverty Level (FPL) compared to 261% FPL for traditional CCAP. Qualifying individuals must work in a licensed child care center, licensed family child care home, or a licensed group family child care home to receive benefits through the pilot. Criteria: Lead agencies must have procedures in place for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements adopted by each State in its approved plan. A lead agency is the designated State, territorial or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Lead agencies shall establish a sliding scale fee based on family size, income, and other appropriate factors that provides for cost sharing by families that receive CCDF child care services (45 CFR §98.45(k)). Lead agencies may exempt families below the poverty line from making copayments and shall establish a payment rate schedule for child care providers caring for subsidized children (45 CFR §98.45(k)(4)). The lead agency has authority to administer the program through other governmental or non-governmental agencies, however, retains overall responsibility for the administration of the program (45 CFR 98.11(a)(1)). Rhode Island General Law §40-5.2-20(k) established a pilot program allowing the Department of Human Services to provide funding for child care for eligible child care educators and child care staff with family income up to three hundred percent (300%) of the Federal Poverty Level, who work in a licensed child care center, licensed family child care home, or a licensed group family child care home. Condition: A sample of 60 cases was tested for fiscal 2025 to determine compliance with program eligibility requirements. Control deficiencies relating to income verification within RIBridges were noted as follows: • 3 of 60 (5.0%) electronic case files did not maintain documentation to support income used in the eligibility determination; • 1 of 60 (1.7%) case files incorrectly calculated household income by including household resources that should have been excluded; and • 1 of 60 (1.7%) case files incorrectly transposed income, which was supported by documentation in the electronic case file, into the eligibility system. The error did not result in a different eligibility determination or change in the calculated family co-share. Deficiencies relating to missing documentation to support eligibility resulted in questioned costs totaling $617 for the sampled provider payments (excluding family co-share). Total payments to child care providers for the sample of 60 cases tested totaled $11,991 resulting in a projected error rate of 5.1%. Known questioned costs relating to cases with unsupported eligibility totaled $37,631 for fiscal 2025. Questioned costs noted above were extrapolated to total provider payments of $68.4 million in fiscal 2025 to determine likely questioned costs relating to provider payments made for cases with unsupported eligibility. Based on our test results and determined error rate, we estimated likely questioned costs of $1.3 million in provider payments funded by the CCDF program. For determination of likely questioned costs by program for compliance evaluation purposes, allocations by funding source were estimated based on the following percentages of total benefits charged by program in fiscal 2025: 37% to CCDF, 41% to TANF, 2% to SSBG, and 20% to State funds. In addition to testing eligibility determinations made within RIBridges, additional procedures were performed over the eligibility determinations relating to the CCAP for Child Care Educators and Child Care Staff Pilot program. During fiscal 2025, 739 children were enrolled in the pilot program with payments to providers totaling $4,746,587. Eligibility determinations and provider disbursements for this program were contracted out to a vendor and were not performed in the RIBridges eligibility system. DHS claimed that changes to RIBridges to accommodate the different eligibility criteria under the program would not have been made in time for the roll out of the pilot program. The vendor performed the data intake and provided DHS with an eligibility recommendation, although the final authority over eligibility approval remained with the agency. During our audit, we tested a sample of 25 cases and did not identify any errors relating to compliance with eligibility determinations. However, we noted duplicate payments for one case that was enrolled in both the pilot program and approved for child care through RIBridges. Two bi-weekly provider payments were disbursed through both systems for the same period. Further data analysis was performed over the complete child care populations to quantify total duplicate payments made. Total questioned costs of $28,308 were determined for 129 duplicate weekly payments for 34 children. Questioned costs for the Child Care Educators and Child Care Staff Pilot program were quantified using the total benefits paid during fiscal 2025, allocation by funding source: 36% by Child Care, 64% by TANF. Additionally, individuals enrolled through the pilot program not maintained within the State’s eligibility system were not subjected to continuous post eligibility monitoring through RIBridges’ built-in interfaces (SWICA, Unemployment, PARIS, etc.), weakening controls over eligibility. Our consideration of compliance, based on our sample error rate and projected questioned costs relating to income validation and duplicated provider payments, was not deemed to represent material noncompliance with CCDF eligibility requirements in fiscal 2025. Cause: RIBridges does not prevent a case from being approved for eligibility for missing required documents. Eligibility exceptions noted resulted from worker noncompliance with documentation requirements supporting eligibility determinations. Controls over the input of payroll information were also deficient, which may result in improper co-share amounts being determined. Controls over provider disbursements were insufficient to prevent disbursal of duplicate provider payments. Effect: Noncompliance with child care eligibility requirements. The parental income/co-shares could be incorrectly determined. Improper payments relating to duplicative disbursements. Questioned Costs: $65,939 Valid Statistical Sample: Not Applicable RECOMMENDATIONS 2025-053a Improve controls over CCDF eligibility determinations by ensuring consistent inclusion of eligibility documentation in the electronic case record. 2025-053b Consider modifying the existing eligibility system to accommodate eligibility determinations made under the CCAP Child Care Staff program. 2025-053c Enhance controls over provider disbursements to identify potential duplicate disbursements. Recover improper payments and return to the federal grantor.

CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS), Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements NONCOMPLIANCE WITH HEALTH AND SAFETY REQUIREMENTS The DHS Office of Child Care’s (OCC) monitoring policies and procedures are not sufficient to ensure child care provider compliance with health and safety standards. Background: The Department of Human Services (DHS), the lead agency, operates the Office of Child Care which administers the Child Care Assistance program as well as the licensing and monitoring of participating child care centers. DHS has adopted formalized licensure and health and safety policies and procedures designed to ensure compliance with 45 CFR §98.41, Health and safety requirements. Criteria: 45 CFR §98.41, Health and safety requirements state that “(a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part.” 45 CFR §98.42 requires sufficient monitoring policies and practices applicable to all child care providers to ensure compliance with health and safety requirements. RI Code of Regulations, Title 218, Department of Human Services, Chapter 70, Office of Child Care Licensing, Parts 1 and 2, mandate licensing standards for Child Care Centers and Family Child Care Centers. As part of the State’s approved plan, unannounced monitoring visits are to be performed once annually for Family Child Care Homes and twice annually for Child Care Centers to inspect providers and ascertain compliance with health and safety regulations. Condition: DHS continued to improve on its compliance with Health and Safety requirements. Late in fiscal 2025, DHS implemented the Rhode Island Start Early System (RISES), an information system intended to improve overall monitoring and licensing of child care providers. RISES replaces a physical case filing system the agency previously utilized and should allow for more timely interaction with providers regarding license renewals, submission of required documentation, and remediation of corrective action plans. While the RISES system is expected to aid in the agency’s compliance in subsequent fiscal years, our testing during fiscal 2025 of a sample of 40 child care providers noted the following noncompliance and related control deficiencies: • 7 of 40 (17.5%) providers did not have a minimum of one unannounced site visit during fiscal 2025 as required by policy. • 25 of 40 (62.5%) provider files did not contain evidence of fire, lead or radon inspections spanning the entire fiscal year. Evidence of prior inspections was noted in the provider record. • 8 of 40 (20%) providers did not have evidence that communicated deficiencies requiring corrective action were subsequently resolved. Our provider review included documentation of 10 specific provider monitoring requirements. While our testing found that DHS’s monitoring procedures were substantive and operational during the year, the exceptions noted were deemed to be noncompliance with certain State policies designed to ensure federal compliance and a significant deficiency in internal control over compliance with this special test and provision. Cause: DHS OCC monitoring policies and procedures are not sufficient to ensure child care provider compliance with health and safety standards. Effect: Noncompliance with child care provider health and safety requirements designed to ensure the health and safety of children covered under the Child Care and Development Fund program. Questioned Costs: None Valid Statistical Sample: Not Applicable RECOMMENDATION 2025-054 Evaluate current monitoring procedures and resources needed to improve child care provider compliance with health and safety requirements.

FOSTER CARE TITLE IV-E – 93.658 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIFOST, 2501RIFOST Administered by: Rhode Island Department of Children, Youth and Families (DCYF) ADOPTION ASSISTANCE – 93.659 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIADPT, 2501RIADPT Administered by: Rhode Island Department of Children, Youth and Families (DCYF) Compliance Requirement: Eligibility UNTIMELY MONITORING OF ELIGIBILITY DETERMINATIONS DCYF should strengthen controls over the eligibility determination process for the Foster Care Title IV E and Adoption Assistance programs by requiring its contractor to complete eligibility quality control reviews on a timely basis. Background: DCYF utilizes contract services to perform monthly reviews of eligibility determination for the Foster Care and Adoption Assistance Title IV-E programs. The contractor conducts case reviews of sampled eligibility determinations periodically throughout the year and reports exceptions noted to DCYF. The results of the reviews are used to confirm the Department’s eligibility determinations and to identify employees who may need additional training. This process represents a significant control over eligibility by validating that eligibility criteria have been met and are appropriately documented by DCYF. DCYF’s policy requires that the reviews be completed within 90 days. Criteria: Monitoring internal controls is essential to ensure controls are operating efficiently. Monitoring involves the use of evaluations by management and third parties to assess the effectiveness of established controls and highlight areas requiring corrective action. Condition: In fiscal 2025, thirteen out of fifteen review reports issued by the contractor during fiscal 2025 were not reported timely for the Foster Care and Adoption Assistance programs. To maximize effectiveness, quality control reviews should be performed timely, which DCYF has defined in policy as no later than 90 days. Our testing found that several reviews were not completed until 7-9 months after the period of the eligibility determination. The lack of timeliness diminishes the value of the quality control process and the controls established over eligibility. Cause: Untimely completion and reporting of eligibility quality control reviews. Effect: Ineligible claiming to federal programs going undetected for an extended period. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-055 Ensure timely completion of eligibility quality control reviews in accordance with DCYF policy.

FOSTER CARE TITLE IV-E – 93.658 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIFOST, 2501RIFOST Administered by: Rhode Island Department of Children, Youth and Families (DCYF) ADOPTION ASSISTANCE – 93.659 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIADPT, 2501RIADPT Administered by: Rhode Island Department of Children, Youth and Families (DCYF) Compliance Requirement: Reporting CONTROLS OVER REPORTING FOR IV-E PROGRAMS DCYF should establish, document, and implement effective internal control over program reporting to ensure the accuracy, completeness, and timeliness of federal report submissions. Background: DCYF administration of the Foster Care and Adoption Assistance programs includes required Form CB-496 reporting of financial and operating data on a quarterly basis to the U.S. Department of Health and Human Services. Form CB-496 reporting includes DCYF certification of report accuracy, correctness, and compliance with award terms and conditions. Criteria: 2 CFR 200.303 requires that Federal award recipients “establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Further, the “internal controls should align with the guidance issued by the Comptroller General of the United States” (Green Book) which includes “segregation of duties in designing control activities so that incompatible duties are segregated” to “reduce the risk of error, misuse, or fraud.” In the case of reporting as a control activity, Compliance Supplement 2025, Part 6 expects that “segregation of duties exists between those preparing and those reviewing and filing required reports.” For Foster Care program awards, Form CB 496 reporting is required and includes recipient certification of the correctness and accuracy of financial and program data reported. Per the references, CB-496 report preparation and review/certification duties are incompatible and should be segregated by documented processes, responsibilities, authorities. Condition: DCYF did not provide supporting documentation demonstrating appropriate segregation of duties between the preparation and review/certification of the CB‑496 report for Foster Care reporting for the periods ending September 30, 2024 and March 31, 2025, or for Adoption Assistance reporting for the period ended March 31, 2025. Additionally, DCYF did not provide documentation describing the internal controls, processes, responsibilities, or authorities governing Foster Care and Adoption Assistance reporting. In conjunction with our audit, we noted that expenditures reported on federal reports for the quarter ending June 30, 2025 were not recorded in the State’s accounting system until fiscal 2026. This timing difference resulted in a significant difference between expenditures claimed on federal reports and amounts reported in the State accounting system which is the basis for program expenditures reported in the State’s Schedule of Expenditures of Federal Awards. While the timing difference does not impact the reporting of grant expenditures for the federal grant year, it supports the need for more oversight to ensure the alignment of reported federal expenditures between federal reports and the State accounting system. This reporting difference and routine late filings of federal reports results from delays in the completion of cost allocation procedures. Proper controls would have allowed for timely identification of the discrepancy and more timely reporting in the State accounting system. Cause: DCYF has not documented and implemented internal control activities over Foster Care or Adoption Assistance program reporting requirements, nor has it documented responsibilities and authorities associated with program reporting to ensure segregation of duties. Current procedures would not ensure that errors in federal reporting would be detected and corrected prior to report filing. Effect: Inaccurate or incomplete federal reporting could occur and not be detected by the Department. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-056a Establish, document, and implement effective internal control that ensures segregation of reporting duties between the report preparation and review to provide reasonable assurance over the accuracy and completeness of federal reporting. Implementation should include the training of sufficient personnel to sustain procedures, control activities, and compliance in the event of staff turnover. 2025-056b Ensure completion of cost allocation procedures to allow for timely federal reporting of program expenditures and reconciliation of federal reports with the State accounting system.

ADOPTION ASSISTANCE – 93.659 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIADPT, 2501RIADPT Administered by: Rhode Island Department of Children, Youth and Families (DCYF) GUARDIANSHIP ASSISTANCE – 93.090 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024, 2025 Federal Award Numbers: 2401RIGARD-05, 2501RIGARD-01 Administered by: Rhode Island Department of Children, Youth and Families (DCYF) Compliance Requirement: Reporting CONTROLS OVER EXPENDITURE REPORTING FOR ADOPTION ASSISTANCE PROGRAM The Department of Children, Youth and Families did not appropriately segregate expenditures for the Adoption Assistance (93.659) and Guardianship (93.090) Programs. Background: The Department of Children, Youth and Families (DCYF) administer both the Adoption Assistance program (ALN 93.659) and the Guardianship Assistance program (ALN 93.090). Efficient administration of these programs requires precise tracking of federal expenditures to ensure that costs are allocated to the correct federal award. Criteria: Pursuant to 2 CFR §200.302 (Financial Management), non-federal entities must maintain a financial management system that provides accurate, current, and complete disclosure of the financial results of each federally sponsored project or program. Specifically, the system must adequately identify the source and application of funds for federally funded activities, including the separation of expenditures by individual Assistance Listing Number (ALN). Condition: DCYF did not maintain separate accounting to properly isolate expenditures between distinct federal programs. Specifically, the Department utilized a single account (Line-Item Sequence Number 2075113) to record transactions for both the Adoption Assistance (ALN 93.659) and Guardianship Assistance (ALN 93.090) program expenditures. Consequently, this led to a reporting error where $287,539 in expenditures relating to the Guardianship Assistance program were incorrectly allocated to the Adoption Assistance program. This resulted in overstated expenditures reported on the Schedule of Expenditures of Federal Awards (SEFA) for the Adoption Assistance program and understated expenditures for the Guardianship Assistance Program in the Schedule of Expenditures of Federal Awards (SEFA). DCYF, however, properly identified the expenditures reported on the respective financial reports for each program. In conjunction with our audit, an adjustment was proposed to the SEFA to ensure properly reporting in the Single Audit. Cause: The Department lacks distinct, dedicated general ledger accounts or unique cost centers within its financial management system for each specific Assistance Listing Number. Relying on manual processes to ensure that the proper allocation of expenditures is prone to error and omission. Effect: Inaccurate or incomplete reporting in the SEFA and on federal reports going undetected and uncorrected by the department. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-057 Ensure proper segregation of accounting for each federal program administered by the Department.

CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER ELIGIBILITY DETERMINATIONS WITHIN THE CHILDREN’S HEALTH INSURANCE PROGRAM (CHIP) Operational and system deficiencies resulted in noncompliance with federal regulations relating to CHIP eligibility. Background: Medical benefit expenditures claimed to CHIP totaled $174.4 million (federal share - $120.4 million) in fiscal 2025. Benefit expenditures mainly constituted managed care capitation payments for CHIP eligible individuals. Various application controls and documentation deficiencies continued to result in eligibility determination errors post the public health emergency (PHE) phase out. Eligibility for CHIP is mainly determined through the State’s integrated eligibility system, RIBridges. Individuals are assigned CHIP eligible aid categories, which are then communicated to the Medicaid Management Information System (MMIS) where fee-for-service claims and managed care capitation (i.e., healthcare premiums) are paid on behalf of the individuals. The MMIS allocates expenditures for claims and capitation based on the individual’s aid category. Criteria: Eligibility requirements for CHIP are detailed in the State Plan. Recipient eligibility requirements generally include children under age 19 with household income less than 261% of the federal poverty level (FPL). Coverage of pregnant women and unborn children of non-citizens is also available under CHIP for members with household income less than 253% of FPL. Enhanced funding under CHIP is available only for children without existing health coverage. Children with existing health coverage are eligible for Medicaid. Condition: While most CHIP eligibility was identified through RIBridges, EOHHS identified additional CHIP claiming totaling $8.3 million (approximately $5.7 million in federal expenditures) through querying the MMIS for members meeting CHIP characteristics but not coded as CHIP eligible by RIBridges. Utilizing two separate claiming mechanisms continues to weaken controls over CHIP eligibility. For fiscal 2025, we tested a sample of 60 CHIP eligible members (population of eligibility segments for individuals with reported CHIP eligibility during fiscal year 2025 totaled 72,117). Fee-for-service and managed care capitation payments for fiscal 2025 approximated $26.0 million (federal share - $18.0 million) and $121.4 million (federal share - $84.0 million), respectively. Of the 60 cases sampled, our testing noted the following noncompliance with eligibility requirements for CHIP and the related control deficiencies: • Individuals enrolled in CHIP had evidence of third-party coverage within the MMIS not relayed to RIBridges impacting eligibility determinations (4 cases; questioned costs - $9,602). • Eligibility terminated within RIBridges not populated within the MMIS. Benefits/disbursements continued despite the change in eligibility status (2 cases; questioned costs - $6,209). • Unearned income excluded from income calculation in determining eligibility. Had reported unearned income been included the individual would have been ineligible for CHIP benefits (1 case; questioned costs - $56). The above reported questioned costs represent actual benefit expenditures incurred for the member during the determined period of ineligibility. In addition, the following deficiencies were noted, however, these case exceptions did not impact the members’ eligibility during the audit period: • The Rhode Island Department of Labor and Training’s State Wage & Information Collection Agency (SWICA) interface utilized to validate household income did not properly report in the RIBridges case records. Incomplete SWICA income not reported within RIBridges may cause the system to fail in detecting household income that exceeds federal income limits for CHIP, potentially impacting eligibility determinations (1 case). • Post Eligibility Verification not performed during the year (1 case). • Incorrect household composition size populating and utilized in eligibility determination (1 case). Our testing found exceptions in 7 out of 60 sampled cases resulting in an error rate of 11.7%. Certain cases contained more than 1 exception noted. Total claims and capitation paid for sample cases total $218,426 (federal share - $151,134). Questioned costs relating to sample cases for fiscal 2025 periods deemed ineligible for CHIP reimbursement totaled $15,867 (federal share - $10,979) or 7.3% of claiming for sampled CHIP individuals. Our test results supported projected questioned costs estimated at $10.7 million (federal share - $7.4 million). In addition to noncompliance reported above, the State continued to claim CHIP enhanced reimbursement for children with existing third-party health insurance coverage. Our analysis of members charged to CHIP against a file of validated health insurance coverage provided by the Medicaid fiscal agent found 782 children charged to CHIP that had verified other private insurance for the entire fiscal year. Capitation payments made in fiscal 2025 for those members totaled $2,609,622 (questioned costs – federal share - $1,805,663). The State implemented system changes to RIBridges designed to prevent children with existing health coverage from being coded CHIP eligible; however, the functionality did not effectively ensure that only uninsured children were charged to CHIP funding sources in fiscal 2025. Deficiencies in program controls to ensure that children aged out of CHIP at age 19 continued to be noted during fiscal 2025. An analysis of children charged to CHIP during fiscal 2025, age 19 (plus 3 months to allow for notice and redetermination) or older noted 45 individuals with managed care capitation payments claimed to CHIP totaling $102,740 (questioned costs – federal share - $71,089). Significant noncompliance was still noted during fiscal 2025. Of the exceptions noted, 7 individuals were between the ages of 20 and 25 and 7 individuals were older than age 25. Based on our sample testing exception noted above, we analyzed instances where children initially coded eligible with expenditures funded under CHIP were re-coded and remained coded at year-end to a State coverage program titled “Cover All Kids”. Cover All Kids provides State-funded eligibility for undocumented children residing in the State that otherwise meet Medicaid and CHIP eligibility requirements. Our analysis found that the coding error impacted approximately 45 cases within CHIP during fiscal 2025. We conducted a detailed analysis of a sample of 25 cases charged to Medicaid (441 cases) or CHIP (45 cases) and found that none of the sample cases contained documentation of citizenship (interface validation or acceptable case documentation). Based on the sample results, we quantified the amount of capitation charged to CHIP for the 45 individuals identified resulting in questioned costs totaling $58,301 (federal share – $40,340). EOHHS was unable to perform quarterly PARIS (Public Assistance Reporting Information System) matches for two quarters during fiscal 2025 as the data was unavailable or unreliable. No alternative processes were performed to compensate for the control activity not executed. Recent audits have noted that EOHHS has not been complying with federal requirements to evaluate PARIS notifications for CHIP members by requiring those members to validate continued residency in the State. Our analysis of PARIS reporting during fiscal 2025 identified 117 members reported in the file where follow-up and residency validation was not conducted. The amount of capitation paid for CHIP members no longer residing in the State was not determinable and will require EOHHS follow-up as required by federal regulations. The cumulative noncompliance identified by our testing procedures over CHIP eligibility was deemed to represent material noncompliance with CHIP program eligibility requirements. Cause: Noncompliance with CHIP eligibility requirements was caused primarily by CHIP specific programming deficiencies within RIBridges (e.g., interface validations not operating as designed, failure to limit claiming for children with third-party health insurance coverage, noncompliance with federal PARIS match requirements). Effect: Noncompliance with federal requirements relating to recipient eligibility for CHIP. Questioned Costs: $1,928,070 Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-058a Address and correct the RIBridges system deficiencies (e.g., income validation, TPL consideration, PARIS match) to strengthen controls and ensure compliance with federal regulations regarding CHIP eligibility. 2025-058b Identify ineligible CHIP costs and return to the federal grantor.

CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Period of Performance CONTROLS OVER PERIOD OF PERFORMANCE Controls need to be developed to ensure EOHHS only charges allowable costs incurred during the approved budget period of the federal awards period of performance. Criteria: Federal regulation 45 CFR §75.303 requires the State to establish and maintain effective internal controls over the Federal award that provide reasonable assurance that the State is managing the Federal award in compliance with Federal statutes, regulation, and the terms and conditions of the Federal award. Federal statute allows for the availability of allotted amounts determined under section 2104(e) of the Act remain available for expenditure by the State through the end of the succeeding fiscal year. Condition: EOHHS has not documented or implemented control activities to ensure that costs are applied within the period of performance. Manual retroactive capitation adjustments and subsequent journal entries present an increased risk that a cost may be charged or allocated to a federal award outside the allowable period of performance. EOHHS does not currently review higher risk activities at the beginning and ending of the federal award period of performance, as a recommended best practice, to ensure compliance with specific grant award requirements. Cause: Lack of documented and implemented internal control policies/procedures. Effect: Potentially charging costs outside the federal awards period of allowability. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-059 Develop and implement controls to ensure costs are charged within the federal awards period of performance.

SNAP CLUSTER – 10.551, 10.561 Federal Awarding Agency: U.S. Department of Agriculture (USDA); Food and Nutrition Service (FNS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 244RI405S2514; 254RI405S2514 Administered by: Rhode Island Department of Human Services (DHS) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS); Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS); Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review COMPREHENSIVE DEPARTMENTAL AUTOMATED DATA PROCESSING (ADP) RISK ANALYSIS AND SYSTEM SECURITY PROGRAM See related Financial Statement Findings 2025-003 and 2025-019. The State continued to maintain systems security oversight over systems used to administer multiple federally funded programs. Certain internal control deficiencies should be addressed to improve the State’s monitoring of information security over RIBridges and the Medicaid Management Information System (MMIS). Background: EOHHS and DHS are charged with managing and securing ADP systems, which administer various federal HHS and State programs (e.g., Medicaid, TANF, etc.). These programs had eligibility, benefit determinations, and payments processed mainly by two systems – MMIS and RIBridges. State agencies (EOHHS, DHS, and the Department of Administration’s Division of Enterprise Technology Strategy and Services – ETSS) were required to determine appropriate ADP security requirements based upon recognized industry standards for each system, optimally within a comprehensive plan. During fiscal year 2025, a breach of the RIBridges system went undetected for a period of time, compromising the personal information of approximately 650,000 individuals. This security incident highlighted the critical importance of information security (InfoSec) within the impacted federal programs and further supported the need for additional improvement and monitoring, which had been recommended in prior year findings since the system’s inception. Criteria: Federal regulation 45 CFR §95.621 requires State agencies to review the ADP system security of installations used in the administration of HHS programs on a biennial basis or when a significant change to the security or system(s) occurs. At a minimum, State agencies must establish and maintain an ADP security plan and implement a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. In addition, the Federal Information Security Modernization Act requires non-federal systems housing, processing, or transmitting federal data to maintain adequate InfoSec. Condition: The State continued to maintain its InfoSec oversight of the MMIS and RIBridges systems to ensure compliance with federal regulations for ADP risk analysis and system security reviews. The following internal control deficiencies were noted during our audit and should be addressed to further improve the State’s monitoring of InfoSec over the MMIS and RIBridges systems. MMIS – EOHHS oversees the IT security requirements of the MMIS. EOHHS largely utilizes independent system organization control (SOC) reports to meet their security and risk monitoring activities for the MMIS. However, the ADP system security plan should be improved by ensuring that the coverage provided by the SOC reports is supplemented with other documented monitoring procedures (e.g., frequent monitoring of system access, timely removal of system access upon user termination, and improved documentation of user entity controls). The SOC report identifies several complementary user entity controls that EOHHS is responsible for implementing and ensuring that they are operating effectively. Examples of areas in need of improvement include the reliability and consistency of data transmitted from RIBridges to the MMIS, monitoring of system access, change management, and oversight of InfoSec activities performed by the system contractor (e.g., penetration testing and vulnerability scans). InfoSec deficiencies identified through these processes should be tracked by the State to ensure timely remediation by the contractor. RIBridges – The State relies on several contractor/external party reviews to monitor InfoSec over the RIBridges system. These include the following: • Attestation reports relating to the RIBridges contractor, Deloitte Consulting, and Deloitte’s subcontractor, NTT Data, that has been delegated certain InfoSec functions over the system (contracted to occur biennially); • MARS-E (Minimum Acceptable Risk Standards for Exchanges) assessments of a set of security and privacy standards, established by the Centers for Medicare and Medicaid Services, applicable to entities managing Health Insurance Exchanges. These assessments are performed annually with the audit scope rotating over a three-year period; and • Internal Revenue Service Safeguard Reviews – InfoSec reviews over State systems and applications that utilize federal tax information. The Deloitte and NTT attestation reports noted above were not available in fiscal 2025 as it was a scheduled non-performance year. Although the State met regularly with the contractor to review outstanding InfoSec deficiencies and discuss the results of penetration tests and vulnerability scans, these monitoring activities did not provide sufficient assurance that controls over critical InfoSec functions remained effective throughout the fiscal year. Due to prolonged delays in resolving critical deficiencies, the State must document the risks associated with medium and high priority issues. This documentation should justify why immediate contractor remediation is not feasible and verify that compensating controls have been implemented to mitigate the risks. The MARS-E evaluation for the quarter ending June 30, 2025 cited significant findings and recommendations within the RIBridges IT security assessment, including: • Ensuring that InfoSec policies and procedures are reviewed and updated annually; • Continued use of unsupported applications in need of update or patching; • Lack of authenticated security scans on critical infrastructure to ensure comprehensive InfoSec validation; • Lack of a formal risk assessment process (e.g., lack of a risk register); • Lack of a consolidated tool to track logical access requests (which impacts the ability to review logical access accounts in a timely manner); and • Lack of proper management of service accounts and privileged accounts. Several of these findings were also identified in prior MARS-E assessments. Cause: Certain deficiencies in the State’s current IT security practices relating to ADP Risk Analysis and System Security Review need improvement to enhance systems security. Effect: Certain collective deficiencies could undermine IT security over the RIBridges and MMIS systems. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-032a Improve monitoring of MMIS system access, oversight of IT security activities performed by the system contractor and tracking of IT security deficiencies to ensure timely remediation by the contractor. 2025-032b Implement recommendations identified in the MARS-E assessment to improve IT security administration of the RIBridges system. 2025-032c Utilize risk assessment results annually to document how expected audit coverage will ensure that critical risk areas are included in the scope of work for assessments planned for that year. 2025-032d Consider whether annual SOC engagements are needed if the State is unable to conduct specific reviews of the operating effectiveness of the contractor’s InfoSec controls.

SNAP CLUSTER – 10.551, 10.561 Federal Awarding Agency: U.S. Department of Agriculture (USDA); Food and Nutrition Service (FNS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 244RI405S2514; 254RI405S2514 Administered by: Rhode Island Department of Human Services (DHS) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES – 93.558 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS); Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RITANF; 2501RITANF Administered by: Rhode Island Department of Human Services (DHS) CCDF CLUSTER – 93.575, 93.596 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS); Administration for Children and Families Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2401RICCDF; 2501RICCDF Administered by: Rhode Island Department of Human Services (DHS) FOSTER CARE TITLE IV-E – 93.658 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Numbers: 2401RIFOST, 2501RIFOST Administered by: Rhode Island Department of Children, Youth and Families (DCYF) ADOPTION ASSISTANCE – 93.659 Federal Award Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Numbers: 2401RIADPT, 2501RIADPT Administered by: Rhode Island Department of Children, Youth and Families (DCYF) CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5ADM; 2505RI5ADM Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles INTERNAL CONTROLS OVER COST ALLOCATION Internal controls over administrative costs allocated to certain federal programs need to be improved to ensure that costs allocated to the programs comply with federal regulations. Background: Administrative expenditures incurred by various State agencies involved in the administration of certain federal programs (e.g., EOHHS, Department of Behavioral Healthcare, Developmental Disabilities & Hospitals (BHDDH), Department of Human Services (DHS), and Department of Children, Youth, & Families (DCYF)) are allocated to the programs through federally approved cost allocation systems. The majority of administrative expenditures claimed are determined through each agency’s cost allocation system (administered through the use of a proprietary web-based application supported by a contractor) and claimed on the respective federal reports. Agencies must periodically adjust administrative expenditures reported in the State accounting system to align with the administrative costs determined through their respective cost allocation systems. Criteria: Management is responsible for implementing and maintaining internal controls to ensure administrative costs are charged in accordance with federal regulations. Specifically, 2 CFR §200.303(a) requires recipients and subrecipients of federal assistance to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: While most State health and human services agencies administering federal programs utilize federally approved cost allocation plans (CAP), internal controls are not sufficiently documented and monitored to ensure expenditures allocated to federal programs are accurate and in compliance with federal regulations. Recommended controls found to be specifically lacking included: • Documented reconciliations between costs allocated to federal programs and the State accounting system were lacking or untimely; • Supervisory review and monitoring were lacking or not formalized, as most agency cost allocation systems are operated by one individual; • Monitoring to ensure that administrative expenditures being allocated to federal programs meet the requirements of federal Uniform Guidance is not being performed; and • Analysis of quarterly cost allocation results to ensure that the contractor application is properly allocating agency costs in accordance with its federally-approved cost allocation plan. EOHHS, BHDDH, DCYF, and DHS administer their cost allocation processes through a contracted proprietary web-based application called AlloCAP. We have found that each department’s understanding of their individual CAP is limited to the manual processes carried out each quarter to complete the allocation process with little understanding or analysis being performed to validate the accuracy of the allocation results. While the application has built-in quality control checks, the State agency responsible for the administration of the federal program to which the costs are allocated is responsible for ensuring the accuracy and federal compliance of the costs allocated. The State needs to consider implementing processes (e.g., reviewing supporting documentation, conducting analytics) across the agencies utilizing AlloCAP or consider obtaining a SOC 1 Type 2 audit (an independent report that evaluates the operating effectiveness of the contractor application) to validate that the contracted cost allocation processes are consistently and accurately allocating costs in accordance with the federally approved cost allocation plan for the respective programs. Cause: Controls over the allocation of administrative costs through AlloCAP lacked documentation and based on current procedures, would not be effective in detecting errors in the quarterly CAP results due to a lack of evaluation and monitoring. Effect: Potential noncompliance with federal requirements relating to allowable costs. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-033 Improve internal controls over administrative claiming to federal programs by 1) completely documenting cost allocation policies and procedures, 2) reconciling quarterly cost allocation results to the State accounting system, 3) enhancing supervision and monitoring of the cost allocation process, and 4) implementing procedures to validate that AlloCAP quarterly results (or consider the need for SOC engagements with that objective) are consistent with underlying federally approved cost allocation plans.

CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions – Managed Care Financial Audit MANAGED CARE FINANCIAL AUDIT The State is not currently in compliance with federal requirements to obtain audited financial reports from its Prepaid Ambulatory Health Plan (PAHP) provider in accordance with 42 CFR §438.3(m). Criteria: Federal regulation requires states to comply with certain contract and program integrity safeguards when administering Medicaid managed care programs. 42 CFR §438.3(m), Audited financial reports, requires that “the contract must require MCOs, PIHPs, and PAHPs to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards.” Condition: The State’s agreement with its contracted Prepaid Ambulatory Health Plan (PAHP) that administers nonemergency medical transportation services within Medicaid includes a provision requiring the submission of audited financial reports specific to the Medicaid contract on an annual basis. The State obtained an audited financial report from its PAHP provider; however, the report did not isolate the financial data specific to the State’s Medicaid contract as required by federal regulation. The State is fully complying with this federal requirement for all of its managed care organization (MCO) providers. The State did not have procedures in place that detected the noncompliance for the PAHP provider. Cause: Failure to implement federal requirements and enforce contracted provisions. Controls were also lacking to identify the partial noncompliance with federal requirements. Effect: Noncompliance with federal regulations relating to managed care financial audit requirements. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-060 Implement policies and procedures to comply with federal regulations for audits of PAHP financial reports.

CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Special Tests and Provisions – Provider Eligibility PROVIDER ELIGIBILITY Controls over the screening, enrollment, and revalidation of providers within the Medicaid program should be improved to ensure compliance with federal requirements relating to provider eligibility. Criteria: 42 CFR §455.410, Enrollment and screening of providers, requires: (a) The State Medicaid agency must require all enrolled providers to be screened under this subpart. (b) The State Medicaid agency must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. (c) The State Medicaid agency may rely on the results of the provider screening performed by any of the following: (1) Medicare contractors. (2) Medicaid agencies or Children's Health Insurance Programs of other States. (d) The State Medicaid agency must allow enrollment of all Medicare-enrolled providers and suppliers for purposes of processing claims to determine Medicare cost-sharing (as defined in section 1905(p)(3) of the Act) if the providers or suppliers meet all Federal Medicaid enrollment requirements, including, but not limited to, all applicable provisions of 42 CFR part 455, subparts B and E. This paragraph (d) applies even if the Medicare-enrolled provider or supplier is of a type not recognized by the State Medicaid Agency. 42 CFR §455.412, Verification of provider licenses, requires that the State Medicaid agency (SMA) must: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. (b) Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. 42 CFR §455.436, Federal database checks, requires that the State Medicaid agency must do all of the following: (a) Confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. (b) Check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. (c) (1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and (2) check the LEIE and EPLS no less frequently than monthly. 42 CFR §488.330, Certification of compliance or noncompliance, (f) Provider Agreements, provides that CMS or the Medicaid agency may execute a provider agreement when a prospective provider is in substantial compliance with all the requirements for participation for a SNF or NF, respectively. 42 CFR §442.101, Obtaining certification, (a) This section states the requirements for obtaining notice of an ICF/IID's certification before a Medicaid agency executes a provider agreement under §442.12. Condition: Our testing of 60 sampled fee-for-service and managed care organization providers for provider eligibility during fiscal 2025 noted the following control deficiencies relating to provider eligibility that need to be addressed: • Encounter data submitted by managed care organizations was subjected to validation for provider enrollment during fiscal 2025; however, we identified exceptions in our sample testing that suggest that the edit was not fully effective. Once fully implemented, this edit should improve controls over provider eligibility by denying encounter data submitted for unenrolled providers. The denial will prompt the MCO to ensure that the provider is properly enrolled or prevent the MCO from being able to claim the encounter as allowable medical expenditures under the contract. Our testing noted 4 providers that were not enrolled in the Medicaid Program as required by federal regulations resulting in noncompliance with provider eligibility requirements, questioned costs totaled $9,331 (federal share - $8,398). Three of the four providers were out-of-state providers required to be enrolled under federal regulations based on the volume of services billed to RI Medicaid. Implementing this additional edit when processing encounter data would improve controls over compliance. • Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from DCYF resulting in a weakness in control for this segment of providers. • The State modified its provider enrollment process beginning in March of fiscal 2025. Providers seeking enrollment, screened by the States contracted vendor over the MMIS, that did not yield an exclusion, exception or other noted error would be enrolled without requiring EOHHS approval. EOHHS as the State’s designated Medicaid agency retains overall responsibility for the program. • Our review of provider licensure disciplinary actions taken by the RI Department of Health during fiscal 2025 identified 2 instances where provider status within the MMIS remained active after the provider’s license was revoked or suspended. While no claims were processed for these providers after license revocation, current processes to ensure that providers are inactivated timely upon license suspension or revocation were not deemed effective. In considering that the above control deficiencies and actual questioned costs identified relate to specific subsets of the Medicaid provider population (e.g., out-of-state providers, unlicensed providers), likely questioned costs from noncompliance with provider eligibility requirements were not deemed to be material to this compliance requirement. Cause: Weaknesses in internal controls over provider eligibility that collectively undermine compliance with federal regulations. Effect: Potential noncompliance with federal regulations relating to eligibility of providers in managed care networks. Questioned Costs: Medicaid - $8,398; CHIP - Undetermined Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-061a Improve encounter data edit checks to validate provider eligibility for this material provider group by denying any data submitted for unenrolled providers. 2025-061b Enhance internal controls over provider eligibility by addressing deficiencies cited that collectively undermine compliance with federal regulations. 2025-061c EOHHS should perform routine review and monitoring of providers enrolled without agency authorization.

CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles CONTROLS OVER MANAGED CARE CAPITATION PAYMENTS AND CONTRACT SETTLEMENTS See related Financial Statement Finding 2025-005. Capitation payments to managed care organizations (MCOs) represent approximately 58% of Medicaid benefit expenditures. EOHHS needs to improve controls over managed care financial activity to ensure compliance with allowable cost principles for related program expenditures. Background: Medicaid expenditures for members enrolled in managed care during fiscal 2025 approximated $2.1 billion (monthly capitation payments paid to participating MCOs, including claim reimbursements for childbirth related claims). This comprised managed care coverage for approximately 274,000 Medicaid eligible members – approximately 88% of total Medicaid enrollees at June 30, 2025. These capitation payments related to the following managed care programs within the State’s Medicaid program: [See Schedule of Findings & Questioned Costs for Table] In addition to capitation for medical services, RI Medicaid also expended approximately $29 million in premiums for dental coverage through the RIte Smiles program for more than 135,000 children in the RIte Care program. Each of these programs has different population eligibility characteristics, capitation rate structures, and covered in-plan services. However, these programs operate under similar contract structures for purposes of financial settlement with Medicaid. Since managed care services provided within the RI Medicaid and CHIP programs involve complex rate setting and contract settlement provisions, the reliability and completeness of the mandated data provided by managed care organizations to the State is vital to fiscal integrity and accountability controls. Criteria: As allowed under federal regulations, the State administers its managed care programs through contracts with MCOs which share the risk regarding financial gain or loss derived from the final contract settlements for the fiscal year. Contract settlements represent significant financial transactions within the Medicaid and CHIP programs and are subject to the provisions of 2 CFR Part 200 (Uniform Guidance). In conjunction with Uniform Guidance requirements, management is responsible for maintaining internal controls that ensure the allowability of federal costs. For benefit costs associated with managed care, the accuracy of contract settlements requires that costs be documented (by submitted encounter data) and in compliance with contractual requirements (e.g., allowable services, net of credits or reimbursements). Condition: Financial settlement of contracts with MCOs are performed annually by EOHHS. These settlements are highly dependent on the managed care providers’ submission of encounter data supporting medical claims reimbursed by the MCO. The encounter data is the basis for the contract settlements and is also critical to future capitation rate setting performed by a contracted actuary. Since the MMIS is a decades old system that was not designed to subject encounter data to the robust edits that fee-for-service claims have received historically, certain control deficiencies exist over the allowability of the encounter services provided to EOHHS. Encounter data submitted by the MCOs is currently validated for the Medicaid recipient’s eligibility, provider enrollment, and completeness of required data elements (e.g., NDC, Program Indicator, referring provider). Edits for service allowability, incompatible services or billings, existence of third-party liability coverage, and reasonableness of the reimbursement rate are not currently evaluated as encounter data is submitted to EOHHS. While certain controls over encounter data have improved in recent years through the completion of financial audits and reviews of encounter data completeness, underlying edits at the claim level remain insufficient to validate the allowability of encounter data submitted. In addition to the reliability of the data provided by managed care organizations to the State, ensuring that reported medical expenditures are supported by valid encounter data is an important control over the contract settlement process. In conjunction with our review of fiscal 2024 managed care contract settlements completed after the one-year claim runout period, we reviewed the percentage of reported managed care expenditures by plan versus submitted encounter data by plan. While the amount of claiming submitted by encounter data continued to improve, medical expenditures reported by the MCOs still exceeded submitted encounter data by $15.6 million in fiscal 2025. The following table provides context regarding the amount of medical expenditures that were not supported by encounter data in fiscal 2024 contract settlements. [See Schedule of Findings & Questioned Costs for Table] Managed care contract settlements, in addition to ensuring that reported medical expenditures are complete and accurate, remain dependent on reported capitation paid to managed care organizations. During our audit, we noted several areas where controls over capitation can be enhanced by ensuring timely termination of managed care enrollment when members pass away or relocate out of state. The current Medicaid Management Information System (MMIS) is over three decades old and was programmed as a medical claims processing system. The system was not programmed with the functionality needed to process capitation adjustments and edit encounter data sufficiently for managed care activity, which now represents most Medicaid benefit expenditures. Cause: Control deficiencies exist in relation to encounter data accuracy, allowability, and completeness which is critical to the final contract settlements with managed care organizations (MCOs). Control deficiencies also exist in relation to the allowability of capitation payments paid to MCOs due to system limitations relating to processing retroactive capitation adjustments and eligibility system deficiencies that do not ensure the timely termination of managed care enrollment when individuals are no longer eligible. Effect: Potential for inaccurate capitation payments or reimbursements to MCOs for unallowable services provided to Medicaid enrollees and/or for ineligible or deceased individuals not unenrolled timely. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-062a Improve controls over encounter claim data submitted by the MCOs by improving the edits that the claims are subjected to (most notably, service allowability, provider eligibility, incompatible services or billings, and accuracy) before being accepted by the Medicaid program. 2025-062b Improve controls over capitation payments to the MCOs by ensuring that managed care enrollment is terminated timely when members pass away or relocate out of State.

CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP and 2405RI5ADM; 2505RI5ADM Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Reporting; Period of Performance FEDERAL REPORTING Controls should be improved over the quarterly reporting of expenditures for the Medicaid and CHIP programs. Criteria: Federal regulations require that expenditures for federal programs be accurately reported on Form CMS-64. The State accounting system is the official record of federal program expenditures, and therefore should be the basis for federal reports. Forms CMS-64 and CMS-21 are required for the quarterly filing of benefit and administrative expenditures for the Medicaid and CHIP programs. Condition: Reviews of federal reports for fiscal 2025 noted the following reporting deficiencies: • EOHHS quarterly reconciliation of expenditures continues to be insufficient in identifying material differences between the State accounting system and amounts reported on the CMS-64 Report. Such reconciliations are critical and made more complex due to significant amounts of prior period adjustments currently required by EOHHS. During fiscal 2025, the HHS Center for Medicare and Medicaid Services (CMS) communicated to EOHHS that CMS-64 Reports for federal fiscal year 2024 reported expenditures and drew $8.2 million in federal funds in excess of its grant authorization for that period. EOHHS has researched the variance and believes it mostly relates to expenditures reported in an incorrect period. CMS has requested that those funds be returned due to the closure of the impacted reporting periods. EOHHS continues to reconcile the variance and dialogue with CMS regarding the reported variance, however formal resolution remains ongoing according to EOHHS. • Additionally, the State’s other health and human service (HHS) agencies are not consistently reconciling activity that recorded administrative expenditures to Medicaid. Various HHS agencies utilize six separate and distinct cost allocation plans to allocate administrative expenditures to Medicaid. The lack of a comprehensive administrative costs reconciliation between the CMS-64 Report and the State accounting system prevents quantifying differences between federal expenditures claimed in federal reports and amounts reported in the State’s Schedule of Expenditures of Federal Awards. • Approximately $8.3 million in CHIP expenditures were claimed to Medicaid initially and determined retroactively to be CHIP eligible and reclassified on federal reports between the two federal programs. The adjustment of expenditures between the Medicaid and CHIP programs presents an increased risk that complicates the reconciliation of federal reports to accounting detail for both programs. Cause: Adjustments of expenditures between the Medicaid and CHIP programs weaken controls over federal reporting for both programs. Lack of complete and accurate reconciliations of Medicaid expenditures to the State accounting system represents a weakness in internal control over federal reporting. Staff turnover and a lack of documented policies and procedures contributed to control deficiencies relating to federal reporting. Effect: Inaccurate federal reporting. Questioned Costs: Medicaid - $8.2 million; CHIP - None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-063a Eliminate untimely expenditure adjustments between Medicaid and CHIP by addressing RIBridges programming deficiencies which prevent CHIP eligibility from being completely determined and coded through the State’s integrated eligibility system. 2025-063b Implement policies and procedures to ensure complete and accurate reconciliation to the State accounting system. Follow up timely and clear reconciling variances prior to submitting the report. 2025-063c Require all HHS agencies to submit reconciliations of their quarterly administrative claiming (as determined through approved cost allocation methodologies) to reported expenditures in the State’s accounting system on a quarterly basis.

CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER THIRD-PARTY LIABILITY (TPL) IDENTIFICATION FOR MEMBERS COVERED UNDER MANAGED CARE The State should improve controls relating to the identification of third-party insurance coverage to ensure that, when appropriate, Medicaid is the payer of last resort by (a) ensuring that TPL reported in the MMIS is accurate and up to date, and (b) ensuring that managed care organizations (MCOs) are effectively identifying TPL insurance coverage for Medicaid recipients and cost avoiding for claims covered by other insurance. Background: The State utilizes a vendor in conjunction with its MMIS operations to identify TPL coverage for Medicaid (and CHIP) eligible members. For members enrolled in managed care, the managed care organizations (MCOs) are responsible for identifying TPL coverage. By contract, MCOs must notify the State of identified TPL within 5 business days of discovery. In response to prior year reporting of this issue, the State began more actively sharing identified TPL information with the MCOs. Criteria: 42 CFR §433.138 requires that States (as defined in their approved State Plan) must take reasonable measures to determine the legal liability of the third parties responsible for paying for services furnished under the State Plan. Federal regulations indicate the minimum required measures that the State must include in their State Plan. Rhode Island’s State Plan TPL procedures are largely focused on TPL identification processes for fee-for-service claiming within the Medicaid program. The State’s contracts with MCOs include requirements for the identification and reporting of TPL for covered members. With most Medicaid beneficiaries enrolled in managed care, ensuring the completeness and effectiveness of TPL identification by the MCOs is important to ensure compliance with federal regulations. Actual claims paid by the MCOs become the basis for final contract settlements and future capitation rate setting; therefore, failure to identify other responsible insurance (TPL) prevents timely cost avoidance during claims processing and increases overall contract costs for the Medicaid program. Condition: During fiscal 2025, we performed certain analytical procedures on MCO encounter data to identify instances where Medicaid recipients (members with Medicaid eligibility for the entire year) had verified TPL coverage that was consistent with their Medicaid managed care coverage to determine the extent to which MCOs were paying for claims that could be cost avoided. Our procedures evaluated only TPL coverages that were consistent with the State’s managed care coverage. We selected a random sample of encounter claims where the State reported verified TPL coverage (positive) and a random sample of encounter claims where the State did not report verified TPL coverage (negative). We confirmed a sample of positive and negative sample items with the MCOs to evaluate the percentage of State verified TPL that the MCOs had successfully identified. Our testing during fiscal 2025 found that the State’s three managed care organizations were unaware of existing private insurance for 71.7% (43 out of 60) of their covered members. These results showed a significant decline in MCO TPL verification from fiscal 2024. Questioned costs could not be determined for this finding as it would require readjudication of the claims against the third-party insurance coverage to determine if the service should have been submitted to that coverage prior to Medicaid covering the claims or related co-pay. Cause: Insufficient monitoring of TPL identification and cost avoidance by managed care organizations to ensure compliance with federal regulations. Effect: Possible noncompliance with federal regulations requiring cost avoidance or recovery of costs when third-party liability coverage is available. Overpayment of capitation and MCO contract settlement costs. Questioned Costs: Undetermined Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-064a Share and match identified TPL coverage with the MCOs annually. Periodic matching with MCO enrollment files would ensure that TPL coverage is consistently being applied throughout the Medicaid and CHIP programs. 2025-064b Evaluate options for identifying encounter data for existing TPL coverage and rejecting encounters that were not billed to other insurance before submission to Medicaid.

CHILDREN’S HEALTH INSURANCE PROGRAM – 93.767 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5021; 2505RI5021 Administered by: Executive Office of Health and Human Services (EOHHS) MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles HOSPITAL INPATIENT COST METHODOLOGY EOHHS did not update the DRG grouper within the MMIS as is required in the approved State Plan. Background: Inpatient hospital services are billed based on a Diagnosis-Related Group (DRG) assigned to the patient in which the hospital receives a single fixed payment instead of billing for individual services, tests, or supplies. Criteria: EOHHS amended State Plan (SPA RI-19-006, section p) requires the agency to review and update the DRG payment methodology annually. Condition: Audit testing performed over inpatient hospital claims identified one instance where the MMIS calculated the sampled claims payment using an incorrect fee schedule. During fiscal 2025 the MMIS utilized a DRG grouper that was several versions behind, however contracted with a vendor to update the coding of the older version. While EOHHS consistently employed the older DRG version when reimbursing hospital claims, it is not specifically complying with its approved State plan requiring annual updates to the payment methodology. Cause: The DRG grouper version within the MMIS was not updated in accordance with the State plan. Effect: Potential for inaccurate inpatient hospital claiming. Questioned Costs: None Valid Statistical Sampling: Yes RECOMMENDATION 2025-065 Review and update as needed the DRG annually or amend the State Plan to align with current practices.

MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Eligibility CONTROLS OVER MEDICAID ELIGIBILITY Operational and control deficiencies during fiscal 2025 resulted in noncompliance with federal regulations relating to Medicaid eligibility. Background: RIBridges, the State’s integrated eligibility system (IES) used to administer multiple federally funded human services programs, determines eligibility for Medicaid. Criteria: Medicaid eligibility requirements are detailed in the State Plan (Section 1115 Global Waiver). 42 CFR §435.940 through §435.960, which detail income and eligibility verification requirements for Medicaid, require State-administered public assistance programs to establish procedures for obtaining, using, and verifying information relevant to determinations as to eligibility and the amount of assistance. Section 1902(a)(4) of the Act allows the HHS Secretary to prescribe methods of administration found necessary for the proper and efficient operation of a State’s Medicaid plan. Medicaid Modified Adjusted Gross Income (MAGI) Determination and Validation policies are formalized within the RI Code of Regulations, Title 210, Executive Office of Health and Human Services, Chapter 30, Subchapter 00, Part 5, Policy 5.8, Verification Process. Part B of Policy 5.8 states: “B. The following lists key eligibility factors, the types of verification required for attestations, if any, and the verification sources for Medicaid Affordable Care Coverage (MACC) Group applicants/beneficiaries: 1. Identity – An applicant must provide proof of identity when applying through the IES or filing a paper application. The requirements related to identity proofing are set forth in Part 30-00-3 of Title 210. Certain applicants may not be able to obtain identity proofing through the federal hub due to data limitations. Pre-eligibility verification is required through an alternative electronic paper documentation source in these instances to establish an account. 2. Income – Electronic verification of attested income is required by the State. Multiple electronic data sources may be used for this purpose. In general, State data sources (such as State Wage Information Collection Agency (SWICA) UI) will be used first. The reasonable compatibility standard applies when there are discrepancies between the applicant’s income self-attestation and information from electronic data sources. 3. General Eligibility – Non-Financial Factors – (Social Security Numbers, Age, Citizenship, Death, Date of Birth, Residency, and Incarceration). Information on these eligibility factors is verified against various State and federal data sources. Information specific to verification requirements for MAGI populations is located in Part 30-00-3 of Title 210; for Medicaid and CHIP-funded eligibility more generally, the applicable provisions are set forth in Part 30-00-3 of Title 210.” Condition: For fiscal 2025, we tested a sample of 60 Medicaid eligible members (total population of eligibility segments for individuals with reported Medicaid eligibility during fiscal year 2025 totaled 424,939) for compliance with program eligibility. Total capitation payments claimed to Medicaid exceeded $2.1 billion (federal share - $1.2 billion) during fiscal 2025. In conjunction with our sample testing, we identified an instance where documentation supporting applicant citizenship (e.g., electronic Social Security Administration validation or applicant submitted documentation) was lacking. This exception resulted in questioned costs totaling $40 (federal share - $22) as the period of ineligibility was limited during the year and estimated likely federal questioned costs for the population totaled $125,810. The results from our testing indicated significant improvement over the prior year in correct eligibility determinations; however, the presence of control deficiencies continued to exist that significantly increased the risk of noncompliance and created challenges for EOHHS to effectively monitor continued eligibility with program requirements. In addition to evaluating eligibility determinations, we also tested recipient eligibility in conjunction with our testing of managed care capitation payments. Our testing of sampled managed care payments in fiscal 2025 also noted an exception where capitation payments totaling $1,983 (federal share - $1,117) were made for an ineligible individual. In this instance, RIBridges determined the individual ineligible for Medicaid but eligibility was not ended in the MMIS, allowing capitation payments to continue. In relation to this testing, we estimated likely questioned costs totaling $3,717,225 for instances where eligibility was not properly terminated in the MMIS. We also noted the following exceptions during our case reviews that were indicative of eligibility processing deficiencies that either did not impact member eligibility or where member eligibility could not be determined due to insufficient information: • Post Eligibility Verification was not performed on all eligible cases during quarterly runs (4 out of 60 cases). • Eligibility segment populated with incorrect recertification dates post processing of the recertification, impacting the timing of future recertifications (2 out of 60 cases). • Inconsistencies in case information between the MMIS and RIBridges (e.g., TPL). • Agency questioned the accuracy of Q2 PARIS data used in the quarterly match, suppressing any automated tasks to verify potential duplicate enrollment in other states. No alternative procedures were performed to validate Medicaid enrollment in other States. • Case information submitted by member was not properly updated in case record; and • Certain system tasks were not acted upon in a timely manner. These exceptions should be evaluated by management and addressed as they could have impacted the members’ eligibility determination had the related system controls operated effectively. In addition to the audit work described above, we performed data mining procedures which identified the following noncompliance with eligibility requirements: We conducted additional data mining procedures to further evaluate the operating effectiveness of the SWICA interface within RIBridges. Our analysis identified individuals with quarterly income in excess of $20,000 reported in the SWICA file obtained from the RI Department of Labor and Training for 5 consecutive quarters (quarter ending June 30, 2024 through the quarter ending June 30, 2025) that had Medicaid eligibility for the entirety of fiscal 2025. Our analysis identified 42 individuals with reported annual income in excess of $80,000 where excess income was not detected, and individuals remained eligible as of June 30, 2025. EOHHS will need to review these cases and determine why the system functionality did not operate effectively. These cases will also need follow-up to provide proper member notification and eligibility redetermination. The State continued to claim Medicaid Expansion enhanced reimbursement (90% Federal Medicaid Percentage) for certain members older than 65 during fiscal 2025. Our analysis identified 36 members where RI Medicaid failed to redetermine eligibility at age 65 - 6 of these members were older than age 67. We identified $210,703 in capitation paid for these members after the age of 65 (federal questioned costs - $189,633). While this issue was improved in fiscal 2025 controls were still found lacking to ensure that individuals were aged out of Medicaid Expansion upon turning age 65. During our audit, we performed procedures to identify currently enrolled members that were reported as deceased via the Rhode Island Department of Health’s (RIDOH) Vital records and the Social Security Administration (SSA) Death Master file. This analysis identified 2,078 deceased members (reported date of death prior to March 31, 2025 to allow for 90 days for identification and notification requirements) still active on Medicaid at June 30, 2025. The period by which the members remained active on Medicaid after reported death, the number of members, and the amount of capitation paid in fiscal 2025 subsequent to the month of death is summarized as follows: [See Schedule of Findings & Questioned Costs for Table] Controls to ensure timely termination of Medicaid enrollment upon death still appear lacking to prevent capitation payments from being made for deceased members. While capitation can be recouped once identified, the length of time that payments are continuing is significant and could span managed care contract settlement periods. To provide context on how long capitation payments can continue when member death is not detected timely, our analysis identified 604 members that had reported dates of death greater than 2 years. We identified capitation payments totaling $2.5 million for 2,078 deceased members that would be considered unallowable Medicaid payments (federal questioned costs - $1,974,299). We also analyzed instances where children initially coded eligible with expenditures funded under Medicaid were re-coded and remained coded at year-end to a State coverage program titled “Cover All Kids”. Cover All Kids provides State-funded eligibility for undocumented children residing in the State that otherwise meet Medicaid and CHIP eligibility requirements. Our analysis found that the coding error impacted approximately 441 cases within Medicaid during fiscal 2025. We conducted a detailed analysis of a sample of 25 cases charged to Medicaid (441 cases) or CHIP (45 cases) and found that none of the sample cases contained documentation of citizenship (interface validation or acceptable case documentation). Based on the sample results, we quantified the amount of capitation charged to Medicaid for the 441 individuals identified resulting in questioned costs totaling $344,889 (federal share – $193,086). EOHHS was unable to perform quarterly PARIS (Public Assistance Reporting Information System) matches for two quarters during fiscal 2025 as the data was unavailable or unreliable. No alternative processes were performed to compensate for the control activity not executed. Recent audits have noted that EOHHS has not been complying with federal requirements to evaluate PARIS notifications for Medicaid members by requiring those members to validate continued residency in the State. Our analysis of PARIS reporting during fiscal 2025 identified 1,601 members reported in the file where follow-up and residency validation was not conducted. The amount of capitation paid for Medicaid members no longer residing in the State was not determinable and will require EOHHS follow-up as required by federal regulations. Cause: Noncompliance with Medicaid eligibility requirements was caused primarily by specific programming deficiencies within RIBridges (e.g., failure to redetermine Medicaid Expansion members upon age 65, interface validations not operating as designed, untimely termination of deceased members). Continued differences in eligibility reported between the MMIS and RIBridges also resulted in noncompliance with federal requirements for eligibility. Effect: Noncompliance with federal requirements relating to recipient eligibility for Medicaid. Questioned Costs: $2,358,157 Valid Statistical Sampling: Yes RECOMMENDATIONS 2025-066a Address and correct the eligibility system and process deficiencies (e.g., SWICA interface, Medicaid Expansion age-out, citizenship verification, death reporting, PARIS reporting) which weaken controls and result in noncompliance with federal regulations regarding Medicaid eligibility. 2025-066b Implement procedures to identify noncompliance resulting from eligibility system and process deficiencies so that cases can be worked manually to resolve long-standing instances of noncompliance detected by external audits and MEQC processes. 2025-066c Identify ineligible Medicaid costs and return to the federal grantor.

MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER STATE HOSPITAL CLAIMING Controls need to be improved to ensure that claims from the State Hospital are reimbursed by Medicaid as the payer of last resort. Criteria: Federal regulations require Medicaid to be the “payer of last resort.” This means that all third party insurance carriers, including Medicare and private health insurance carriers, must be billed before Medicaid processes the claim. Condition: Unlike similar providers that claim reimbursement to Medicaid, claims submitted by Eleanor Slater Hospital (ESH), a State-operated hospital, are not edited to ensure that ESH has sought reimbursement from Medicare before seeking reimbursement from Medicaid. Normal processing requires the provider to submit to Medicaid an “explanation of benefits” (EOB) from Medicare which shows that Medicare was billed and was not reimbursed or only partially reimbursed for the claim based on the individual’s remaining benefits. The amount of claims, if any, inappropriately reimbursed by Medicaid could not be determined. Cause: Controls over State Hospital claiming were inadequate to ensure compliance with federal regulations requiring Medicaid to be the payer of last resort. Effect: Ineligible reimbursements by Medicaid for Eleanor Slater Hospital claims for members with other insurance coverage (predominantly Medicare). Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATION 2025-067 Ensure that claiming from Eleanor Slater Hospital is subject to edits for other insurance to ensure that Medicaid is the payer of last resort.

MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER OPIOID TREATMENT PROGRAM (OTP) BILLING The Medicaid Program disbursed $875,696 in potential improper payments for Opioid‑Use‑Disorder treatment services furnished by Opioid Treatment Programs between January 1, 2023 and December 31, 2024. Background: The Medicaid State Plan establishes a weekly bundled payment methodology for Opioid Treatment Program (OTP) services, under which providers must submit a single weekly bundled claim that includes all covered services. Daily billing of H0020 encounters is not authorized. Collectively, these criteria require that OTP services be billed as a weekly bundle rather than as multiple daily encounters. Criteria: Federal regulations, specifically 42 U.S.C. §1396a(a)(30)(A), requires states to administer their programs in a manner that ensures payments are economical, efficient, and free from unnecessary or duplicative utilization. Provider regulations at 210‑RICR‑50‑00‑1 require Medicaid providers to comply with all billing rules and methodologies set by EOHHS, while RI General Law §40‑8.2‑4 requires providers to return overpayments. Condition: In conjunction with a joint audit with the federal Department of Health and Human Services (DHHS), Office of Inspector General (OIG), we identified and validated 6,347 potential OTP claims where the Medicaid program reimbursed Opioid Treatment Programs for daily methadone encounters instead of the required weekly bundled methadone claim (H0020). We independently verified the claim data provided by the OIG was consistent with encounter data submitted by the respective managed care providers (from data provided by EOHHS), resulting in $875,696 (federal share - $656,919) in potential overpayments. In many instances, OTP providers submitted five to seven daily methadone claims for the same beneficiary within a single week, causing the State to pay several times more than the established weekly bundled rate. Cause: The primary causes of these improper payments were OTP provider noncompliance with the required weekly bundled billing methodology and the absence of adequate system controls within the MMIS to detect and prevent provider billing noncompliance. Effect: Noncompliance with Medicaid billing policies resulting in improper payments by the Medicaid program. Questioned Costs: $656,919 Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-068a Conduct a full review of all OTP H0020 claims - both adjudicated and pending - to determine compliance with the weekly bundled methodology and calculate the total amount of overpayments. Recover amounts from OTP providers determined to be improper payments and return the federal share of those payments to the federal government. 2025-068b Implement system edits within the MMIS to prevent payment of daily H0020 claims when a weekly bundled claim is required and ensure that no more than one weekly OTP bundled claim is paid per beneficiary per week. 2025-068c EOHHS should strengthen provider education and issue updated billing guidance to reinforce weekly bundling requirements for OTP services. 2025-068d Implement enhanced post‑payment monitoring and periodic audits to ensure ongoing compliance and prevent recurrence of improper billing.

MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER COMPLIANCE WITH FEDERAL AND STATE REQUIREMENTS FOR OPIOID TREATMENT PROGRAM (OTP) SERVICES REIMBURSED BY MEDICAID The Department of Behavioral Healthcare, Developmental Disabilities & Hospitals (BHDDH) needs to improve its oversight and monitoring of Opioid Treatment Program (OTP) providers to ensure provider compliance with federal and State regulations relating to the delivery of medication assisted treatment. Criteria: Federal and State regulations (42 CFR §8.12 and 212‑RICR‑10‑10‑1.6.14) require Opioid Treatment Program (OTP) providers to maintain adequate recordkeeping systems, document all services delivered, and ensure that services furnished to Medicaid beneficiaries comply with all applicable licensing and regulatory requirements. The Department of Behavioral Healthcare, Developmental Disabilities & Hospitals (BHDDH) is responsible for overseeing OTP providers to ensure compliance with these standards. Condition: In conjunction with a joint audit with the U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG), we reviewed a sample of 100 OTP medication assisted treatment (MAT) services to evaluate provider compliance with State and federal requirements. Compliance with requirements for biopsychosocial assessments, treatment plans, required counseling services, annual medical examinations, and toxicology testing mandated to be performed in conjunction with MAT services were found lacking for all OTP providers. During the audit period, BHDDH conducted biennial audits that reviewed only about 10 percent of each OTP provider’s patient charts. Based on our audit results, BHDDH’s current monitoring procedures were not found to be effective ensuring compliance with State and federal requirements for OTP MAT services. While the noncompliance cited could impact the overall effectiveness of the OTP program, we did not question the costs for the sampled services since the Medicaid client remained actively receiving MAT in the program. Cause: Biennial audits performed by BHDDH’s Licensing and Regulatory Compliance unit were not effectively ensuring provider compliance with federal and State requirements. BHDDH did not compile and evaluate provider results in a manner sufficient to determine if its monitoring procedures were effectively ensuring compliance. Effect: BHDDH lacked assurance that OTP services provided to Medicaid beneficiaries were properly documented, monitored, and compliant with federal and State regulations. This insufficient oversight increased the risk of widespread noncompliance across OTP providers and weakened program integrity controls intended to safeguard patient care and regulatory adherence. Questioned Costs: None Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-069a Improve monitoring and oversight procedures to ensure compliance with federal and State requirements. 2025-069b Improve technical assistance, including mandated periodic training, to OTP providers to support the development and maintenance of adequate recordkeeping systems and compliance with federal and State regulations. 2025-069c Accumulate provider audit results to allow for evaluation of provider compliance and to allow for better targeting of provider audits and education efforts.

MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles CONTROLS OVER COMMUNITY HEALTH WORKER (CHW) PROVIDERS ENROLLMENT AND CLAIMING Controls over CHW provider enrollment and claiming needs to be improved to ensure that only allowable costs are reimbursed by the Medicaid program. Background: Community Health Worker (CHW) providers are front line public health professionals who often have similar cultural beliefs, chronic health conditions, disability, or life experiences as other people in the same community. CHW providers link people to needed health information and services with the intent to prevent disability, disease and the progression of other health conditions while improving access to, quality of, and cultural responsiveness of service providers. In 2021, the Rhode Island Department of Health (RIDOH) received a competitive grant award from the US Centers for Disease Control and Prevention (CDC) to train, deploy and engage CHW providers as part of the States Health Equity Zones Initiative, and as a result Medicaid billing by CHW providers has increased year over year through fiscal 2025. Criteria: Federal regulations require the State Medicaid Agency to screen and enroll all providers in accordance with 42 CFR Part 455, Subpart E. Rhode Island Regulation (210-RICR-20-00-1.7) states, “To be eligible to participate in the Rhode Island Medicaid program as any provider type, a provider must: (1.) Be fully licensed, certified, registered, and/or credentialed, where required by the State, as an active practitioner by the agency or board overseeing the specific provider type.” 2 CFR §200.303(a) requires recipients and subrecipients of federal assistance to establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: A review by the Office of Program Integrity (OPI) identified a significant increase in claiming by CHW providers which prompted investigation and proposed changes to the State Approved Plan requiring (1) all CHW providers to be screened for required certifications and background checks and (2) the creation of system edits capping the allowable service time billed for each beneficiary. Prior to the State’s proposed change to its approved State Plan (May 2025), all newly and currently enrolled Community Health Worker providers were not screened to ensure certification with the Rhode Island Certification Board. System edits within the MMIS were lacking to prevent excessive billing or billing for CHW services not rendered. OPI continues to investigate the claiming of CHW providers to determine the extent of unallowable costs reimbursed through the Medicaid Program. The amount of questioned costs for this claim group is believed to be significant but have not been determined or concluded at this time. OPI continues to review the claiming activity for this provider group and is properly referring provider cases to the Medicaid Fraud Control Unit at the Attorney General’s office when appropriate. Cause: Insufficient screening of enrolled CHW providers compounded with a lack of system edits in the claims adjudication process. Effect: Potential fraud, program abuse, and overpayments. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-070a Screen all newly and currently enrolled CHW providers not previously subjected to certification and background check criteria. 2025-070b Review prior CHW claims to identify overpayments or potential fraud. Refer fraud to the Medicaid Fraud Control Unit for investigation and possible recovery.

MEDICAID CLUSTER – 93.775, 93.777, 93.778 Federal Awarding Agency: U.S. Department of Health and Human Services (HHS) Federal Award Fiscal Years: 2024; 2025 Federal Award Number: 2405RI5MAP; 2505RI5MAP Administered by: Executive Office of Health and Human Services (EOHHS) Compliance Requirement: Allowable Costs/Cost Principles PAYMENTS MADE TO CERTIFIED COMMUNITY BEHAVIORAL HEALTH CLINICS (CCBHC) FOR UNSUPPORTED CLAIMS Implement controls to prevent payments for unsupported or denied CCBHC claims. Background: Certified Community Behavioral Health Clinics (CCBHC) are reimbursed through a predetermined rate, required by the prospective payment system (PPS), for services provided based on the acuity level of the individual rather than by individual claim. Criteria: Federal regulations require payments to providers to be for incurred and allowable services and that the State performs system audits and edits within the MMIS in adjudicating the claim. Condition: While CCBHC are paid on a predetermined PPS, EOHHS requires providers to submit claims for the individuals’ qualifying services provided. EOHHS utilizes the claims detail also known as “shadow data/shadow billing” in validating the services provided. The “shadow” claim is the triggering event that causes the PPS payment. During fiscal 2025, it was identified that payments were made to CCBHC for denied or unsupported claims. EOHHS’s OPI has identified certain provider billings as potential noncompliance with program regulations. OPI continues to review the claim activity for CCBHC to determine the amount of noncompliance and potential remediation actions needed. The amount of noncompliance has not yet been determined by EOHHS. Cause: No controls in the MMIS to prevent the payment of PPS for claims without a triggering event. Effect: Possible improper payments to providers. Questioned Costs: Undetermined Valid Statistical Sampling: Not Applicable RECOMMENDATIONS 2025-071a Modify MMIS edits to prevent PPS for denied or unsupported claims. 2025-071b Review prior CCBHC claims to identify potential overpayments and seek recovery for repayment to the federal grantor. 2025-071c Refer cases of questionable or unsupported billing to the Medicaid Fraud Control Unit, if determined appropriate.