Audit 409119

FINDING NO: 2024-083 (Repeat 2023-069) Strengthen Internal Controls Over the G1DX Exception Resolution Process STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: United States Department of Agriculture (USDA) ALN: 10.551 FEDERAL PROGRAM NAME: SNAP Cluster FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Special Tests and Provisions – ADP System for SNAP QUESTIONED COSTS: $0 Condition and Context: The G1DX System is an OKDHS application that compares client information entered by a OKDHS employee and OKDHS IEVS information sources as they are periodically updated. These sources include: • Wage information for the State Wage Information Collection Agency (SWICA) • Unemployment Compensation (UC) • All available information from the Social Security Administration (SSA) • Information from the U.S. Citizenship and Immigration Services • Unearned Income from the Internal Revenue Services (IRS) The purpose of the GIDX Exception and Clearance Report is to report discrepancies detected between agency data and external data sources and then notify staff to promptly address discrepancies so that case information remains accurate, reliable, and compliant with federal program requirements. The Exception and Clearance Report summarizes these discrepancies by worker, supervisor, county, and area, which allows management to monitor not only the type of discrepancy and length of days outstanding, but also to distinguish who is responsible for clearing the discrepancy within the 45 days allowed under current federal regulation and OKDHS policy. We reviewed the state fiscal year (SFY) 2024 (July 1, 2023 – June 30, 2024) G1DX Exception and Clearance Reports to determine whether data exchange discrepancy (exception) messages were resolved within the required 45 calendar days from the date the message was posted on the data exchange inquiry screen. Because the system used to compile the discrepancy messages does not distinguish messages by individual program, our review was conducted at the error type level rather than by program. Therefore, the discrepancies listed below represent a combined set of issues across multiple programs and may not apply to each program individually. Our review determined that 280,897 of the total 590,942 exceptions, or 47.53%, were not resolved within the required 45 calendar day period. The schedule below outlines the specific exceptions by error type and their corresponding delays. ERROR TYPE OPEN & RESOLVED G1DX EXCEPTIONS OVER 45 DAYS TOTAL OPEN & RESOLVED G1DX EXCEPTIONS % OF EXCEPTIONS OVER 45 DAYS BEN 29,366 82,923 35.41% CSE 3,027 4,633 65.34% DOD 34 88 38.64% ENU 17,800 22,945 77.58% IEV 4,407 13,452 32.76% NNH 92,641 179,866 51.51% OWG 49,626 91,048 54.51% PRS 2,446 4,364 56.05% SDX 32,681 97,589 33.49% SNH 44,862 84,069 53.36% UIB 4,007 9,965 40.21% TOTAL 280,897 590,942 47.53% Cause: The OKDHS G1DX exception clearing process in place did not provide a sufficient internal control structure to enable management to effectively monitor the status of G1DX discrepancy resolutions and ensure adequate staffing for timely processing. Because the current controls do not provide accountability or oversight, OKDHS failed to ensure that discrepancies were resolved within the required 45 days. Effect: The untimely resolution of discrepancies not only elevates the risk of program benefits being provided to ineligible individuals, but also elevates the risk of delayed benefits to eligible individuals, Recommendation: We recommend OKDHS enhance its monitoring activities by timely reviewing Exception and Clearance reports created for the G1DX discrepancies, ensuring adequate staff have effective tools and training to timely clear the exception, and holding all responsible individuals accountable. Additionally, we recommend OKDHS establish and follow policies and procedures outlining how the monitoring reports should be used and by whom to ensure discrepancies are timely resolved within the required 45 days. Criteria: 2 CFR Part 200 (June 30, 2024), Appendix XI, Part 4 applicable to the Temporary Assistance for Needy Families program, requires each State to participate in the Income Eligibility and Verification System (IEVS) required by section 1137 of the Social Security Act, as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. 45 CFR 205.56(a)(1)(iv) (June 30, 2024) states in part: “For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary… .” OAC 340:65-3-4(4)(C) states in part: “Automated data exchange with other agencies provides OKDHS with information regarding household members' benefits, wages, taxes, Social Security numbers, and current addresses. The system compares information obtained electronically with data stored within OKDHS electronic records to determine if there are discrepancies that need to be addressed. Automated data exchange information is also available within the OKDHS system to determine discrepancies. The worker is responsible for resolving data exchange discrepancy messages within 45-calendar days of the date the message is posted on the data exchange inquiry screen.” 45 CFR 75.303 (June 30, 2024) states: “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Views of Responsible Official(s): Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: 10/5/2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-052 (Repeat 2023-023; 2022-007) Strengthen Internal Controls Over the Electronic Benefit Transaction (EBT) Card Security STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: United States Department of Agriculture (USDA) ALN: 10.551 / 10.561 FEDERAL PROGRAM NAME: SNAP Cluster FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Special Tests & Provisions – EBT Card Security QUESTIONED COSTS: $0 Condition and Context: When a client needs a card printed at an OKDHS county office, a county worker will initiate the process of printing an EBT card. Then someone from the Electronic Payment Services (EPS) group, who is separate from the county staff, will authorize the printing of a new EBT card at the initiating county location. Based on procedures performed on 72 of 248 daily EBT Administrative Activity Reports from July 1, 2023 – June 30, 2024 (SFY 2024) we noted: • Thirteen (18.06%) daily reports indicated there was “CARD PRINTED” activity by an employee who was not in the EPS group. EBT cards that are returned to OKDHS are to be destroyed, and to ensure that an employee won’t steal and use the benefits, two employees are to be present and sign that they were present for the destruction of the EBT card. Based on procedures performed on 72 of 6,577 EBT cards present on DHS destruction logs from SFY 2024 we noted: • One (1.39%) card was destroyed by only one staff member. EBT cards are to be considered accountable documents and are to have inventory control records. To ensure that EBT card inventory is accurate, two staff are to inventory and reconcile EBT card stock every time the inventory is accessed, and to keep records of any additions or removals to the inventory. Based on procedures performed at 9 of 43 county office locations, we noted: • Eight (88.89%) county offices where the cards were not reconciled daily by two staff (EBT Daily Card Issuance Report) and reconciliations were not mathematically accurate. • Five (55.56%) county offices where the email request for new EBT card stock was not retained by staff. To curb trafficking and theft OKDHS monitors the number of EBT cards that are printed for a case and notifies a household of excessive card reprints (4 card prints in a 12-month period) and the number of cards printed. OKDHS also notifies the OKDHS Oklahoma Inspector General (OIG) of cases that are suspected of trafficking, misuse, or fraud. Based on procedures performed on excessive EBT card reprints in SFY24 we noted: • Excessive card reprint notices mailed to households begin when the fourth card, in a 12-month period, is printed. If subsequent card reprints occur in the 12-month period, the notices are updated with the current number of card reprints. However, for instances of eight card reprints or greater, the notices state seven cards were reprinted. • Notifications of excessive card reprints were not sent out after October 20, 2023. • Criteria used to evaluate possible EBT Card trafficking during SFY24 could not be produced by the agency. • EBT transactions were not monitored for possible misuse or fraud in SFY24. Cause: Internal controls are not being followed consistently to ensure OKDHS inventory accounting, unauthorized transfer/issuance, and destruction of EBT cards are consistently followed by field employees. Additionally, internal controls are not in place to monitor possible trafficking, misuse, or fraud of EBT cards. Effect: EBT cards are at risk of improper use and possible misappropriation of Supplement Nutrition Assistance Program (SNAP) benefits. Recommendation: We recommend OKDHS provide training to SNAP employees to ensure policies and procedures related to inventory accounting, security, transfer/issuance, and the destruction process of SNAP cards are understood and consistently followed. Additionally, we recommend DHS management implement procedures to monitor the county office locations for compliance with these policies and procedures throughout the year. We also recommend OKDHS revisit their systematic process of excessive card printing notices to ensure notices are set to print when four or more SNAP cards are printed for a case in a 12-month period and the proper information is relayed to their clients. We further recommend OKDHS establish and implement policies and procedures to provide guidance to identify possible trafficking, fraud, or misuse of SNAP cards. Criteria: The Government Accountability Office (GAO) Standards for Internal Control in the Federal Government 10.10 states “Transaction control activities are actions built directly into operational processes to support the entity in achieving its objectives and addressing related risks. “Transactions” tends to be associated with financial processes (e.g., payables transactions), while “activities” is more generally applied to operational or compliance processes. For the purposes of this standard, “transactions” covers both definitions. Management may design a variety of transaction control activities for operational processes, which may include verifications, reconciliations, authorizations and approvals, physical control activities, and supervisory control activities”. 7 CFR § 274.1(h)(2) states in part “If issuance functions in an office are handled by one person, a second-party review shall be made to verify card inventory, the reconciliation of the mail log, and the number of mailings prepared.” 7 CFR § 274.6 Replacement issuance and cards to households states in part “(b)(6) Excessive Replacement Card Notice. The State agency shall monitor all client requests for EBT card replacements and send a notice, upon the fourth request in a 12-month period, alerting the household that their account is being monitored for potential, suspicious activity. If another replacement card is subsequently requested and trafficking is suspected, the State agency shall refer that case to the state’s fraud investigation unit. (ii) The State agency shall notify the household in writing upon their fourth card request that their case is being monitored. This notice shall, at a minimum: (C) Specify the number of cards requested and over what period of time;” OAC 340:50-10-5 Replacement of lost, stolen, or destroyed Electronic Benefit Transfer (EBT) cards states in part “(2) The worker requests the Oklahoma Department of Human Services (DHS) Financial Services Electronic Payment Services (EPS) Unit assistance in issuing a replacement card…” According to DHS’ Electronic Payments Handbook, • “EPS prints Initial Cards for cardholders in the county office.’ “EPS will print replacement cards to the County Office based upon the conditions listed…” • “EBT cards are counted and recorded each and every time the EBT card inventory is accessed. For example, designated staff count and record the EBT card inventory in each of the following circumstances: o Upon receipt of new cards (from another office, or the vendor), o When removing cards from the bulk inventory in secure storage, and o When returning unused cards to secure storage at the end of the day.” • “Documenting card inventory is completed on the EBT Daily Card Issuance Report …” • “At the completion of each day, both the designated EBT staff and their supervisor review and sign the report (the EBT Daily Card Issuance Report) … .” • “Retain a copy of the email order and the confirmation reply for verification purposes ... .” • Returned or Damaged cards must be properly recorded, deactivated, and destroyed under the following procedures: o Upon receipt of the card(s), two personnel must complete this process -one staff who destroys the card, and another who witnesses the destruction. Best practice is for the witness to be supervisory level staff. Best practice includes the security of Electronic Benefit Transaction (EBT) cards, which includes the daily reconciliation of EBT cards, and deactivation of an EBT card prior to destruction. Views of Responsible Official(s): Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: Substantially complete Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

Finding No: 2024-101 Strengthen controls for capturing and reporting transactions on the SEFA State Agency: Oklahoma Department of Health Federal Agency: United States Department of Health and Human Services Assistance Listing Number: 10.557 Federal Program Name: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Federal Award Number: 6OK700505 Federal Award Year: 2023, 2024 Compliance Category: Reporting Questioned Costs: Unknown Criteria: The Schedule of Expenditures of Federal Awards (SEFA – GAAP Package Schedule Z) should be accurately captured, reconciled, and reviewed by the Oklahoma State Department of Health (the “Department”). Adequate documentation of procedures performed, as well as evidence of thorough reviews, should be in place. According to GAAP, expenditures should be recognized in the period services are performed or goods are received. In accordance with the modified accrual basis of accounting, federal grant revenues should be recognized when applicable eligibility requirements, including reimbursement, time requirements, and other eligibility requirements, are met and the resources are available. Revenues are considered available when they are collectible within the current period or soon enough thereafter to pay liabilities of the current period. In accordance with the State of Oklahoma’s Annual Comprehensive Financial Report, the State considers revenues to be available if they are collected within sixty days of the end of the fiscal year. Lastly, the Uniform Guidance (2 CFR 200.510) requires an auditee to “prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the auditee’s financial statement [that] … at a minimum shall … list individual Federal programs by Federal agency … [and] provide total Federal awards expended for each individual Federal program … [and] include the total amount provided to subrecipients for each Federal program.” In accordance with Uniform Guidance, the Department is required to maintain a structure of internal control to ensure compliance with applicable reporting requirements. Furthermore, the State of Oklahoma’s Schedule Z SEFA Conversion Package states, “The amount reported as provided by the primary recipient to state agencies should be entered in the ‘Amount Transferred to State Agencies’ column. This amount should be included in the Federal revenue but not in expense columns of the primary recipient.” The Government Accountability Office (GAO) Standards for Internal Control in the Federal Government 10.03 states, in part, “Management designs appropriate types of control activities for the entity’s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.” Additionally, GAO Standards for Internal Control in the Federal Government 10.03 states, in part, “Transactions are promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from its initiation and authorization through its final classification in summary records. In addition, management designs control activities so that all transactions are completely and accurately recorded.” Condition: The Department was unable to provide support that recorded transactions agree to the federal revenues reported in Schedule Z. Cause and Effect: The Department does not have appropriate internal procedures for capturing and reporting the federal expenditures and revenues on the SEFA in accordance with the Uniform Guidance (2 CFR 200200.510). Revenues are recorded by the Department on a cash basis and deposits are not recorded in the general ledger (GL) with a unique identifier to indicate which fiscal year in which the matching expenditures reside. Also, batched cash deposits containing sources of revenues from differing fiscal years cannot be appropriately allocated to the year in which the revenue was earned. Batched deposits are recorded as a single GL transaction regardless of the year in which the related deposit was earned and contain revenues for which the related expenditures were recorded in differing fiscal years. As a result, the Department’s GL does not possess sufficient detail to accurately account for the required modified accrual basis conversions. The Department has not ensured that the transactional data recorded provides enough detail to accurately report the federal activity in Schedule Z. Recommendation: We recommend the Department review and document the current procedures and implement the necessary changes to ensure adequate reporting of program financial information in the SEFA. Specifically, we recommend the Department continue to review its cash reporting and decipher batch deposits by fiscal year, with a unique identifier recorded at the GL transaction level. Additionally, we recommend retaining evidence that adequate reviews of the SEFA occurred. We also recommend the Department establish procedures to timely reconcile federal revenues to its federal expenditures to ensure completeness of its related federal reporting. Views of Responsible Official(s) Contact Person: Ryon Fields, Interim CFO Anticipated Completion Date: 6/30/26 Management Response: The Oklahoma State Department of Health agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

Finding No: 2024-107 Payroll Timekeeping and Payroll Report Monitoring State Agency: Oklahoma Department of Health Federal Agency: United States Department of Health and Human Services Assistance Listing Number: 10.557 Federal Program Name: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Federal Award Number: 6OK700505 Federal Award Year: 2023, 2024 Compliance Category: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Questioned Costs: None Criteria: 7 CFR 246.13 - Financial Management System, states in part: “(b) Internal control. The State agency shall maintain effective control over and accountability for all Program grants and funds.” The Government Accountability Office (GAO) Standards for Internal Control in the Federal Government 10.03 states, in part, “Management designs appropriate types of control activities for the entity’s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.” Additionally, GAO Standards for Internal Control in the Federal Government 10.03 states, in part, “Transactions are promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from its initiation and authorization through its final classification in summary records. In addition, management designs control activities so that all transactions are completely and accurately recorded.” Condition: During state fiscal year (SFY) 2024, recorded payroll costs did not accurately reflect the Oklahoma State Department of Health’s (the “Department”) time and effort. Additionally, the Department neglected to perform its existing control activities of timely reviewing time and effort against the payroll expenses recorded in the general ledger. Cause and Effect: The Department did not have adequate internal controls in Workday to limit employee access profiles, which allowed all timecodes to be available for use regardless of an employee’s specific job position and function. Moreover, incorrect timecodes were selected by the employees when completing their timecards and supervisors approved employee timecards without thoroughly reviewing to detect and correct these errors. Inadequate internal control policies and procedures over the payroll cycle could result in an increased risk of non-compliance with federal requirements, and an inability to comply with audit requirements. Recommendation: We recommend the Department continue to monitor the employee access of timecodes related to their specific job function and projects. Supervisors should thoroughly review timecards prior to approval. Additionally, the Department should timely monitor time and effort against recorded payroll to ensure grants are not over or under charged and reconcile validated time to booked payroll costs regularly. Views of Responsible Official(s) Contact Person: Ryon Fields, Interim CFO Anticipated Completion Date: 6/30/27 Management Response: The Oklahoma State Department of Health agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-088 Strengthen Internal Controls over CSFP Documentation STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: United States Department of Agriculture (USDA) ALN: 10.565 FEDERAL PROGRAM NAME: Food Distribution Cluster FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2023, 2024 CONTROL CATEGORY: Eligibility, Special Tests and Provisions: Accountability for USDA Foods QUESTIONED COSTS: $0 Condition and Context: OKDHS partners with two food banks (Regional Food Bank of Oklahoma and Food Bank of Eastern Oklahoma) who then partner with local pantries to administer Commodities Supplemental Food Program (CSFP) kits. The two food banks provide each local pantry with a specific number of USDA CSFP kits each month. The local partners maintain receiving and distribution records of CSFP kits. During testwork of ten of the 33 local pantries we noted one (10%) local pantry did not maintain CSFP kit receiving or distribution records for the three months tested (September 2023, October 2023, and April 2024). For the same ten local pantries, we also observed whether USDA CSFP kits were on hand the day we visited each local pantry. We also reviewed the receiving and distribution records for the applicable time period to ensure all USDA CSFP kits received were distributed and/or on hand. For one of ten (10%) pantries visited, we noted 48 kits were received per the 4/30/26 invoice (receiving document) and 28 kits were distributed; however, 0 kits were on hand at the local pantry resulting in 20 unaccounted for USDA CSFP kits. Through discussion with the local pantry site manager, it was determined kits at this pantry are delivered to participants but either the delivery person or the site manager sign for all the kits on the distribution log as opposed to the CSFP kit recipient. Cause: There is a lack of internal controls at the local pantry to ensure proper accountability of USDA CSFP kits. Additionally, OKDHS and the food banks have insufficient internal controls to ensure USDA CSFP kits are properly accounted for and supporting documentation is adequately maintained. Effect: The lack of USDA CSFP kit records may result in misuse or theft of USDA CSFP kits. Recommendation: We recommend the agency strengthen internal controls and develop written policies and procedures to ensure the CSFP local partners are retaining USDA CSFP kit records to ensure accurate receiving and distribution accountability. We further recommend OKDHS establish and implement written policies and procedures requiring the food banks perform monitoring visits of their local pantries. Lastly, we recommend OKDHS hire additional staff to perform monitoring of the food banks and food pantries more frequently. Criteria: 45 CFR 75.303 states: “The non-Federal entity must a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 7 CFR 247.5 states: “State and local agencies are responsible for administering the program in accordance with the provisions of this part, and with the provisions of part 250 of this chapter, as applicable. Although the State agency may delegate some responsibilities to another agency, the State agency is ultimately responsible for all aspects of program administration. The following is an outline of the major responsibilities of State and local agencies; it is not intended to be all-inclusive. (a) What are the major responsibilities shared by State and local agencies? The major responsibilities shared by State and local agencies include: 1) Entering into required agreements; 2) Ordering USDA Foods for distribution; 3) Storing and distributing USDA Foods; 4) Establishing procedures for resolving complaints about USDA Foods; 5) Complying with civil rights requirements; 6) Maintaining accurate and complete records; and 7) Conducting program outreach. 7 CFR 247.10 states in part: “(a) What are the requirements for distributing USDA Foods to participants? The local agency must distribute a package of USDA Foods to participants each month, or a two-month supply of USDA Foods to participants every other month, in accordance with the food package guide rates established by FNS. (b) What must the local agency do to ensure that USDA Foods are distributed only to CSFP participants? The local agency must have a process in place, in accordance with State agency requirements, to verify the identity of participants or the participant's proxy before distributing USDA Foods to that person. 7 CFR 247.29 states: “(a) What recordkeeping requirements must State and local agencies meet? State and local agencies must maintain accurate and complete records relating to the receipt, disposal, and inventory of USDA Foods, the receipt and disbursement of administrative funds and other funds, eligibility determinations, fair hearings, and other program activities. State and local agencies must also maintain records pertaining to liability for any improper distribution of, use of, loss of, or damage to USDA Foods, and the results obtained from the pursuit of claims arising in favor of the State or local agency. All records must be retained for a period of three years from the end of the fiscal year to which they pertain, or, if they are related to unresolved claims actions, audits, or investigations, until those activities have been resolved. All records must be available during normal business hours for use in management reviews, audits, investigations, or reports of the General Accounting Office. 7 CFR 247.34 states: “(a) What must the State agency do to ensure that local agencies meet program requirements and objectives? The State agency must establish a management review system to ensure that local agencies, subdistributing agencies, and other agencies conducting program activities meet program requirements and objectives. As part of the system, the State agency must perform an on-site review of all local agencies, and of all storage facilities utilized by local agencies, at least once every two years. As part of the on-site review, the State agency must evaluate all aspects of program administration, including certification procedures, nutrition education, civil rights compliance, food storage practices, inventory controls, and financial management systems. In addition to conducting on-site reviews, the State agency must evaluate program administration on an ongoing basis by reviewing financial reports, audit reports, food orders, inventory reports, and other relevant information. Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: In Progress Corrective Action Planned: The Department of Human Services partially agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-076 Strengthen Internal Controls over Performing Eligibility Determinations STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: United States Department of Agriculture (USDA) ALN: 10.565/10.568/10.569 FEDERAL PROGRAM NAME: Food Distribution Cluster FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Eligibility QUESTIONED COSTS: $0 Condition and Context: OKDHS partners with two food banks (Regional Food Bank of Oklahoma and Food Bank of Eastern Oklahoma) who then partner with local pantries to administer The Emergency Food Assistance Program (TEFAP) and Commodities Supplemental Food Program (CSFP). We tested program applications at 10 of the 33 local food pantries that administer both TEFAP and CSFP. Of these 10 food pantries, we found 1 (10%) pantry failed to keep CSFP program applications (eligibility records) from July 2023 through December 2023, although they are required to be retained for three years. Cause: There is a lack of internal controls at the local pantry to ensure records are retained for three years. Further, OKDHS lacks internal controls to ensure local pantries or any entity determining participant eligibility retains program applications for three years. While OKDHS reviews the program application (blank) being used at the local pantry, they are not performing reviews of completed applications to ensure eligibility is determined correctly. Effect: Individuals who are not eligible may receive CSFP commodities. Further, without support of participant eligibility the USDA may reduce the amount of funds available to provide commodities to those over 60. Recommendation: We recommend the OKDHS strengthen its internal controls to ensure adequate reviews and/or monitoring of the CSFP eligibility applications at the food pantry level. We further recommend OKDHS strengthen internal controls and establish training to ensure the local food pantries understand the importance of maintaining supporting documentation and having those records available for review. Criteria: 45 CFR 75.303 states: “The Non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 7 CFR 247.4(b)(2) states in part: “All agreements described under paragraphs (a)(2) and (a)(3) of this section must contain the following:…An assurance that each agency will maintain accurate and complete records for a period of three years from the close of the fiscal year to which they pertain, or longer if the records are related to unresolved claims actions, audits, or investigations;”… 7 CFR 247.5 states in part: “State and local agencies are responsible for administering the program in accordance with the provisions of this part, and with the provisions of part 250 of this chapter, as applicable. Although the State agency may delegate some responsibilities to another agency, the State agency is ultimately responsible for all aspects of program administration”... 7 CFR 247.5 (a)(6) states in part: “The major responsibilities shared by State and local agencies include:…Maintaining accurate and complete records”… 7 CFR 247.5 (b)(5) states in part: “The major responsibilities of State agencies include:…Establishing eligibility requirements, in accordance with the options provided to the State agency under § 247.9. (This function may not be delegated to another agency.)”… 7 CFR 247.5 (c)(1) states in part: “The major local agency responsibilities include:…Determining eligibility of applicants in accordance with eligibility criteria established by the State agency”… Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: In Progress Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-079 Strengthen Internal Controls over Performing Subrecipient Eligibility Determinations STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: United States Department of Agriculture (USDA) ALN: 10.565/10.568/10.569 FEDERAL PROGRAM NAME: Food Distribution Cluster FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Eligibility QUESTIONED COSTS: $0 Condition and Context: We tested 10 out of 40 new food pantry agencies who joined either The Emergency Food Assistance Program (TEFAP) or Commodities Supplemental Food Program (CSFP) in SFY24. Of these 10 food pantries, we found that for 1 (10%) food pantry DHS and the food bank partner failed to provide a DHS signed CSFP Agreement or Civil Rights Questionnaire. Therefore, DHS was unable to confirm CSFP program eligibility for a subrecipient who provides CSFP benefits to the public. Cause: The internal controls DHS has in place, which should require subrecipient eligibility records to be signed by an authorized DHS representative, did not promote adequate performance of CSFP subrecipient eligibility processes and record retention at the food pantry, food bank, and DHS level. Effect: With inadequate retention of CSFP subrecipient eligibility records, ineligible subrecipients may have participated in the CSFP program and DHS could not ensure CSFP food commodities were available for those who did qualify to participate as a CSFP partner. Without proper support of subrecipient eligibility, the Department of Agriculture could impose a penalty and reduce the amount of funds available for DHS’s Food Distribution program. Recommendation: We recommend DHS continue to strengthen its internal controls over subrecipient eligibility determination for food pantries to ensure CSFP partners’ records are properly kept. Further, we recommend DHS ensure adequate reviews and/or monitoring of the CSFP subrecipient eligibility process at the food bank level. Lastly, we recommend DHS develop an appropriate process to ensure food banks are adequately trained in documenting CSFP subrecipient eligibility and in record keeping for the appropriate amount of time and making those records available for review. Criteria: 45 CFR 75.303 states: “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 7 CFR 247.4(b)(2) states in part: “All agreements described under paragraphs (a)(2) and (a)(3) of this section must contain the following:…An assurance that each agency will maintain accurate and complete records for a period of three years from the close of the fiscal year to which they pertain, or longer if the records are related to unresolved claims actions, audits, or investigations;”… 7 CFR 247.5 states in part: “State and local agencies are responsible for administering the program in accordance with the provisions of this part, and with the provisions of part 250 of this chapter, as applicable. Although the State agency may delegate some responsibilities to another agency, the State agency is ultimately responsible for all aspects of program administration”... 7 CFR 247.5 (a)(6) states in part: “The major responsibilities shared by State and local agencies include:…Maintaining accurate and complete records”… 7 CFR 247.5 (b)(5) states in part: “The major responsibilities of State agencies include:…Establishing eligibility requirements, in accordance with the options provided to the State agency under § 247.9. (This function may not be delegated to another agency.)”… 7 CFR 247.5 (c)(1) states in part: “The major local agency responsibilities include:…Determining eligibility of applicants in accordance with eligibility criteria established by the State agency”… 7 CFR 247.5 (c)(2) states in part: “The major local agency responsibilities include:… Complying with fiscal and operational requirements established by the State agency”… Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: Standardized onboarding checklist: July 30, 2026, Annual training materials: August 30, 2026, Review of food bank agreements and centralized record-retention processes: September 30, 2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-080 Strengthen procedures for document retention related to daily offset reconciliations STATE AGENCY: Oklahoma Employment Security Commission (OESC) FEDERAL AGENCY: U.S. Department of Labor ALN: 17.225 FEDERAL PROGRAM NAME: Unemployment Insurance FEDERAL AWARD NUMBER: UI37244PU0, UI37244PU1, UI39343OB0, UI39343OB1, UI000066YT0 FEDERAL AWARD YEAR: 2022, 2023, 2024 CONTROL CATEGORY: Special Tests and Provisions - UI Program Integrity – Overpayments QUESTIONED COSTS: $ Condition and Context: Unemployment Insurance (UI) overpayments occur when a state agency pays more benefits than the recipient is lawfully entitled to receive. One of four possible repayment processes is a deduction to current benefits, called an "offset". OESC’s finance division generates the UIB770L1 report each day and compares it to the UIB419L1 report of payments received to ensure offsets are applied against current Unemployment Insurance (UI) claims. The daily comparison includes all repayments, not just offsets. If the overpayment is the result of fraud, a penalty is applied to the repayment; claimants with penalties do not have current benefits to offset. When the penalty was established in 2019, the reports were not correctly programmed to apply penalty monies recovered to the penalty column—they were added to the difference column. Payments received from another state’s UI program are entered into the system as a deposit, but the system classifies those payments in the offset (Involuntary) column but still registers them as payments (which follow different business rules than offsets). These payments show up as a difference. When there is a difference between the UIB770L1 Subtotal (Deposit) line and the Total for Deposits on the UIB419L1 reports, finance sends a request to the Benefit Payment Control Unit, at which time the variance is investigated to verify the totals are correct. We tested 60 daily comparisons of the UIB770L1 report to the UIB419L1 report to ensure the comparison is performed, documented, and if applicable, variances are explained. We identified six (6) days (10%) with unreconciled variances and the client was unable to provide support to explain the variance. Cause: OESC does not have sufficient controls in place to ensure reviews of the reconciliations are documented and retained. Effect: Offsets may not be properly applied to the UI program claims and differences unrelated to the issues above may be overlooked. For the 3 days that the reconciliation reports were not provided, we were unable to determine whether the reconciliation occurred and whether any overpayments are offset against UI payments. Recommendation: According to OESC, this programming was corrected in the fourth quarter of SFY 2025. We recommend OESC continue to address programming issues in the UIB770L1 report to ensure the data reported is accurate and to monitor the report after programing issues are resolved. Criteria: Section 303 [42 U.S.C. 503] (g) of the Social Security Act states in part: “ (1) A State shall deduct from unemployment benefits otherwise payable to an individual an amount equal to any overpayment made to such individual under an unemployment benefit program of the United States or of any other State, and not previously recovered. The amount so deducted shall be paid to the jurisdiction under whose program such overpayment was made. Any such deduction shall be made only in accordance with the same procedures relating to notice and opportunity for a hearing as apply to the recovery of overpayments of regular unemployment compensation paid by such State. (2) Any State may enter into an agreement with the Secretary of Labor under which- (A) the State agrees to recover from unemployment benefits otherwise payable to an individual by such State any overpayments made under an unemployment benefit program of the United States to such individual and not previously recovered, in accordance with paragraph (1), and to pay such amounts recovered to the United States for credit to the appropriate account, and (B) the United States agrees to allow the State to recover from unemployment benefits otherwise payable to an individual under an unemployment benefit program of the United States any overpayments made by such State to such individual under a State unemployment benefit program and not previously recovered, in accordance with the same procedures as apply under paragraph (1).” Oklahoma Administrate Code (OAC) 240:10-3-11 - Priority of deductions from unemployment insurance benefits states in part: “ (a) If more than one type of deduction is being made from a claimant's weekly benefit amount, the deductions will be made in the following order until all funds are exhausted: (1) Offset of a former benefit overpayment pursuant to 40 O.S. §2-613;” OAC 240:10-3-28 - Application of payments made to repay an overpayment of benefits states in part: “ (a) Offset or recoupment of current unemployment benefit payments - If the current benefit payments of a claimant are offset or recouped to repay a benefit overpayment, the funds from the offset or recoupment shall be applied to the principal amount of the indebtedness in the following order: (1) First, to the earliest administrative overpayment established pursuant to 40 O.S. §2-613 (3) until the principal amount of the overpayment is paid in full. (2) Second, to the administrative overpayment established next in time and all subsequent administrative overpayments established in chronological order until the principal amount of all administrative overpayments are paid in full. (3) Third, to the earliest fraud or claimant error overpayment established pursuant to 40 O.S. §2-613 (1) or (2) until the principal amount of the overpayment is paid in full. (4) Fourth, to the fraud or claimant error overpayment established next in time and all subsequent fraud or claimant error overpayments established in chronological order until the principal amount of all fraud or claimant error overpayments are paid in full.” 2 CFR §200.303 Internal controls states in part: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Government Accountability Office (GAO) Standards for Internal Control in the Federal Government Design of the Entity’s Information System, states in part: “11.03 Management designs the entity’s information system to obtain and process information to meet each operational process’s information requirements and to respond to the entity’s objectives and risks. An information system is the people, processes, data, and technology that management organizes to obtain, communicate, or dispose of information. … 11.04 Management designs the entity’s information system and the use of information technology by considering the defined information requirements for each of the entity’s operational processes. … Although information technology implies specific types of control activities, information technology is not a “standalone” control consideration. It is an integral part of most control activities. 11.05 Management also evaluates information processing objectives to meet the defined information requirements. Information processing objectives may include the following: • Completeness - Transactions that occur are recorded and not understated. • Accuracy - Transactions are recorded at the correct amount in the right account (and on a timely basis) at each stage of processing. • Validity - Recorded transactions represent economic events that actually occurred and were executed according to prescribed procedures.” Management Response: The agency concurs with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-085 (Repeat 2023-036) Developing Reliable System to Capture ETA 9128 Data STATE AGENCY: Oklahoma Employment Security Commission FEDERAL AGENCY: U.S. Department of Labor ALN: 17.225 FEDERAL PROGRAM NAME: Unemployment Insurance Program FEDERAL AWARD NUMBER: UI359652160A40, UI380002260A40, 23A60UR000033 FEDERAL AWARD YEAR: 2022, 2023 CONTROL CATEGORY: Special Tests and Provisions – Reemployment Services and Eligibility Assessments (RESEA) QUESTIONED COSTS: $0 Condition and Context: The Department of Labor’s Employment and Training Administration (ETA) 9128 report provides quarterly information on the RESEA activities of claimants who are selected to participate in the RESEA program. The data on this report allows for evaluation and monitoring of the RESEA program. Oklahoma Job Match system (OKJM), the management system where the appointments are recorded, provides appointment information for Sections I and III of the ETA 9128 performance report. OESC’s mainframe generates a report that is used for Sections II and IV of the report. The data from both systems are then input into the Department of Labor’s Sun System to create the final ETA 9128 report. The data generated by OKJM used in the ETA 9128 performance report was not reliable for reporting purposes. In order to complete the ETA 9128 report, the RESEA program manager had staff manually go back through their appointments, capture information, and verbally provide the results. Based on the lack of physical documentation for the ETA 9128 performance report, we are unable to determine if the ETA 9128 performance report accurately compiled all RESEA performance data. Cause: During Covid, services were suspended in part due to a directive from the Governor to suspend required work searches, as well as the inability to meet with RESEA participants in person. As a result, programming changes prevented enrollments from opening in OKJM and staff were unable to enter data in the RESEA enrollment to be captured in the report. For SFY 2024, the programming changes had yet to be corrected. Effect: For SFY 2024, OESC staff were unable to use the OKJM system to capture RESEA participant information, which could result in OESC reporting inaccurate data on the ETA 9128 performance reports. Recommendation: We recommend the OESC continue to develop a process in OKJM to ensure that the RESEA enrollment opens allowing staff to capture appointment information and keep track of the number of RESEA appointments and that the system generates reliable quarterly data to be reported on the ETA 9128. Criteria: Section 306 of the Social Security Act requires all states to operate either a Worker Profiling and Reemployment Services Program (WPRS) or a Reemployment Services and Eligibility Assessment Program (RESEA), or both. The State of Oklahoma only operates a RESEA program. The requirements include profiling of all claimants to determine who will likely exhaust their benefits and need reemployment services to transition to new employment. If operating only a RESEA program, the Oklahoma Employment Security Commission must include the basic elements of the WPRS program which includes the required WPRS profiling model and statewide provision of services. Social Security Act § 306(a) [42 USC § 506(b)] – Grants to States for reemployment services and eligibility assessments states in part, “The purposes of this section are to accomplish the following goals: (1) To improve employment outcomes of individuals that receive unemployment compensation and to reduce the average duration of receipt of such compensation through employment. (2) To strengthen program integrity and reduce improper payments of unemployment compensation by States through the detection and prevention of such payments to individuals who are not eligible for such compensation. (3) To promote alignment with the broader vision of the Workforce Innovation and Opportunity Act (29 U.S.C. 3101 et seq.) of increased program integration and service delivery for job seekers, including claimants for unemployment compensation. (4) To establish reemployment services and eligibility assessments as an entry point for individuals receiving unemployment compensation into other workforce system partner programs.” Elements of an Unemployment Insurance (UI) Reemployment Services and Eligibility Assessment (RESEA) Grant State Plan, OMB Number: 1205-0538, Question 16. Role of UI Staff, states: “UI program management provides feedback to RESEA program staff regarding identified irregularities. UI program management is responsible for evaluating the effectiveness of the adjudication process that is tied to RESEA issues such as: failed to report, job search, and able and available issues identified during the eligibility review process, as well as RESEA appointment. UI program management is responsible for training RESEA staff on all UI policy and procedures including detecting any eligibility issues and improper payments. Reports are reviewed by both the UI and RESEA Program managers to ensure the data is reported accurately. Note: At a minimum, UI Staff must be involved with the following activities: Participating in the planning, administration, and oversight of the RESEA program; Training -- Providing all appropriate staff training on unemployment compensation (UC) eligibility requirements; Reports -- Ensuring accurate data are provided in the RESEA-required reports; and Conducting eligibility determinations and redeterminations resulting from issues identified through RESEA participation.” Management Response: The agency concurs with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-087 (Repeat #2023-035) Strengthen Retention of RESEA Participant Documentation STATE AGENCY: Oklahoma Employment Security Commission (OESC) FEDERAL AGENCY: U.S. Department of Labor ALN: 17.225 FEDERAL PROGRAM NAME: Unemployment Insurance Program FEDERAL AWARD NUMBER: UI359652160A40, UI380002260A40, 23A60UR000033 FEDERAL AWARD YEAR: 2022-2023 CONTROL CATEGORY: Special Tests and Provisions – Reemployment Services and Eligibility Assessments (RESEA) QUESTIONED COSTS: $0 Condition and Context: The RESEA program at OESC provides reemployment services to unemployment claimants who are unlikely to return to their previous industry or occupation and who are considered likely to use up benefits. The Department of Labor’s Employment and Training Administration (ETA) 9128 report provides quarterly information on the RESEA activities, which allows for evaluation and monitoring of the RESEA program. We tested 60 Unemployment Insurance claimants, from a population of 12,312 that were profiled for the RESEA program during State Fiscal Year (SFY) 2024. We identified 9 (15%) of the participant files in which documentation for at least one of the nine required RESEA steps was missing. Cause: During SFY 2024, the Oklahoma Employment Security Commission did not have adequate controls, along with timely and/or effective communication of RESEA procedures, including instructions on how to properly retain documentation. Further, due to system malfunctions, for the first three quarters of SFY 2024, there were no formal quality control reviews performed to detect missing documentation and provide feedback to RESEA program staff. Effect: RESEA program evaluation and monitoring may not have been based on correct information and the ETA 9128 performance report may be incomplete and unreliable. RESEA participants may not have received notice regarding their required participation in the RESEA program and may have received benefits for a longer period than necessary. Recommendation: The Oklahoma Employment Security Commission revised the RESEA procedures in the last month of SFY 2023. We recommend the Oklahoma Employment Security Commission continue implementing the new procedures to ensure all documents are properly completed and retained. Additionally, now that the Quality Control program has resumed, we recommend follow-up on all Quality Control findings with training to ensure employees are aware of and understand proper procedures for completing appropriate forms and retaining records to prevent future errors. Criteria: 42 USC § 506(b) – Grants to States for reemployment services and eligibility assessments states in part: “The purposes of this section are to accomplish the following goals: (1) To improve employment outcomes of individuals that receive unemployment compensation and to reduce the average duration of receipt of such compensation through employment. (2) To strengthen program integrity and reduce improper payments of unemployment compensation by States through the detection and prevention of such payments to individuals who are not eligible for such compensation. (3) To promote alignment with the broader vision of the Workforce Innovation and Opportunity Act (29 U.S.C. 3101 et seq.) of increased program integration and service delivery for job seekers, including claimants for unemployment compensation. (4) To establish reemployment services and eligibility assessments as an entry point for individuals receiving unemployment compensation into other workforce system partner programs.” Elements of an Unemployment Insurance (UI) Reemployment Services and Eligibility Assessment (RESEA) Grant State Plan, OMB Number: 1205-0538, Question 16. Role of UI Staff, states: “UI program management provides feedback to RESEA program staff regarding identified irregularities. UI program management is responsible for evaluating the effectiveness of the adjudication process that is tied to RESEA issues such as: failed to report, job search, and able and available issues identified during the eligibility review process, as well as RESEA appointment. UI program management is responsible for training RESEA staff on all UI policy and procedures including detecting any eligibility issues and improper payments. Reports are reviewed by both the UI and RESEA Program managers to ensure the data is reported accurately. Note: At a minimum, UI Staff must be involved with the following activities: Participating in the planning, administration, and oversight of the RESEA program; Training -- Providing all appropriate staff training on unemployment compensation (UC) eligibility requirements; Reports -- Ensuring accurate data are provided in the RESEA-required reports; and Conducting eligibility determinations and redeterminations resulting from issues identified through RESEA participation.” 40 O.S. § 2-421 – Failure to Participate in Reemployment Services through Profiling states: “The Oklahoma Employment Security Commission shall establish and utilize a system of Re-employment Services and Eligibility Assessment selection for all ex-military service claimants and for unemployment benefit claimants who will be likely to exhaust unemployment benefits and who will need job-search assistance services to make a successful transition to new employment. Any claimant who has been referred to re-employment services pursuant to the selection system and who fails to participate in the re-employment services made available to the claimant, shall be disqualified to receive benefits for each week in which the failure occurs, unless the Commission determines that: 1. The claimant has previously completed the re-employment services within the benefit year; or 2. There is good cause for the claimant's failure to participate in re-employment services.” The RESEA Instructions and Procedures, 06/06/2023 and 3/21/2024 revisions, Summary of Documentation states: “The RESEA process will be documented by the following: • Required services: • Reemployment Services & Eligibility Assessment – RESEA • Reemployment Needs Inventory & Eligibility Review • Resume Assistance • Referral to WIOA Services • OKJM Registration • Job Search Planning • Individual Reemployment Plan • Custom Labor Market Information • RESEA – Follow-up • Completing the Individual Reemployment Plan (IEP) according to procedures. • Upload the three (3) required RESEA forms. If the appointment was virtual the RESEA Specialist must signed the form “completed virtually” • Reemployment Needs Inventory & Eligibility Review, OES 802 • RESEA Follow-Up, OES 251(Must be completed and uploaded during the initial appointment.) • Unemployment Eligibility Review Questionnaire for follow-up appointment, OES 173” The RESEA Instructions and Procedures, 06/06/2023 and 3/21/2024 revisions, Notifying UI and the Adjudication Process states in part: “Adjudication Process. Once all notifications have been sent to the OKC Claims Adjudication Unit, the adjudication process follows these general steps: • If the Participant is a no show RESEA Specialist will complete and upload the OES-842 to Docushare and send an email to PRF/JSW/POE@oesc.ok.gov and the 2-421 issue will be placed on the claim and benefits will be denied until attended and no back weeks will be paid. • If the Participant reschedules and attends the same week they were a FTR no show, RESEA Specialist will complete and upload the OES-842 to Docushare, email PRF/JSW/POE@oesc.ok.gov and the 2-421 will be deleted; and the participants will receive their weekly benefits. • If the Participant reschedules and attends any time after the same week, they were a failed to report the RESEA Specialist will report the Participant as attended after denial by completing and upload the OES-842 and send an email to PRF/JSW/POE@oesc.ok.gov. The 2-421 issue will be released that week and no back benefits will be paid.” 2 CFR § 200.303 “Internal controls” states in part: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Government Accountability Office (GAO) Standards for Internal Control in the Federal Government 14.03 states, “Management communicates quality information down and across reporting lines to enable personnel to perform key roles in achieving objectives, addressing risks, and supporting the internal control system. In these communications, management assigns the internal control responsibilities for key roles.” 2 CFR § 200.334 Retention requirements for records states in part: “Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient….” Management Response: The agency concurs with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-047 Strengthen Controls over Record Retention for Consultant Selection and Indirect Cost Rate Review STATE AGENCY: Oklahoma Department of Transportation FEDERAL AGENCY: U.S. Department of Transportation ALN: 20.205 FEDERAL PROGRAM NAME: Highway Planning and Construction FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Procurement and Suspension and Debarment QUESTIONED COSTS: $0 Condition and Context: Engineering consultants are selected by an Oklahoma Department of Transportation (Department) Consultant Selection Committee (DCSC). A DCSC is formed for each project as a designated group responsible for evaluating, interviewing, and ranking engineering consultants based on their qualifications, experience, and project approach (qualifications-based selection). The DCSC evaluates interested consultants and develops a short-list of consultants, which is provided to the Director of Engineering for concurrence and the Chief Engineer for approval. After the short-list is approved, the DCSC interviews the consultants and performs evaluations to rank the consultants. The final results are sent to the Director of Engineering for recommendation, to the Chief Engineer for concurrence, and to the Executive Director for approval. The Department’s Grants & Contracts Audit Office (Audit Office, formerly Operations Review and Evaluation) is responsible for reviewing and accepting consultant indirect cost rates to ensure that overhead rates charged to consultant contracts are reasonable, allowable, and compliant with Federal Acquisition Regulations (FAR). The Audit Office maintains the review files and the accepted FAR internal cost rate and/or a provisional indirect cost rate. The timeline from DCSC selection, to contracting with a consultant, to reimbursement of eligible consultant claims can span multiple state fiscal years. The Department reimbursed 516 consultant contracts during the audit period, totaling $64,125,923. We tested 47 of the contracts, which included a total of 29 consultants, to determine whether the contracts had related DCSC selection approvals and an accepted FAR indirect cost rate when the Department contracted with the consultant. We identified: • One (1) of the 47 (2.12%) consultant contracts in which the Department was unable to provide the DCSC’s short-list, final recommendation, or the associated selection approvals. • 14 of the 47 (29.79%) contracts, relating to 9 consultants, in which the Department did not have an accepted FAR indirect cost rate and/or a provisional indirect cost rate on record with the Audit Office. Cause: The Department’s record retention process lacked the necessary strength and consistency to ensure the DCSC selection and approval documentation was maintained. Further, the Audit Office experienced turnover in 2021 and 2022, which affected the performance and maintenance of FAR indirect cost rates. Effect: Without a DCSC approved short-list of consultants, the Department is unable to provide proof that consultant contract procurement guidelines were followed. There is also the risk that the consultant selected may not be the most qualified consultant for the project or that the contract was selected due to wrong-doing.* The consultant’s indirect cost rate charged to the contracts may be unreasonable, unallowable, and/or noncompliant with Federal Acquisition Regulations. * The vendor associated with this contract has been used by the Department for years and is an established consultant; therefore, there are no concerns regarding the consultant’s existence, just the methodology used to select the consultant. Recommendation: We recommend the Department evaluate DCSC record retention process and implement training necessary to ensure all DCSC recommendations are maintained in the contract file. Furthermore, we recommend the Department evaluate the FAR indirect cost rate review and retention process and strengthen indirect cost rate review tracking to ensure that all consultants’ indirect cost rates are reviewed annually and retained, and necessary adjustments to the consultants’ provisional indirect cost rates are made. Criteria: 2 CFR § 1201.1 states in part: “Except as otherwise provided in this part, the Department of Transportation adopts the Office of Management and Budget Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR part 200)….” 2 CFR § 200.334 states in part: “Retention requirements for records. Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. … “ 23 CFR § 172.11(b) states in part: “Elements of contract costs. The following requirements shall apply to the establishment of the specified elements of contract costs: (1) Indirect Cost Rates. (i) Indirect cost rates shall be updated on an annual basis in accordance with the consultant's annual accounting period and in compliance with the Federal cost principles. (ii) Contracting agencies shall accept a consultant's or subconsultant's indirect cost rate(s) established for a 1-year applicable accounting period by a cognizant agency that has: (A) Performed an audit in accordance with generally accepted government auditing standards to test compliance with the requirements of the Federal cost principles and issued an audit report of the consultant's indirect cost rate(s); or (B) Conducted a review of an audit report and related workpapers prepared by a certified public accountant and issued a letter of concurrence with the related audited indirect cost rate(s).” 2 CFR § 200.303 states in part: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.1 states in part: “Internal controls for non-Federal entities means: (1) Processes designed and implemented by non-Federal entities to provide reasonable assurance regarding the achievement of objectives in the following categories: (i) Effectiveness and efficiency of operations; (ii) Reliability of reporting for internal and external use; and (iii) Compliance with applicable laws and regulations.” Oklahoma Department of Transportation Guidelines for the Administration of Consultant Contracts, dated June 22, 2016, contains the following guidance: • Section 4.01 Short-List Development states in part: “a) Department Consultant Selection Committee Determination. … The DCSC will review the LOIs submitted by each Consultant. The DCSC is a working committee which consists of a minimum of three (3) representatives (Committee Chair and two (2) members) and is generally determined by the different components of a project (i.e. roadway design, bridge design, survey etc.). The DCSC will be composed of Department representatives with knowledge and expertise in critical aspects of the projects and/or services, and are generally recommended by the Director of Engineering, for Chief Engineer concurrence and Executive Director approval.…” • Section 4.04 Interview Evaluation states in part: “Based upon the DCSC’s evaluation of the proposals and oral presentations, a final ranking is established and the CA provides the Director of Engineering recommendation for Chief Engineer concurrence and Executive Director approval….” • Section 6.11 Federal Acquisition Regulations (FAR) states: “The Consultant shall certify that the indirect cost rate submitted does not include any costs which are expressly unallowable and that the indirect cost rate was established only with allowable costs in accordance with the applicable cost principles contained in the FAR. The Department’s OR&E Division will be responsible for ensuring that a Consultant’s indirect cost rate complies with the FAR cost principles.” • Section 16.3 states: “An audited FAR indirect cost rate and related information must be submitted by the Consultant to the Department for review and acceptance no later than July 31st following the end of the previous calendar year. A provisional overhead rate may be used until such time that an annual overhead rate is audited and established. In the event the Consultant is unable to provide the audit report within the time frame specified, the Consultant shall submit a written request for an extension citing the reason for the delay. Submittal of the Consultant’s annual indirect cost rate audit will be documented in the Consultant’s contract evaluation.” Views of Responsible Official(s) Contact Person: Jennifer Hankins Anticipated Completion Date: 12/31/2026 Corrective Action Planned: The Oklahoma Department of Transportation agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-050 Strengthen Internal Controls over Wage Rate Requirements STATE AGENCY: Oklahoma Department of Transportation FEDERAL AGENCY: U.S. Department of Transportation ALN: 20.205 FEDERAL PROGRAM NAME: Highway Planning and Construction FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Special Tests and Provisions – Wage Rate Requirements QUESTIONED COSTS: $0 Condition and Context: The Oklahoma Department of Transportation (Department) residencies are responsible for monitoring and maintaining contractor payroll records in accordance with Construction Control Directive 20160418. The residencies monitor the payroll for timely submission by stamping the date received. When the payroll certification is not received, the residency follows up on late payroll records. The Department made payments to 383 construction projects subject to the wage rate requirements. We tested 58 projects and identified a total of 52 projects (89.65%) in which the Department did not follow the wage rate requirements: • For 33 of 58 (56.90%) projects tested, the Department did not obtain copies of the certified payrolls for each week in which work was performed under the contract or subcontract or have correspondence with the contractor/subcontractor regarding the missing payrolls within the required two-week period • For 36 of 58 (62.07%) projects tested, the Department did not follow their written policy and procedures for stamping payroll records with the date they were received. Cause: The Department’s contractor payroll review process lacked the necessary strength and consistency to ensure residencies adequately monitored contractor payroll records. The payroll review process was not robust enough to identify payroll records that were not submitted timely. Consequently, written notifications to the contractors were not consistently submitted when the contractor failed to submit the required payrolls. Effect: The Department is not in compliance with 29 CFR § 5.5 and with Construction Control Directive No. 20160418. Continued noncompliance with 2 CFR § 5.5 increases the risk of the Federal Highway Administration taking action to suspend further payments, advances, or guarantee of funds. Recommendation: We recommend the Department evaluate and strengthen the payroll monitoring process in the residencies involved and provide appropriate training to ensure future compliance with Federal wage rate requirements. Criteria: 2 CFR § 1201.1 states: “Except as otherwise provided in this part, the Department of Transportation adopts the Office of Management and Budget Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 200). This part supersedes and repeals the requirements of the Department of Transportation Common Rules (49 CFR Part 18 - Uniform Administrative Requirements for Grants and Cooperative Agreements to State and Local Governments and 49 CFR Part 19 - Uniform Administrative Requirements - Uniform Administrative Requirements for Grants and Agreements with Institutions of Higher Education, Hospitals, and other Non-Profit Organizations), except that grants and cooperative agreements executed prior to December 26, 2014 shall continue to be subject to 49 CFR Parts 18 and 19 as in effect on the date of such grants or agreements. New parts with terminology specific to the Department of Transportation follow.” 2 CFR § 200.303 states in part: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 29 CFR § 5.5(a)(3)(ii) states in part: “Certified payroll requirements - (A) Frequency and method of submission. The contractor or subcontractor must submit weekly, for each week in which any DBA- or Related Acts-covered work is performed, certified payrolls to the [write in name of appropriate Federal agency] if the agency is a party to the contract, but if the agency is not such a party, the contractor will submit the certified payrolls to the applicant, sponsor, owner, or other entity, as the case may be, that maintains such records, for transmission to the [write in name of agency]. The prime contractor is responsible for the submission of all certified payrolls by all subcontractors.” Construction Control Directive No. 20160418 states in part: “1. Contractor Payrolls: The prime contractor and all approved subcontractors performing work on a Federally funded contract are required to submit weekly payroll records to the Residency. All payroll records from the prime contractor or subcontractor shall be received within two weeks of the end of the payroll reporting period. Payrolls for periods of “no work in progress” will not be required. The Residency will be required to stamp all payrolls indicating the date on which they were received. The Residency must monitor the payroll records received weekly and should notify the prime contractor in writing for any failure to submit the required payrolls or to submit a record with the necessary information (as detailed below) within the two week period. The written notification to the prime contractor may state actions that could be taken by the Residency, including holding future progressive payments until the contractual requirement has been satisfied. Any such correspondence must be stored in the project’s payroll files.” Views of Responsible Official(s) Contact Person: John B. Leonard Anticipated Completion Date: October 31, 2026 Corrective Action Planned: The Oklahoma Department of Transportation agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-054 (Repeat 2023-097) Strengthen Internal Controls Over Claim Voucher Approvals STATE AGENCY: Oklahoma Department of Transportation (Department) FEDERAL AGENCY: Federal Highway Administration ALN: 20.205 FEDERAL PROGRAM NAME: Highway Planning and Construction Program FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Allowable Cost/Cost Principles QUESTIONED COSTS: $50,910 Condition and Context: To initiate the payment of program expenditures, individual divisions review and approve invoices related to the divisions’ operations and prepare the Claim Voucher Form (ODOT Form 324) before submitting them to the Comptroller Division for processing. We analyzed 100% of federally reimbursed Highway Planning and Construction Program (ALN 20.205) claims that were paid during the audit period. The population consisted of 11,622 claims, totaling $1,062,621,905. During the analysis, we identified three (3) duplicate claims, totaling $50,910, which are considered improper payments. Cause: The Department’s claim preparation and review processes lacked the necessary strength and consistency to ensure personnel verified whether the invoices had previously been paid prior to processing the duplicate claims. Further, the review and approval process was not robust enough to detect the duplicate claim. Effect: The Department made three (3) improper payments for $50,910 with ALN 20.205 funding. Continued noncompliance with 2 CFR § 200.1 increases the risk of Federal claw backs, which impacts state dollars. Recommendation: We recommend the Department evaluate and strengthen the claim preparation and review processes in the divisions involved and provide appropriate training to ensure that future duplicate payments are prevented. Additionally, we recommend the affected Divisions maintain a log documenting the invoice date and number, vendor name, and payment amount and review the log for prior claim vouchers issued before approving and processing potential duplicate invoices for payment. Criteria: 2 CFR § 1201.1 states: “Except as otherwise provided in this part, the Department of Transportation adopts the Office of Management and Budget Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 200). This part supersedes and repeals the requirements of the Department of Transportation Common Rules (49 CFR Part 18 - Uniform Administrative Requirements for Grants and Cooperative Agreements to State and Local Governments and 49 CFR Part 19 - Uniform Administrative Requirements - Uniform Administrative Requirements for Grants and Agreements with Institutions of Higher Education, Hospitals, and other Non-Profit Organizations), except that grants and cooperative agreements executed prior to December 26, 2014 shall continue to be subject to 49 CFR Parts 18 and 19 as in effect on the date of such grants or agreements. New parts with terminology specific to the Department of Transportation follow.” 2 CFR § 200.303 states in part: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR § 200.1 states in part: “Internal controls for non-Federal entities means: (1) Processes designed and implemented by non-Federal entities to provide reasonable assurance regarding the achievement of objectives in the following categories: (i) Effectiveness and efficiency of operations; (ii) Reliability of reporting for internal and external use; and (iii) Compliance with applicable laws and regulations.” 2 CFR § 200.1 states in part: “Improper payment means: (1) Any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. (i) Incorrect amounts are overpayments or underpayments that are made to eligible recipients (including inappropriate denials of payment or service, any payment that does not account for credit for applicable discounts, payments that are for an incorrect amount, and duplicate payments). An improper payment also includes any payment that was made to an ineligible recipient or for an ineligible good or service, or payments for goods or services not received (except for such payments authorized by law).” Views of Responsible Official(s) Contact Person: Sam Ddamba Anticipated Completion Date: 07/02/2025 Corrective Action Planned: The Oklahoma Department of Transportation agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-018 (Repeat 2023-013) Strengthen Internal Controls over Subrecipient Monitoring STATE AGENCY: Oklahoma Department of Transportation FEDERAL AGENCY: Federal Transit Authority ALN: 20.509 FEDERAL PROGRAM NAME: Formula Grants for Rural Areas FEDERAL AWARD NUMBER: OK-2017-023-05, OK-2018-023-03, OK-2019-025-03, OK-2020-021-02, OK- 2021-018-00, OK-2022-016-00, OK-2022-025-00, OK-2022-027-00, OK-2023-026-00, OK-2024-006-00, OK-2024- 013-00 FEDERAL AWARD YEAR: 2017, 2018, 2019, 2020, 2021, 2022, 2023, 2024 CONTROL CATEGORY: Subrecipient Monitoring QUESTIONED COSTS: $0 Condition and Context: The Office of Mobility and Public Transit (OMPT) at the Oklahoma Department of Transportation (Department) is responsible for is responsible for overseeing subrecipients associated with the Assistance Listing Number (ALN) 20.509 grant. OMPT provides the grant information, as required in 2 CFR 200.332, through the contract agreement between the Department and the subrecipient. A template of the contract agreement is used to ensure the correct information is provided. We reviewed the contracts agreements for eight (8) of 23 subrecipients receiving funding during the audit period to determine whether the correct information was communicated to the subrecipients. We identified three (3) or 37.5% (3/8) subrecipients who received a contract agreement with an incorrect Assistance Listing Number (ALN). As part of the monitoring process, the project managers obtain subrecipients’ audit reports and forward them to the Department’s Audit Office for review. OMPT relies on responses received from the Audit Office subsequent to review for identification of findings to monitor and assess the risk related to subrecipients’ compliance with Federal statutes, regulations, and the terms and conditions of the subaward. OMPT uses an Single Audit Tracking spreadsheet as a control mechanism to ensure the requirements described in 2 CFR 200.332 are met and OMPT’s program managers are required to update the audit tracking spreadsheet for their assigned subrecipients. We met with OMPT employees to discuss the control processes used to ensure monitoring requirements were met. During the discussion, it was discovered that risk assessments were not performed, and the Single Audit Tracking spreadsheet was used sporadically. Additionally, we noted the Single Audit Tracking sheet omitted two (2) or 9.09% (2/22) of the subrecipients expected to have and submit an audit during the period. We reviewed documentation for the 22 subrecipients that were expected to have and submit an audit during the audit period to determine whether the Department complied with the monitoring of the subrecipients audits. The following was observed: • Twelve (12) or 54.55% (12/22) of the subrecipients did not submit an audit report until after the audit period and no communication was provided to indicate attempts were made by OMPT to obtain the audit reports. • Two (2) or 9.09% (2/22) of the subrecipients did not submit an audit report at all and no communication was provided to indicate attempts were made by OMPT to obtain the audit reports. • One (1) or 4.55% (1/22) of the subrecipients submitted an Agreed Upon Procedure instead of a single audit or financial audit. • Six (6) or 27.27% (6/22) of the subrecipients submitted a single audit or a financial audit and it was not reviewed by the Audit Office. This is a repeat finding for the current audit period. According to the status reported in the SFY 2023 Summary Schedule of Prior Audit Findings, corrective action was implemented 6/30/2024. Because the SFY 2023 corrective action was implemented after the audit period, results of those corrections were not a part of the scope of the audit. Cause: The Department lacked a sufficient system of controls to properly monitor subrecipients. An unauthorized change to the contract template went unnoticed when the contract agreement was created and the review process by the Department did not detect the discrepancy between the Federal award and the contract agreement. - A process to evaluate the risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subawards was not established. - Program managers’ use of the Single Audit Tracking sheet is inconsistent and the Single Audit Tracking sheet lacks reliable oversight to ensure that program managers are effectively monitoring the subrecipients. Further, the Department does not have an adequate process in place to determine whether subrecipients are subject to a single audit or financial audit. Effect: Inadequate monitoring can lead to program non-compliance on the part of the Department and its subrecipients. - The Department prevented the subrecipients from properly recording or reporting the activity related to the contract agreements due to an incorrect ALN. - Monitoring of subrecipient activities is not directly related to the level of noncompliance risk each individual subrecipient poses. - Inadequate tracking of audits has prevented the Department from ensuring the subrecipients’ audits were received. This in turn prevented the Department from performing review and taking timely and appropriate action on deficiencies detected through audits. Recommendation: We recommend the Department review and update the contract template to ensure it contains the correct grant information and modify the contract agreement review process to ensure the review is robust enough to detect whether correct grant information is provided to the subrecipients. We further recommend the Department send corrected grant information in a letter or email to active grants to subrecipients who received incorrect Federal award information in their contract agreement. In addition, we recommend the Department continue with implementation of corrective action procedures and training necessary to ensure subrecipient risk assessments are performed, inquiries are made with sub-recipients to determine the audit type required based on the expected federal expenditures, and the Single Audit Tracking sheet is updated monthly for review and/or follow-up. Criteria: 2 CFR 1201.1 states, “Except as otherwise provided in this part, the Department of Transportation adopts the Office of Management and Budget Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR part 200). This part supersedes and repeals the requirements of the Department of Transportation Common Rules (49 CFR part 18 - Uniform Administrative Requirements for Grants and Cooperative Agreements to State and Local Governments and 49 CFR part 19 - Uniform Administrative Requirements - Uniform Administrative Requirements for Grants and Agreements with Institutions of Higher Education, Hospitals, and other Non-Profit Organizations), except that grants and cooperative agreements executed prior to December 26, 2014 shall continue to be subject to 49 CFR parts 18 and 19 as in effect on the date of such grants or agreements. New parts with terminology specific to the Department of Transportation follow.” 2 CFR 200.332 states in part, “All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. xii. Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (d) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward... (f) Verify that a subrecipient is audited as required by subpart F of this part... (h) Consider taking enforcement action against noncompliant subrecipients as described in § 200.339 of this part and in program regulations.” 2 CFR 200.521 states in part, “(a) General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments or take other action. If the auditee has not completed corrective action, a timetable for followup should be given.…While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements, which are required to be reported in accordance with GAGAS.” 2 CFR 200.521 states in part, “(d) Time requirements. The Federal agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report.” Views of Responsible Official(s) Contact Person: Eric Rose/Bobby Parkinson Anticipated Completion Date: 12/31/2026 Corrective Action Planned: The Oklahoma Department of Transportation agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-039 (Repeat 2023-056) Strengthen Internal Controls Over SEFA Reconciliations STATE AGENCY: State of Oklahoma and Office of Management and Enterprise Services (OMES) FEDERAL AGENCY: U.S. Department of the Treasury ALN: 21.027 FEDERAL PROGRAM NAME: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Reporting QUESTIONED COSTS: $0 Condition and Context: The State of Oklahoma had twenty-two (22) state agencies report CSLFRF expenditures on the Schedule of Expenditures of Federal Awards (SEFA) for SFY 2024. The state created class fund 488 (ARPA Advance Grants) for administrative costs to run the grant, and class fund 497 (Statewide Recovery Fund) to facilitate the transfer of CSLFRF funds to agencies. Class fund 488 only applies to State of Oklahoma OMES - Grants Management Office (GMO) and class fund 497 applies to all agencies. For the thirteen (13) state agencies audited by the State Auditor’s Office, we noted the following SEFA exceptions: • Three agencies (055, 060, 585) did not include, but should have reported expenditures for, AL #21.027 CSLFRF on their SEFA • Five agencies (452, 670, 800, 830, 835) included AL #21.027 CSLFRF on their SEFA but did not accurately report their expenditures Based on testwork performed by the State Auditor’s Office on CSLFRF state agency SEFA expenditures for SFY 2024, we determined the state agencies reported $126,453,915 in modified accrual expenditures; and the correct SEFA total should have been $132,349,844. Further, when including outside audits of state agency CSLFRF funds, we determined total modified accrual federal expenditures reported were $174,998,951; however, the correct CSLFRF SEFA total for SFY 2024 should have been $180,894,880. Cause: The State of Oklahoma had no controls in place to ensure a SEFA was completed for each agency receiving CSLFRF funds. State agencies (055, 060, 452, 585, 670, 800, 830, 835) lacked adequate controls to ensure SEFA expenditures for AL #21.027 were reported correctly. State agencies (055, 060, 452, 585, 670, 800, 830) did not review the Summary of Receipts and Disbursements (SRD) report for class fund 497 (Statewide Recovery Fund) to ensure all federal expenditures were included on their SEFA. State agency (835) recorded cash transfers erroneously as expenditures. Cash transfers of $167,173,545 were erroneously recorded as total modified accrual expenditures on the SEFA. We were able to support $46,452,859 of actual expenditures incurred during the period; therefore, we determined this to only be a control deficiency. However, the agency did overstate their actual SEFA expenditures by $711,718 by recording expenditures in SFY 2024, that should have been recorded in the prior year. This overstatement was a part of the overall SEFA variance listed in the Effect below. Effect: The State of Oklahoma under-reported SEFA expenditures by $5,895,929 for SFY 2024. Recommendation: We recommend OMES ensure that state agencies strengthen controls over their SEFA process to ensure accurate reporting of CSLFRF expenditures, including a review of the SRD for class fund 497. Further, we recommend the State of Oklahoma review the SRD for class fund 497 for the agencies that transferred CSLFRF funds to ensure those with expenditures complete a SEFA. In addition, we recommend the State of Oklahoma reconcile state agency SEFAs to the SRD for class fund 497 to ensure expenditures are reported accurately. Lastly, for agency 835, we recommend all expenditures be recognized in the period the liability is incurred. Criteria: Per 2 CFR § 200.303, “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.502(a) states in part, “Determining Federal awards expended. The determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs.” 2 CFR § 200.510(b) states in part, “Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements. The schedule must include the total Federal awards expended as determined in accordance with §200.502. … (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available.” Management Response Contact Person: OMES: Elizabeth Base; 055: April Kowardy; 060: Chris Wadsworth; 452: Chad Carden; 585: Brittany Stroud; 670: Erik Paulson & Darrell Green; 800: Lisa Batchelder; 830: Lindsey Kanaly; 835: Jerri Hargis Anticipated Completion Date: Completed Corrective Action Planned: The Office of Management Enterprise Services – Grants Management Office agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-040 (Repeat 2023-005) Strengthen Internal Controls over Program Fund Expenditures STATE AGENCY: State of Oklahoma FEDERAL AGENCY: U.S. Department of the Treasury ALN: 21.027 FEDERAL PROGRAM NAME: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles QUESTIONED COSTS: $88,768 Condition and Context: During our cash basis reconciliation of the Office of Management and Enterprise Services (OMES) Schedule of Expenditures of Federal Awards (SEFA) for SFY 2024 to the State of Oklahoma - Statewide Accounting System, we reconciled the agency’s cash basis expenditures of $968,168 for AL #21.027. We noted $88,768 of OMES CSLFRF expenditures from class fund 488 (ARPA Advance Grants) for administrative costs to run the grant were expended on AL #84.825C - Governor's Emergency Education Relief (GEER) and AL #21.023 - Emergency Rental Assistance (ERA). Cause: The State of Oklahoma/Office of Management and Enterprise Services (OMES) did not have adequate controls in place to ensure CSLFRF class fund 488 were used only for the CSLFEF program. Effect: Unallowable costs totaling $88,768 were charged to CSLFRF grant for SFY 2024. Recommendation: We recommend OMES develop and implement procedures to ensure CSLFRF funds (class fund 488) are not expended on other federal programs. Criteria: 2 CFR § 200.303 – Internal Controls states in part, “The Non-Federal entity must; (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.403 states in part, “Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: … (f) Not be included as a cost or used to meet cost sharing requirements of any other federally-financed program in either the current or a prior period. See § 200.306(b).” Management Response Contact Person: Elizabeth Base Anticipated Completion Date: September 1, 2026 Corrective Action Planned: The Office of Management Enterprise Services – Grants Management Office agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-043 Strengthen Controls Over Planning and Development of Construction Projects and Noncompliance With State Encumbrance Requirements STATE AGENCY: State of Oklahoma FEDERAL AGENCY: U.S. Department of the Treasury ALN: 21.027 FEDERAL PROGRAM NAME: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance; Procurement and Suspension and Debarment QUESTIONED COSTS: $6,218,295 Condition and Context: During SFY 2024, the Oklahoma Department of Mental Health and Substance Abuse Services (ODMHSAS) received CSLFRF funds for planning and development activities for the proposed Donahue Behavioral Health Campus, a project originally intended to replace the existing Griffin Memorial Hospital. The Oklahoma Legislature appropriated $87 million to the project on October 5, 2022, through House Bill 1013. Additional CSLFRF funds were contributed by Oklahoma City ($1 million) and Oklahoma County ($1.5 million), with future funding anticipated from the eventual sale of the Griffin Memorial Hospital property. During SFY 2024, ODMHSAS incurred expenditures totaling $6,218,295 associated with planning, design, and initial development for the Donahue Behavioral Health Campus in Oklahoma City. However, the project became financially infeasible due to escalating construction costs and budget shortfalls. By May 2025, ODMHSAS abandoned the original construction plan and restructured the project to instead acquire and renovate the vacant former SSM Health facility in southwest Oklahoma City. Expenditures associated with the original Donahue project did not result in a completed capital asset or usable project deliverable. The prior project activities did not transfer to, or provide value toward, the revised Oklahoma City Behavioral Health Campus (OKCBHC) renovation project. As a result, planning and development expenditures for the original Donahue project represent wasted costs. In addition, during our review of the expenditures related to the project, the State incurred an obligation prior to encumbering the necessary funds for claim 629685, totaling $50,000. Because the obligation occurred before the encumbrance was established, the payment required a subsequent ratification to be processed. Cause: The State did not adequately evaluate the project’s feasibility or long-term funding requirements before committing significant planning and development costs, including failing to account for the rising construction expenses typically associated with a project of this scale. Rising construction costs and insufficient appropriated resources caused ODMHSAS to discontinue the original project, rendering prior expenditures ineffective and providing no benefit to the Federal program. In addition, an obligation was initiated without first completing the required encumbrance process, indicating a lapse in adherence to procurement procedures, review processes, and internal controls over commitment of funds. Effect: CSLFRF funds totaling $6,218,295 were used for activities that did not result in a functional capital project and provided no measurable benefit to the Federal program. Failure to encumber funds prior to incurring obligations increases the risk of unauthorized expenditures, budget overruns, and noncompliance with State procurement regulations. The need for ratification indicates that normal procurement controls were bypassed. However, the claim 629685 for $50,000 was not questioned since the agency made a correcting entry to pay for the costs with state funds. Recommendation: The State should strengthen project planning and feasibility evaluations before obligating Federal funds for large-scale capital projects. The State should ensure that sufficient funding, cost estimates, and contingency plans are verified prior to expenditure. The State should strengthen internal controls to ensure that all obligations are properly encumbered before commitments are made. Staff responsible for initiating purchases or contracts should receive periodic training on procurement and encumbrance requirements. The State should also implement review procedures to detect and prevent obligations from being incurred without an existing encumbrance. Criteria: 2 CFR § 200.303 – Internal Controls states in part, “The Non-Federal entity must; (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.403, states in part, “Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: …(a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (g) Be adequately documented. See also §§ 200.300 through 200.309 of this part.” 2 CFR § 200.405(a) states, “A cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received. This standard is met if the cost: (1) Is incurred specifically for the Federal award; (2) Benefits both the Federal award and other work of the non-Federal entity and can be distributed in proportions that may be approximated using reasonable methods; and (3) Is necessary to the overall operation of the non-Federal entity and is assignable in part to the Federal award in accordance with the principles in this subpart.” 2 CFR § 200.317, - Procurements by States, states, “When procuring property and services under a Federal award, a State must follow the same policies and procedures it uses for procurements from its non-Federal funds. Applicable State Rules and Regulations Okla. Const. art. X, § 23 - Balanced budget - Procedures. “The state shall never create or authorize the creation of any debt or obligation, or fund or pay any deficit, against the state, or any department, institution or agency thereof, regardless of its form or the source of money from which it is to be paid.” 62 O.S. § 34.62 - Encumbrance Requirements for Payments from Funds of State, “Encumbrance requirements for payments from funds of the state shall include the following: 1. Whenever agencies of this state enter into contracts for, or on behalf of the state for the purchase of tangible or intangible property, or for services or labor, such agreement shall be evidenced by written contracts or purchase orders, and must be transmitted to the Director of the Office of Management and Enterprise Services within a reasonable time from the date of the awarding of the contract or purchase order.” Management Response Contact Person: OMES: Elizabeth Base 452: Chad Carden Anticipated Completion Date: ODMHSAS anticipates completing updated procedures, review checklists, and targeted written guidance by June 30, 2027. Because the Donahue review requires analysis of historical project expenditures, related accounting and reporting records, multiple funding sources, and coordination with OMES-GMO, ODMHSAS anticipates completing the riskbased transaction review and related follow-up by December 31, 2027. Corrective Action Planned: The Office of Management Enterprise Services – Grants Management Office agrees and Mental Health partially agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report. Auditor Response: Based on current documentation the costs do not demonstrate a benefit to the CSLFRF award or show value carried forward to the successor project; therefore, the questioned costs remain unchanged.

FINDING NO: 2024-044 (Repeat 2023-051) Strengthen Project and Expenditure Reporting Policies and Procedures. STATE AGENCY: State of Oklahoma and Office of Management and Enterprise Services (OMES) FEDERAL AGENCY: U.S. Department of the Treasury ALN: 21.027 FEDERAL PROGRAM NAME: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Reporting QUESTIONED COSTS: $0 Condition and Context: State of Oklahoma/OMES-Grants Management Office (GMO) serves as the central coordinator for quarterly CSLFRF Project and Expenditure Reporting. State agencies that expend CSLFRF funds are required to submit their quarterly expenditure data to OMES-GMO. OMES-GMO compiles the agency submissions, uploads the consolidated data to the U.S. Treasury’s reporting portal, and then reviews, approves, and certifies the reports before formally submitting them on behalf of the State. The State of Oklahoma/OMES-Grants Management Office (GMO) reported for SFY 2024 total quarterly expenses of $161,328,031 for 128 project ID’s per Project and Expenditure Reports. We reconciled $161,188,894 of total cash basis expenditures for SFY 2024 to the State of Oklahoma - Statewide Accounting System for 128 project ID’s. Further, while performing testwork on the Quarterly Project and Expenditure Reports for SFY 2024, we noted the following issues with eight state agencies: Not reported (understated): • State agency 055 had project expenditures totaling $12,364; however, $0 was reported resulting in a ($12,364) difference. Under reported: • State agency 085 had project expenditures totaling $2,993,082; however, $2,432,862 was reported resulting in a ($560,220) difference. • State agency 090 had project expenditures totaling $1,234,668; however, $1,160,439 was reported resulting in a ($74,229) difference. • State agency 452 had project expenditures totaling $3,591,350; however, $3,118,009 was reported resulting in a ($473,341) difference. • State agency 605 had project expenditures totaling $678,993; however, $227,691 was reported resulting in a ($451,302) difference. • State agency 619 had project expenditures totaling $18,263,991; however, $16,569,742 was reported resulting in a ($1,694,249) difference. Over reported: • State agency 585 had project expenditures totaling $1,536,601; however, $2,081,086 was reported resulting in a $544,485 difference. • State agency 800 had project expenditures totaling $3,286,109; however, $3,736,100 was reported resulting in a $449,991 difference. Cause: The State of Oklahoma/OMES-GMO failed to implement adequate controls to ensure quarterly reports were accurately reported to the U.S. Department of the Treasury. Effect: Total quarterly expenditures per the Project and Expenditure Reports during SFY 2024 were under reported by $2,271,229, which reduces the accuracy and reliability of the State’s federal reporting of CSLFRF expenses. Recommendation: We recommend the State of Oklahoma/OMES-GMO strengthen its reporting policies and procedures by requiring staff to reconcile expenditure amounts to the State of Oklahoma - Statewide Accounting System records and investigate and resolve any differences prior to submitting the report to the U.S. Department of the Treasury. In addition, we recommend reconciling reports already submitted to the U.S. Department of the Treasury, to identify errors and revise future reports. Further, we recommend OMES-GMO require that state agencies reconcile to the Summary of Receipts and Disbursements (SRD) for class fund 497 (and 488 for agency 090) to ensure expenditures are reported accurately. Criteria: Per 2 CFR § 200.303 states in part, “The non-Federal must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Management Response Contact Person: Elizabeth Base Anticipated Completion Date: April 30, 2027, due to variances in normal business processes, reimbursement timing, accounting adjustments, and Treasury reporting requirements. Corrective Action Planned: The Office of Management Enterprise Services – Grants Management Office disagrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report. Auditor Response: Although the Treasury’s process permits subsequent corrections, it is not a substitute for effective quarter-end cutoff controls; rather, it exists to remedy isolated errors, not to routinely reconcile broad timing gaps after the fact. Quarter end procedures must capture what was expended in the quarter and prevent routine deferral or acceleration of amounts across periods. The cash basis expenditures tied to the Statewide Accounting System making it possible to align Project and Expenditure Reports to quarter specific activity with appropriate reconciliations and cutoff checks before certification. Reliance on subsequent quarter corrections or final closeout to achieve alignment does not provide reasonable assurance at the time of quarterly reporting and undermines comparability across quarters. The Project and Expenditure Reports for SFY 2024 did not consistently reflect expenditures in the correct quarter, and the pattern across multiple agencies indicates a control deficiency, not merely unavoidable timing. Accurate quarter reflection must be achieved at the time of each quarterly certification. We therefore stand by the recommendation to strengthen reporting policies and procedures and to reconcile and resolve differences before submission to the Treasury.

FINDING NO: 2024-069 Strengthen Internal Controls Over Federal Expenditures Charged To Other Grants and Excessive Defined Contributions (Pathfinder) Being Charged To Federal Grants STATE AGENCY: State of Oklahoma FEDERAL AGENCY: U.S. Department of the Treasury ALN: 21.027 FEDERAL PROGRAM NAME: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance QUESTIONED COSTS: $80,370 Condition and Context: While reconciling the Oklahoma Broadband Office (OBO) SEFA to the statewide accounting system we noted OBO used class fund 497 (CSLFRF designated class fund) for ALN 11.035 (Broadband Equity, Access, and Deployment (BEAD) Program) and ALN 11.032 (State Digital Equity Planning and Capacity Grant Program) payroll expenditures totaling $322,387. The BEAD program is designated to class fund 410. The Digital Equity Planning and Capacity Grant Program is designated to class fund 400. This resulted in a payroll fund correcting entry in the same amount; therefore, we will not question the costs. For employees in Oklahoma’s Pathfinder Defined Contribution retirement plan, the employer pays a defined contribution match on the employee’s pay. That match can be charged to CSLFRF (class fund 497) or other grants, as long as the employee’s work benefits the grant. The employer also must send an extra amount to the retirement system so total employer contributions equal the standard rate, and that extra amount cannot be charged to grants and must be paid with state funds. We noted $80,370 [$84,986 (total CF 497 Pathfinder) - $4,616 (Payroll Fund Corrections)] was charged to class fund 497 account 513300 for Pathfinder. The remaining uncorrected charges for Pathfinder will result in questioned costs. Cause: The State does not have a process or control to ensure program expenditures are charged only to the respective class fund for that program. Effect: The $80,370 in excess Pathfinder contributions overcharged to the CSLFRF program are required be reimbursed to the Federal agency. Recommendation: We recommend the State develop and implement controls to ensure agencies can only charge federal grant payroll expenditures to the respective class fund for each program. In addition, ensure Pathfinder excess contributions (account 513300) are not charged to the CSLFRF program. Criteria: 2 CFR 200.405 (d) Allocable costs states, “Direct cost allocation principles. If a cost benefits two or more projects or activities in proportions that can be determined without undue effort or cost, the cost must be allocated to the projects based on the proportional benefit. If a cost benefits two or more projects or activities in proportions that cannot be determined because of the interrelationship of the work involved, then, …, the costs may be allocated or transferred to benefitted projects on any reasonable documented basis.” 2 CFR §200.62, “Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards: (a) Transactions are properly recorded and accounted for, in order to: …. (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award and (b) Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program. …. .” 2 CFR 200.403 (a) Factors affecting allowability of costs states, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles.” 2 CFR 200.431 (c) Compensation – fringe benefits states, . . . “Such benefits, must be allocated to Federal awards and all other activities in a manner consistent with the pattern of benefits attributable to the individuals or group(s) of employees whose salaries and wages are chargeable to such Federal awards and other activities, and charged as direct or indirect costs in accordance with the non-Federal entity's accounting practices.” A basic objective of Generally Accepted Accounting Principles is to provide accurate, reliable, and timely information. Management Response Contact Person: OMES: Elizabeth Base; 085: Beverlee Harbuck Anticipated Completion Date: December 31, 2026. Corrective Action Planned: The Office of Management Enterprise Services – Grants Management Office agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-074 (Repeat 2023-101) Obtain Adequate Invoice Documentation to Support Administrative Cost Reimbursements. STATE AGENCY: State of Oklahoma FEDERAL AGENCY: U.S. Department of the Treasury ALN: 21.027 FEDERAL PROGRAM NAME: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance QUESTIONED COSTS: $67,998 Condition and Context: The State of Oklahoma had twenty-two (22) state agencies report CSLFRF expenditures on the Schedule of Expenditures of Federal Awards (SEFA) for SFY 2024. For the nine (9) state agencies selected for cash basis non-subrecipient testing, we sampled 72 of 489 transactions totaling $9,447,954 from a population of $14,688,540, and noted only one exception for lack of adequate documentation on the invoice to support the administrative costs (see additional exceptions from sample on finding 2024-075): • Department of Human Services (DHS) processed reimbursement claim #1960613 totaling $13,320 for administrative costs related to services provided by Jill Geiger Consulting (JGC). The associated JGC invoice lacked sufficient detail to substantiate the allowability and allocability of the charges to the CSLFRF award. The invoice for claim #1960613 provided only a general description for program management services for the project included in SB1186 for June 2023 and listed quantity, rate, and amount, with no project-level or staff-level detail. SB1186 designated funds for only one project. The invoice did not document the progress of work performed for the project (e.g., staff assigned, hours by staff, cumulative hours/amounts, or cumulative percent of contract billed). For the nine (9) state agencies selected for current-year accounts payable testing, we sampled 35 of 113 current-year accounts payable transactions totaling $11,282,131 from a population of $16,177,841, and noted only one exception for lack of adequate documentation on the invoice to support the administrative costs (see additional exceptions from sample on finding 2024-075): • Department of Human Services (DHS) processed reimbursement claim #2013148 totaling $54,678 for administrative costs related to services provided by Jill Geiger Consulting (JGC). The associated JGC invoice lacked sufficient detail to substantiate the allowability and allocability of the charges to the CSLFRF award. The invoice for claim #2013148 provided only a general description for program management services for projects included in HB2884 for June 2024 and listed quantity, rate, and amount, with no project-level or staff-level detail. HB2884 designated funds for nine projects. The invoice did not document the progress of work performed for each project (e.g., staff assigned, hours by staff, cumulative hours/amounts, or cumulative percent of contract billed). Cause: The State did not require JGC to submit invoices with sufficient detail to support the administrative costs billed to each project. Existing invoice review procedures did not ensure that key documentation elements were provided prior to reimbursement. Effect: Without detailed invoices supporting the nature and extent of work performed for each project, the State cannot demonstrate that the administrative costs billed were reasonable, allocable, and allowable under Federal requirements. This deficiency increases the risk of unallowable or unsupported charges, misallocation across projects, inaccurate financial reporting, and potential repayment or recovery of questioned costs. Recommendation: The State and DHS should ensure JGC provides invoices with the following details: • Staff assigned to each project and hours billed by each staff • Total current hours billed for each project • Total current amount billed for each project • Cumulative hours billed for each project • Cumulative amount billed for each project • Cumulative amount billed as a percentage of total contract value • Detailed description of work performed. Criteria: 2 CFR § 200.303 – Internal Controls states in part, “The Non-Federal entity must; (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.403 - Factors affecting allowability of costs states in part, “Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (g) Be adequately documented.” 2 CFR § 200.404 Reasonable costs, states in part, “A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person under the circumstances prevailing at the time the decision was made to incur the cost. The question of reasonableness is particularly important when the non-Federal entity is predominantly federally-funded. In determining reasonableness of a given cost, consideration must be given to … : (a)Whether the cost is of a type generally recognized as ordinary and necessary for the operation of the non-Federal entity or the proper and efficient performance of the Federal award. (b) The restraints or requirements imposed by such factors as: sound business practices; arm's-length bargaining; Federal, state, local, tribal, and other laws and regulations; and terms and conditions of the Federal award. (c) Market prices for comparable goods or services for the geographic area. (d) Whether the individuals concerned acted with prudence in the circumstances considering their responsibilities to the non-Federal entity, its employees, where applicable its students or membership, the public at large, and the Federal Government. (e) Whether the non-Federal entity significantly deviates from its established practices and policies regarding the incurrence of costs, which may unjustifiably increase the Federal award's cost.” 2 CFR §200.405 (d) Allocable costs states, “Direct cost allocation principles. If a cost benefits two or more projects or activities in proportions that can be determined without undue effort or cost, the cost must be allocated to the projects based on the proportional benefit. If a cost benefits two or more projects or activities in proportions that cannot be determined because of the interrelationship of the work involved, then, …, the costs may be allocated or transferred to benefitted projects on any reasonable documented basis.” Management Response Contact Person: OMES: Elizabeth Base DHS: Lindsey Kanaly Anticipated Completion Date: Completed Corrective Action Planned: The Office of Management Enterprise Services – Grants Management Office disagrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report. Auditor Response: The invoices lacked the minimum detail needed to substantiate the nature and extent of work and cumulative progress. Agreement of total hours between invoices and timekeeping does not establish allocability to each project. The requirement is that hours charged to a project on the invoice match and be traceable to the actual staff reported hours for that project.

FINDING NO: 2024-075 Strengthen documentation and project scope reviews, enforce procurement, confirm receipt, and recover or reclassify unallowable CSLFRF costs STATE AGENCY: State of Oklahoma FEDERAL AGENCY: U.S. Department of the Treasury ALN: 21.027 FEDERAL PROGRAM NAME: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Period of Performance, Procurement and Suspension and Debarment, Subrecipient Monitoring QUESTIONED COSTS: $630,505 Condition and Context: The Office of Management and Enterprise Services - Grants Management Office (OMESGMO) is the central administering entity of CSLFRF funds for the State of Oklahoma (primary recipient). Although OMES-GMO has the authority to transfer funds, the transfer to state agencies does not create a subrecipient relationship since both entities are part of the same auditee (State of Oklahoma Single Audit). CSLFRF funds were transferred by the State of Oklahoma to twenty-two (22) state agencies, each of which reported CSLFRF expenditures on the Schedule of Expenditures of Federal Awards (SEFA) for SFY 2024. We selected nine (9) state agencies for Non-Subrecipient, Subrecipient, and Accounts Payable Testing. For the nine (9) state agencies selected for cash basis testing, we randomly sampled 72 of 489 non-subrecipient transactions totaling $9,447,954 from a population of $14,688,540 (64.3%), and noted the following exceptions: o For five claims reviewed at agency (025), we noted the agency chose to follow the controlled advance policy; therefore, OMES-GMO only reviewed supporting documentation provided during quarterly reporting to U.S Treasury, based on what the agency submitted. It does not appear OMES-GMO would have had sufficient support to determine the costs were allowable since the documentation provided was the same as what is available in the Statewide Accounting System. The claims in Statewide Accounting System were supported with only an OMD Design Build Invoice or professional services invoice. Therefore, it does not appear the claims were properly reviewed since there was not enough support provided by the vendor at the time of payment. Based on our review of additional support and contracts requested through the vendor, the costs were allowable; therefore, we will not question the costs. o For four claims reviewed at agency (085), it appears the expenditures were for the federal Broadband Equity, Access, and Deployment (ALN 11.035 - BEAD) and Digital Equity Act (ALN 11.032 - DEA) State Planning Grant programs. We obtained the scope of work associated with the purchase order for the claims from the Statewide Accounting System and noted it appears CSLFRF funds were used to supplement BEAD and DEA planning and implementation expenditures. Therefore, the expenses are outside the scope of the Broadband Mapping project for CSLFRF. As a result, it appears $309,250 of unallowable costs were reviewed and approved. o For one claim reviewed at agency (085), we noted the claim was for legislative consulting services in April, May, and June 2023. Each month of service was a charge of $6,000 for a total of $18,000. No purchase order was created for the April 2023 services. Therefore, the agency completed the Agency Business Services (ABS) – Form 009 Ratification Agreement. The claim was then processed by ABS and services were paid on 9/18/23. The state incurred an obligation before encumbering funds; therefore, violating procurement policies. o For three claims reviewed at agency (452), we noted it does not appear OMES-GMO would have had sufficient support to determine if the costs were allowable. The invoice only states "work completed" or "progress billing" for a period; therefore, we are unable to determine what services were performed. It does not appear the claim was properly reviewed by OMES-GMO. In addition, we noted the claim was reversed as a result of a correcting voucher included in the current year accounts payable to move the class funding from CF 497 (Federal CSLFRF) to CF 194 (state). Therefore, we will not question the costs. o For one claim reviewed at agency (452), we noted the claim required a ratification for payment. The state incurred an obligation before encumbering funds; therefore, violating procurement policies. In addition, we noted the claim was reversed as a result of a correcting voucher included in the current year accounts payable to move the class funding from CF 497 (Federal CSLFRF) to CF 194 (state). Therefore, we will not question the costs. Additional exceptions noted during non-subrecipient testing can be found at findings 2024-043, 2024-069, & 2024- 074. Questioned costs for non-subrecipient transactions totaled $309,250. For the nine (9) state agencies selected for cash basis testing, we randomly sampled 52 of 443 subrecipient transactions totaling $18,059,149 from a population of $49,407,554 (36.6%), and noted the following exceptions: o For two claims reviewed at agency (400), we noted the agency chose to follow the controlled advanced policy; therefore, OMES-GMO only reviewed supporting documentation provided during quarterly reporting to U.S Treasury, based on what the agency submitted. The costs do not appear to be within the CSLFRF project description. Therefore, $257 of unallowable costs were reviewed and approved. o For one claim reviewed at agency (619), we noted it does not appear OMES-GMO would have had $10,915 of $74,472 in supporting documentation to ensure a proper review and approval. Based on our review of the missing support we obtained from the agency the costs were allowable; therefore, we will not question the costs. o For one claim reviewed at agency (830), we noted it appears $331 of unallowable costs (incentive gift cards, travel costs and mileage for training) were reviewed and approved. o For two claims reviewed at agency (830), we noted there was no receiving documentation such as a packing slip or bill of lading to indicate the goods had been received by the intended recipient. We obtained the missing support from the agency; therefore, we will not question the costs. Questioned costs for subrecipient transactions totaled $588. For the nine (9) state agencies selected for current-year accounts payable testing, we randomly sampled 35 of 113 current-year accounts payable transactions totaling $11,282,131 from a population of $16,177,841 (69.7%), and noted the following exceptions: o For three claims reviewed at agency (025), we noted the agency chose to follow the controlled advance policy; therefore, OMES-GMO only reviewed supporting documentation provided during quarterly reporting to U.S Treasury, based on what the agency submitted. It does not appear OMES-GMO would have had sufficient support to determine the costs were allowable since the documentation provided was the same as what is available in the Statewide Accounting System. The claims in Statewide Accounting System were supported with only an OMD Design Build Invoice or professional services invoice. Therefore, it does not appear the claims were properly reviewed since there was not enough support provided by the vendor at the time of payment. Based on review of additional support and contracts requested through the vendor, the costs were allowable; therefore, we will not question the costs. o For three claims reviewed at agency (085), it appears the expenditures were for the federal Broadband Equity, Access, and Deployment (ALN 11.035 - BEAD) and Digital Equity Act (ALN 11.032 - DEA) State Planning Grant programs. We obtained the scope of work associated with the purchase order for the claims from the Statewide Accounting System and noted it appears CSLFRF funds were used to supplement BEAD and DEA planning and implementation expenditures; therefore, outside the intent or scope of the CSLFRF Broadband Mapping project. As a result, it appears $320,667 of unallowable costs were reviewed and approved. Additional exceptions noted during current-year accounts payable testing can be found at findings 2024-043 and 2024-074. Questioned costs for current-year accounts payable transactions totaled $320,667. Cause: The controlled advance review performed by OMES‑GMO relied on summary documentation at the time of quarterly reporting to U.S. Treasury, which does not consistently provide the detailed evidence necessary to determine allowability. Preventive procurement controls were not consistently followed, as evidenced by obligations incurred prior to encumbrance and subsequent ratifications. Also, controls to ensure expenditures were for the intended project were insufficient to prevent CSLFRF charges that supplemented other federal programs. Lastly, receiving evidence was not consistently retained or reviewed for subrecipient expenditures. Effect: The conditions noted above increase the risk that unallowable costs are charged to CSLFRF and that the State of Oklahoma is not in compliance with Uniform Guidance and U.S. Treasury program requirements. The deficiencies also elevate the risk of SEFA misstatement at an agency and state level, and potential repayment to the federal government. Recommendation: We recommend the State of Oklahoma strengthen controls for claims review procedures by requiring detailed invoices, deliverable‑level descriptions, and receiving evidence to be presented at the time of review. Further, the State of Oklahoma should strengthen controls to ensure project expenditures are within the scope of the project. The State of Oklahoma should strengthen controls to ensure that all obligations are properly encumbered before commitments are made. Also, the State of Oklahoma should implement review procedures to detect and prevent obligations from being incurred without an existing encumbrance. Subrecipient monitoring should include consistent verification of supporting documentation and perform follow‑up for any missing support. Lastly, a retrospective review should be performed for high‑risk agencies and transactions to identify, recover, or reclassify any additional unallowable charges. Criteria: 2 CFR § 200.303 – Internal Controls states in part: “The Non-Federal entity must; (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.334 – Retention requirements for records states in part: “Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient.” 2 CFR § 200.403 states in part: “Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: … (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. … (g) Be adequately documented. See also §§ 200.300 through 200.309 of this part.” 2 CFR § 200.405(a) states: “A cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received. This standard is met if the cost: (1) Is incurred specifically for the Federal award; (2) Benefits both the Federal award and other work of the non-Federal entity and can be distributed in proportions that may be approximated using reasonable methods; and (3) Is necessary to the overall operation of the non-Federal entity and is assignable in part to the Federal award in accordance with the principles in this subpart.” 2 CFR § 200.317, - Procurements by States states: “When procuring property and services under a Federal award, a State must follow the same policies and procedures it uses for procurements from its non-Federal funds.” Applicable State Rules and Regulations Okla. Const. art. X, § 23 - Balanced budget – Procedures states: “The state shall never create or authorize the creation of any debt or obligation, or fund or pay any deficit, against the state, or any department, institution or agency thereof, regardless of its form or the source of money from which it is to be paid.” 62 O.S. § 34.62 - Encumbrance Requirements for Payments from Funds of State states: “Encumbrance requirements for payments from funds of the state shall include the following: 1. Whenever agencies of this state enter into contracts for, or on behalf of the state for the purchase of tangible or intangible property, or for services or labor, such agreement shall be evidenced by written contracts or purchase orders, and must be transmitted to the Director of the Office of Management and Enterprise Services within a reasonable time from the date of the awarding of the contract or purchase order.” Management Response Contact Person: Elizabeth Base Anticipated Completion Date: December 31, 2026 Corrective Action Planned: The Office of Management Enterprise Services – Grants Management Office disagrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report. Auditor Response: OMES-GMO’s reliance on 62 O.S. § 255.1 to label agencies “subrecipients” cannot override Federal audit classification. State-mandated grant agreements may be useful internal oversight instruments, but they do not convert intra-State transfers into Federal subawards for Single Audit purposes. Both the State’s central oversight (OMESGMO) and the state agency share responsibility for ensuring the award complies. Failures at the agency level can create noncompliance for the State’s Single Audit. The State is externally accountable to the Federal awarding agency. In Single Audit terms, they act as one non-federal entity, so compliance, controls, and reporting are consolidated across them. Relevant state agencies were contacted to obtain information and supporting documentation and were provided with an opportunity to submit additional support, clarifications, or evidence responding to the finding. Despite this outreach and the extended window for response, no further support was provided. Agency 025 It is the agency’s responsibility to perform and document a concurrent allowability review at the time of payment and to retain sufficient support in OMD’s own grant/finance records. The Uniform Guidance requires that costs be adequately documented and that the non-Federal entity maintain records that identify the source and application of funds and support its internal control over compliance. Agency 085 Supporting records indicate work that principally benefits BEAD/DEA planning and implementation. Absent a documented allocation basis that ties the charged amounts to CSLFRF mapping deliverables, the charges are not allocable to CSLFRF. Processing payments “together” for convenience does not relieve OBO of its obligation to segregate costs by funding source and retain sufficient documentation in OBO’s files that demonstrates allowability under CSLFRF. Agency 400 Based on our review of the subrecipient contract description for how the funds will be utilized, we maintain our position that the Keurig holder and portable heaters appear to be outside the scope of the project. Agency 830 The agency’s response describes programmatic rationale for $100 completion-based incentives but does not address the specific transaction tested which were four $25 gift cards purchased on October 25, 2023. The agency did not provide documentation identifying recipients, issuance dates, or purposes for the gift cards. The support provided pertains to a different period (January – March 2024) and different amounts ($100).

FINDING NO: 2024-055 Strengthen Controls over Submission of VA-Form 10-5588A STATE AGENCY: Oklahoma Department of Veterans Affairs (ODVA) FEDERAL AGENCY: U.S. Department of Veterans Affairs (USDVA) ALN: 64.015 FEDERAL PROGRAM NAME: Veterans State Nursing Home Care FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Eligibility, Reporting QUESTIONED COSTS: $0 Condition and Context: The VA Form 10-5588 report is the basis for federal payment to ODVA under the Veterans State Nursing Home Care grant. Each of the 7 Homes in the State of Oklahoma prepare and submit a VA Form 10- 5588 monthly to central office for review. Revisions to the submitted 10-5588 due to a veteran being retroactively changed to the service-connected disability rate are done by completing the VA Form 10-5588A (Claim for Payment for Nursing Home Care Provided to Veterans Awarded Retroactive Service Connection). When a veteran’s Service- Connection is re-evaluated at 70% or higher, they become eligible to receive the prevailing rate per diem. This determination is retroactively applied, so ODVA must submit a revision form including days of care at the basic rate. In order to submit the revision, ODVA prepares a VA Form 10-5588A, which is sent by email to the agency’s liaison at USDVA. Based on discussion with management, no 10-5588 revisions (VA Form 10-5588A’s) were submitted during SFY 2024. Based on review of the list of revisions applicable to SFY 2024 provided by ODVA, it appears there were 52 10- 5588A’s that should have been submitted to the USDVA. Cause: ODVA did not have adequate internal controls in place for SFY 2024 to ensure and track the submission of VA Form 10-5588A’s. Effect: ODVA did not receive per diem at the prevailing rate for 52 residents determined to meet the Service- Connection of 70% disability or higher. As a result, the ODVA is not receiving the per diem allowed under the program in a timely manner. Recommendation: We recommend ODVA develop and implement a process to track 10-5588 revisions (VA Form 10-5588A’s), including whether they have been submitted to USDVA. Criteria: 38 CFR §51.41(c)(4) “Payments under State home care agreements” states in part: “If a veteran receives a retroactive VA service-connected disability rating and becomes a veteran identified in paragraph (a) of this section, the State home may request payment under the State home care agreement for nursing home care back to the retroactive effective date of the rating or February 2, 2013, whichever is later. For care provided after the effective date but before February 2, 2013, the State home may request payment at the special per diem rate that was in effect at the time that the care was rendered.” 38 CFR §51.42(a)(1) “Forms required at time of admission or enrollment” states in part: “As a condition for receiving payment of per diem under this part…the State home must also submit the appropriate form with any request for a change in the type of per diem paid on behalf of a veteran as a result of a change in the veteran's program of care or a change in the veteran's service-connected disability rating that makes the veteran's care eligible for payment under § 51.41...” 2 CFR §200.303 “Internal controls” states in part: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” A basic objective of Generally Accepted Accounting Principles is to provide accurate, reliable, and timely information. Views of Responsible Official(s) Contact Person: Chris Busby (CFO), and Caitlyn Thiele (Accounting Manager), Oklahoma Department of Veterans Affairs Anticipated Completion Date: August 31, 2026: Finalize the design of the revised tracking sheet and standard operating procedures. October 31, 2026: Complete comprehensive training for all personnel across the 7 State Homes on the new requirements, procedures, and standardized tracking mechanisms. Corrective Action Planned: The Oklahoma Department of Veterans Affairs concurs with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-073 Strengthen Procurement Procedures To Avoid Ratifications STATE AGENCY: Oklahoma Department of Veterans Affairs (ODVA) FEDERAL AGENCY: U.S. Department of Veterans Affairs (USDVA) ALN: 64.015 FEDERAL PROGRAM NAME: Veterans State Nursing Home Care FEDERAL AWARD NUMBER: N/A FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Part A/B – Activities Allowed or Unallowed & Allowable Costs/Cost Principles QUESTIONED COSTS: $0 Condition and Context: As part of our allowability testing for Veterans State Nursing Home Care grant, we complete a Benford Analysis (Benford’s Law). The Benford’s Analysis is a simple test that looks at the first digit of numbers in a dataset. In many naturally occurring datasets, the number 1 appears as the first digit much more often than 9. If the pattern in the data is very different from this expected distribution, it can be a sign that the numbers were entered incorrectly, manipulated, or are otherwise unusual. When comparing Benford Analysis results between SFY 2023 and 2024, we noted two (2) incidences where the difference between the actual and the expected percentages exceeded +/1.0 percent per Benford’s Law. The differences in percentages by years were related to Leading Digits of ‘1’ and ‘3’ for vendor expenditures. We then investigated the individual vendors within the categories of “Leading Digits of ‘1’ and ‘3’ to observe if there were any substantial differences from one year to the next and noted that there was a shift in expenditures related to “CELL STAFF LLC”. When we observed the invoices attributed to them, we noted that they contained multiple “Ratifications” without a purchase order. Therefore, we expanded our observations to the entirety of the Assistance Listing #64.015 expenditure data and noted that there were at least 244 claims, totaling $12,236,128.29 of approximately $35,000,000 (34%) for non-payroll costs that had to be Ratified because unauthorized procurement procedures allowed vendors to be paid directly by voucher without encumbering funds. However, of the non-payroll claims that we sampled for this grant, we didn’t find that the costs were for unallowable activities, only that they failed to meet procurement protocol. Cause: ODVA did not have controls in place to ensure expenditures are first encumbered via a purchase requisition and/or purchase order, prior to payment. Effect: ODVA did not perform the procurement in line with State of Oklahoma policies, putting the state at risk of being out of compliance with federal/state purchasing standards. In addition, by not encumbering funds through Purchase Order, Purchase Requisition, or Authority Order, ODVA could put the agency at risk of losing real-time visibility into its available budget. Recommendation: We recommend ODVA strengthen their procurement process to ensure expenditure is properly procured and tracked, to ensure the agency has an accurate, real-time budget. Criteria: 2 CFR §200.303 “Internal controls” states in part: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 74 O.S. §85.39 “Development and Promulgation of Internal Purchasing Procedures” states in part: “Each state agency shall develop internal purchasing procedures for acquisitions by the state agency. Procedures shall, at a minimum, include provisions for the state agency’s needs assessment, funding, routing, review, audits, monitoring and evaluations. Following development, the state agency shall submit the procedures to the State Purchasing Director for approval.” Oklahoma Statewide Accounting Manual 6.8 “Encumbrances” states in part: “Article X § 23 of the Oklahoma State Constitution and state statutes require that all state agencies operate an encumbrance system and prohibit any state agency or official from incurring any obligation more than the unencumbered cash balance on hand in their class fundings. Purchases exempt from the Oklahoma Central Purchasing Act are not exempt from encumbrance requirements. In the State Accounting System an agency’s budget dollars are reserved or set aside in three ways: • Completing a requisition in the system, which establishes a pre-encumbrance. • Completing a purchase order in the system. • Completing an authority order (if allowed) that covers the purchase. One of these methods of encumbering should take place prior to the purchase or the effective date of a contract, if a separate contract exists. If the encumbrance is not completed within 30 days after the effective date, the agency must submit a Ratification Agreement pursuant to the procedures set forth below.” Oklahoma Statewide Accounting Manual 6.9.1 “Ratification of Unauthorized Contract” states in part: “If a state agency makes an unauthorized commitment on behalf of the state to a supplier, the state may, if in the best interest of the state, ratify the commitment.” Oklahoma Statewide Accounting Manual 8.3 “Expenditure Year” states: “Expenditures must be associated with the year they are incurred. Agencies cannot use prior year funding on current year expenditures. Likewise, agencies cannot post an expenditure incurred in one year against the following year’s funds.” Views of Responsible Official(s) Contact Person: Chris Busby (CFO), and Eric Edstedt (Purchasing Director), Oklahoma Department of Veterans Affairs Anticipated Completion Date: The above CAP was completed in September 2025, and compliance monitoring is ongoing. Corrective Action Planned: The Oklahoma Department of Veterans Affairs concurs with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-013 (Repeat 2023-010) Strengthen Internal Controls Over Monitoring Supplement Not Supplant STATE AGENCY: Oklahoma State Department of Education (OSDE) FEDERAL AGENCY: United States Department of Education (USDE) ALN: 84.010 FEDERAL PROGRAM NAME: Title I Grants to Local Educational Agencies FEDERAL AWARD NUMBER: S010A230036 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Level of Effort – Supplement not Supplant; Monitoring; Special Tests and Provisions: Title IA Specific Supplement not Supplant QUESTIONED COSTS: $0 Condition and Context: Local Educational Agencies (LEAs) are required to submit an appropriate Supplement not Supplant (SNS) methodology (or methodologies) describing how State and local funds will be allocated or budgeted to each Title I school that ensures the school receives the full amount of the State and local funds it would otherwise receive if it were not receiving Title I funds. OSDE had implemented monitoring activities for tracking the methodologies in prior audit periods (state fiscal year (SFY) 20 and 21); however, staff that prepared and reviewed this spreadsheet were not employed at OSDE during the audit period, and the current employees could not locate a supplement not supplant tracking spreadsheet applicable to SFY 22 to 24. Furthermore, no other support for comparable procedures to ensure compliance with supplement not supplant requirements during the audit period was available. OSDE did have consolidated monitoring procedures to review the LEAs’ methodology. These procedures were limited and did not review the calculations the LEA performed to implement its methodology or verify the methodology was compliant. During our testwork, we determined that during SFY 2024 OSDE did not require the LEAs to demonstrate that the LEAs expended State and local funds in accordance with its methodology, and, the OSDE Office of Federal Programs (OFP) did not perform appropriate procedures to verify and quantifiably demonstrate that: the LEAs’ SNS methodologies were sufficient and effective, and the LEAs only used Federal funds to supplement, and not supplant other non-Federal funds used for Title I activities based on the methodologies submitted by the LEAs to demonstrate compliance. Furthermore, during our review of the Title I Specific Fiscal Requirements section of the United States Department of Education (USDE) Performance Review (dated July 25, 2024) including OSDE’s corrective action, we noted the OSDE revised its ESEA Resource Toolkit, the Title I, Part A Handbook, and the ESEA Grant Performance Review Application in Grant Management System (GMS) in response to the USDE findings and recommendations on July 25, 2024. As of April 11, 2025, the USDE stated that the SNS requirement was resolved as “OSDE developed new resources with example methodologies regarding Title I supplement not supplant requirements in ESEA section 1118(b) that the LEA’s methodologies to allocate State and local funds to schools results in each Title I school receiving all of the State and local funds it would have otherwise received if it were not receiving Title I funds. OSDE’s new resources for LEAs demonstrate examples of allocation methodologies similar to those shown in ED’s supplement not supplant guidance.” Because OSDE’s response occurred after the audit period of SFY 2024, the corrections and the updated methodologies were not included in the scope of the audit. Cause: OSDE’s existing monitoring activities lacked the necessary strength and consistency to effectively support ongoing oversight of compliance with 20 U.S. Code § 6321 during the audit period. Effect: The program was noncompliant with SNS requirements during the audit period. Continued noncompliance with SNS requirements increases the risk of Federal claw backs and impacts state dollars. Recommendation: We recommend OSDE continue to strengthen its monitoring activities over the LEA Supplement not Supplant requirements. These activities should include but not be limited to implementing the updated policies, procedures, and methodologies submitted to and approved by the USDE to ensure LEAs are supplementing and not supplanting Title I funds. Criteria: 20 U.S. Code § 6321 states in part: “(b) Federal funds to supplement, not supplant, non-Federal funds - 1) IN GENERAL - A State educational agency or local educational agency shall use Federal funds received under this part only to supplement the funds that would, in the absence of such Federal funds, be made available from non-Federal sources for the education of pupils participating in programs assisted under this part, and not to supplant such funds. 2) COMPLIANCE – To demonstrate compliance with paragraph (1), a local educational agency shall demonstrate that the methodology used to allocate State and local funds to each school receiving assistance under this part ensures that such school receives all of the State and local funds it would otherwise receive if it were not receiving assistance under this part.” 2 CFR § 200.303(a) states in part: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Title I Supplement not Supplant Guidance, FAQ # 19 states, “Must an LEA maintain documentation to demonstrate that the LEA allocated State and local funds to schools in accordance with its methodology? Yes. Under ESEA section 8306(a)(6)(B) and 34 C.F.R. §§ 76.730-76.731, an LEA must keep records to show compliance with program requirements and facilitate an effective audit. Accordingly, an LEA must maintain documentation necessary to demonstrate that its methodology results in each Title I school in the LEA receiving all of the State and local funds it would otherwise receive if it were not receiving Title I, Part A funds and provide this information upon request to the SEA, auditors, and other authorized individuals. Examples of documentation include the LEA’s methodology and calculations the LEA performed to implement its methodology.” Title I Supplement not Supplant Guidance, FAQ # 24 states in part: “The ESEA requires an SEA to monitor its LEAs to ensure compliance with the requirements of the ESEA (see ESEA section 8304(a)(1), (3)(B)), which would include that an LEA has a compliant methodology for allocating State and local funds, among other requirements.” Management Response Contact Person: Tammy Smith | Senior Director of Federal Programs Anticipated Completion Date: April 11, 2025 Corrective Action Planned The Oklahoma State Department of Education agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-001 (Partial Repeat 2023-053) Strengthen Internal Controls Over LEA Risk Assessment Monitoring STATE AGENCY: Oklahoma State Department of Education (OSDE) FEDERAL AGENCY: United States Department of Education (USDE) ALN: 84.010; 84.425 – 84.425D, 84.425U FEDERAL PROGRAM NAME: Title I Grants to Local Educational Agencies; Education Stabilization Fund (ESF) - Elementary and Secondary Schools Emergency Relief Fund (ESSER II); American Rescue Plan – Elementary and Secondary Schools Emergency Relief Fund (ARP ESSER III) FEDERAL AWARD NUMBER: S010A230036; S425D210024; S425U210024 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Subrecipient Monitoring QUESTIONED COSTS: $0 Condition and Context: All Local Educational Authorities (LEAs) are monitored for Federal programs at least once on a three-year cycle; however, additional monitoring may be required for LEAs identified as high risk. OSDE utilizes a Risk Assessment Ranking Tool to track LEA risk scores and determine whether any additional LEAs should be monitored during the school year. We audited a sample of 60 of 537 LEAs listed in the Risk Assessment Ranking Tool and identified: • 22 of 60 (36.67%) LEA risk scores were not appropriately evaluated.  High risk category – eight LEAs would have remained at high risk.  Moderate risk category –three LEAs should have been increased to high risk and were not monitored appropriately, and five LEAs would have remained at moderate risk.  Low risk category –four LEAs should have been increased to moderate risk, and two LEAs would have remained at low risk. Cause: OSDE’s existing monitoring activities lacked the necessary strength and consistency to effectively support ongoing oversight of subrecipient LEA risk scores in the Risk Assessment Ranking Tool. Effect: Inaccurate distribution of an LEAs points in the Risk Assessment Monitoring Tool results in inconsistent monitoring of the total risk score for subrecipient LEAs. In addition, LEAs may not be identified appropriately as high risk, which affects the level of monitoring necessary to ensure the LEA complies with requirements. Recommendation: We recommend OSDE continue to strengthen its policies and procedures related to risk assessment scoring to ensure all subrecipients are appropriately evaluated and monitored. Criteria: 2 CFR § 200.332(b) states in part: “All pass-through entities must: … (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency).” 2 CFR § 200.303(a) states in part: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Management Response Contact Person: Tammy Smith | Senior Director of Federal Programs Anticipated Completion Date: August 2026 Corrective Action Planned: The Oklahoma State Department of Education agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-002 Strengthen Internal Controls over Preparation of the Schedule of Expenditures of Federal Awards (SEFA) STATE AGENCY: Oklahoma State Department of Education (OSDE) FEDERAL AGENCY: United States Department of Education (USDE) ALN: 10.558; 84.010; 84.425 - 84.425D; 84.425U; 84.425R, 84.425V FEDERAL PROGRAM NAME: Child and Adult Care Food Program (CACFP); Title I, Part A – Grants to Local Educational Agencies; Education Stabilization Fund (ESF): Elementary and Secondary School Emergency Relief Fund (ESSER); Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance for Non-Public Schools (CRRSA EANS); American Rescue Plan – Elementary and Secondary Schools Emergency Relief Fund (ARP ESSER); ARP – EANS FEDERAL AWARD NUMBER: 6OK300330, 6OK300349; S010A230036; S425D210024; S425R210007; S425U210024; S425V210007 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Reporting QUESTIONED COSTS: $0 Condition and Context: Each state agency is required to submit its Schedule of Expenditures of Federal Awards (SEFA – GAAP Package Z) to the State of Oklahoma Office of Management and Enterprise Services (OMES). OMES requires each agency to review its SEFA – GAAP Package Z for validity, accuracy, and completeness and verify this review through a signature accompanying the submission. OSDE submitted its state fiscal year (SFY) 2024 SEFA – GAAP Package Z to OMES. During our review of the SEFA – GAAP Package Z, we determined the SEFA included the following errors: • For all assistance listing numbers, the amounts reported did not include applicable indirect costs, transfers (either from or to other state agencies), or between federal programs), Consolidated Administrative costs, or refunds. Also, direct payroll was not included for most of the assistance listing numbers. These issues combined caused the total cash basis OSDE SEFA to be understated by at least $35,028,735 or 2.61%. This amount does not include refunds as OSDE did not provide this information. For reference, the prior year’s refunds were approximately $2 million. • The SEFA did not include the internal transfers between federal education programs of $18.8 million. The total SEFA amount for education programs is not affected. • The amount recorded for the ARP EANS II contractual accounts payable was $0 and should have been $383,748. • The amount recorded for the CRRSA Act accounts payable was the same amount recorded in FY23. • The expenditures recorded for the CACFP Audit grant were actually applicable to the CACFP Food Program grant and vice versa. Because these two grants have the same assistance listing number, the combined total was not affected. Cause: OSDE has not established robust internal procedures to ensure accurate calculation and reporting of all applicable amounts on the SEFA -GAAP Package Z. Additionally, the personnel or contractors responsible for preparing and reviewing the SEFA lack sufficient knowledge and training to perform these duties in compliance with applicable requirements. Effect: The amounts reported on the SEFA do not reflect the total expenditures including direct payroll, indirect costs, transfers, refunds and other entitlements. Also, the accrual basis amount for the CRRSA Act and ARP EANS II does not reflect an accurate accounts payable amount. Recommendation: We recommend OSDE review the current procedures and implement robust controls to ensure accurate reporting of program financial information on its SEFA - GAAP Package Z. Additionally, we recommend the preparer and reviewer obtain and review the OMES SEFA - GAAP Package Z Instructions to ensure all applicable amounts are included in the SEFA. Criteria: A basic objective of Generally Accepted Accounting Principles is to provide accurate and reliable information. 2 CFR § 200.303(a) – Internal Controls states in part: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR §200.62 states: “Internal control over compliance requirements for Federal awards means a process implemented by a non-Federal entity designed to provide reasonable assurance regarding the achievement of the following objectives for Federal awards: (a) Transactions are properly recorded and accounted for, in order to: . . . (3) Demonstrate compliance with Federal statutes, regulations, and the terms and conditions of the Federal award and (b) Transactions are executed in compliance with: (1) Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program. . . .” Management Response Contact Person: Kathy Wall - Comptroller Anticipated Completion Date: October 2026 Corrective Action Planned: The Oklahoma State Department of Education agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-015 (Partial Repeat # 2023-061) Strengthen Internal Controls Over Review and Approval or Claims STATE AGENCY: Oklahoma State Department of Education (OSDE) FEDERAL AGENCY: United States Department of Education (USDE) ALN: 10.558; 84.010; 84.425 - 84.425U FEDERAL PROGRAM NAME: Child and Adult Care Food Program (CACFP); Title I, Part A – Grants to Local Educational Agencies; Education Stabilization Fund (ESF): Elementary and Secondary School Emergency Relief Fund (ESSER); American Rescue Plan – Elementary and Secondary Schools Emergency Relief Fund (ARP ESSER) FEDERAL AWARD NUMBER: 6OK300330, 6OK300349; S010A230036; S425U210024 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed or Unallowed & Allowable Costs/Cost Principles QUESTIONED COSTS: ALN 84.425U - $1,549 Condition and Context: OSDE has policies and procedures in place to review and approve claims. In addition, the Comptroller’s Office has policies and procedures in place to determine which claims are to be included in accounts payable We tested a sample of 35 of 745 (4.7%) Education Stabilization Fund (ESF) accounts payable claims totaling $57,843,297, and identified: • One of 35 (2.86%) ESF claims lacked supporting invoices which were not obtained by OSDE until after our inquiry, indicating inadequate review and approval. We subsequently received supporting documentation and were able to verify the invoices were for allowable costs. • One of 35 (2.86%) ESF claims had invoiced amounts less than the expenditure within the claim, resulting in an overclaim of $1,549. We tested a sample of 23 of 456 (5.04%) Title I, Part A accounts payable claims totaling $34,218,534 and identified: • One of 23 (4.35%) Title I, Part A claims lacked supporting invoices which were not obtained until after our inquiry, indicating an inadequate review and approval. We subsequently received supporting documentation and were able to verify the invoices for allowable costs. We tested a sample of 6 of 1,491 (.40%) CACFP accounts payable claims totaling $16,763, reported on the state fiscal year (SFY) 2024 Schedule of Federal Awards (SEFA) dated July 1, 2024 to August 15, 2024, and identified: • Four of six (66.67%) CACFP claims totaling $6,268 with claim months after June 30, 2024 should not have been included in the SFY 2024 CACFP accounts payable population. Cause: OSDE’s claims review and approval process lacked the necessary strength and consistency to adequately review Title I and CACFP claims to ensure proper supporting documentation, including invoices, agrees with the expenditures submitted on the claim to ensure the amounts claimed were accurate and for allowable costs. In addition, OSDE’s accounts payable determination lacked necessary strength and consistency to accurately review and account for accounts payable transactions for goods and services received after June 30, 2024. Effect: Inadequate review of claims with proper supporting documentation increases the risk of reimbursement of unallowable expenses resulting in noncompliance. Furthermore, noncompliance increases the risk of Federal claw backs, which impacts state dollars. Noncompliance during the audit period resulted in $1,549 of state funds owed to the USDE. Additionally, inaccurate reporting of goods and services received during the period increases the risk of accounts payable in the CACFP SEFA accrual amount to be overstated. The exception rate in our testwork indicates a significant overstatement of accounts payable is likely. Recommendation: We recommend OSDE strengthen its claims review and approval process to ensure accurate supporting documentation for claims is included and only allowable costs are reimbursed. We also recommend OSDE strengthen its accounts payable determination process to accurately account for claims identified as accounts payable for the audit period. Criteria: 2 CFR § 200.403 states in part: “Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. … (g) Be adequately documented.” 2 CFR Part 200 §200.1 states in part: “Improper payment means a payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. The term improper payment includes: any payment to an ineligible recipient; any payment for an ineligible good or service; any duplicate payment; any payment for a good or service not received, except for those payments where authorized by law; any payment that is not authorized by law; and any payment that does not account for credit for applicable discounts.” 2 CFR § 200.303(a) states in part: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Management Response Contact Person: Tammy Smith | Senior Director of Federal Programs Anticipated Completion Date: July 31, 2026 Corrective Action Planned: The Oklahoma State Department of Education agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-016 (Partial Repeat #2023-021) Strengthen Internal Controls Over Review and Approval of Claims STATE AGENCY: Oklahoma State Department of Education (OSDE) FEDERAL AGENCY: United States Department of Education (USDE) ALN: 84.425 – 84.425D; 84.425U FEDERAL PROGRAM NAME: Education Stabilization Fund (ESF): Elementary and Secondary School Emergency Relief Fund (ESSER); American Rescue Plan – Elementary and Secondary Schools Emergency Relief Fund (ARP ESSER) FEDERAL AWARD NUMBER: S425D210024; S425U210024 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed or Unallowed & Allowable Costs/Cost Principles; Subrecipient Monitoring QUESTIONED COSTS: 84.425U - $358 Condition and Context: OSDE has policies and procedures in place to review and approve claims. Additionally, the Grants Management System (GMS) has edits for the ESF allocation notices. Activities Allowed or Unallowed & Allowable Costs/Cost Principles We tested a sample of 65 of 4,382 (1.48%) ESSER II and ARP ESSER III claims totaling $47,049,093 and identified: • Four of 65 (6.15%) claims did not have an adequate review and approval of the electronic claim by an authorized claims auditor, which resulted in o unallowable items purchased totaling $303, o an overpayment totaling $55, o missing supporting invoices at the time of claim approval, and o costs coded to the wrong ARP ESSER III program. Subrecipient Monitoring We reviewed the allocation notices applicable to all LEAs that had claims in the claims sample noted above and identified: • For 25 of 59 (42.37%) LEAs, the allocation notices were not generated and provided to inform the LEA of the 2 CFR § 200.332(a)(1) requirements. Additionally, we noted during our documentation of procedures over allocation notices, one allocation notice did not contain the FAIN or the Federal award date as required. However, we determined the allocations per the allocation spreadsheet and budgets in the GMS were correct. Cause: OSDE’s claims review and approval process lacked the necessary strength and consistency to adequately review claims to ensure proper supporting documentation, including invoices, agrees with the expenditures submitted on the claim and agrees to the approved budgeted items to ensure the amounts claimed were accurate and for allowable costs. OSDE’s monitoring and oversight process lacked the necessary strength and consistency to ensure allocation notices populated correctly and generated notices from GMS. Effect: Inadequate review of claims, along with insufficient verification of required supporting documentation, increases the risk of reimbursing unallowable expenses, resulting in noncompliance. Furthermore, noncompliance increases the risk of Federal claw backs, which impacts state dollars. Noncompliance during the audit period resulted in $359 of actual questioned costs and $43,168 in projected questioned costs for ALN # 84.425U (projects 559 and 795). Additionally, not informing LEAs of the required information per the 2 CFR § 200.332 increases the risk of noncompliance occurring within the program. Recommendation: We recommend OSDE strengthen its claims review and approval process to ensure accurate supporting documentation for claims is included, only allowable uses and costs of ESF are reimbursed, and expenditures are correctly coded to the proper program. We also recommend that OSDE enhance the monitoring and oversight process to ensure allocation notices containing all 2 CFR § 200.332 requirements are populated correctly and generated from GMS. Criteria: 2 CFR § 200.332 states in part: “All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal Award Identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see § 200.39 Federal award date) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (vii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current obligation; (viii) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (ix) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (x) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xi) CFDA Number and Name; the pass-through entity must identify the dollar amount made available under each Federal award and the CFDA number at time of disbursement; (xii) Identification of whether the award is R&D; and (xiii) Indirect cost rate for the Federal award (including if the de minimis rate is charged per § 200.414 Indirect (F&A) costs).” 2 CFR § 200.303(a) states in part: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Management Response Contact Person: Tammy Smith, Senior Director of Federal Programs Anticipated Completion Date: September 1, 2026 Corrective Action Planned: The Oklahoma State Department of Education agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-019 (Repeat 2023-050) Strengthen Internal Controls over Monitoring of Wage Rate Requirements STATE AGENCY: Oklahoma State Department of Education (OSDE) FEDERAL AGENCY: United States Department of Education (USDE) ALN: 84.425 –84.425U FEDERAL PROGRAM NAME: Elementary and Secondary School Emergency Relief Fund (ESSER); American Rescue Plan – Elementary and Secondary Schools Emergency Relief Fund (ARP ESSER) FEDERAL AWARD NUMBER: S425U210024 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Special Tests and Provisions: Wage Rate Requirements; Monitoring QUESTIONED COSTS: $0 Condition and Context: For all school districts subjected to audit under 2 CFR Part 200, Subpart F, the school district’s compliance with wage requirements is reviewed as part of the individual district’s audit and, OSDE reviews all findings related to these audits. OSDE also ensures compliance with wage rate requirements by including a review of the construction contracts and required certified payroll records as part of the consolidated monitoring process instead of requiring the school districts to submit the actual construction contract or payroll certifications along with construction related ESSER and ARP ESSER claims. The information required to separately identify school districts with construction project expenditures subject to wage rate requirements is included in the school district’s ESSER and ARP ESSER applications and, in supporting documentation for claims uploaded into the Grants Management System (GMS). During our documentation of controls and testwork over monitoring wage rate requirements, we reviewed nine school districts with construction expenditures included in OSDE’s consolidated monitoring for the audit period and identified the following: • Two of nine (22.22%) school districts had construction related claims approved as part of the claim reimbursement process without any certified payroll records supporting the claims uploaded into GMS. Furthermore, OSDE not identify the omission of the required certifications during its review and approval process indicates OSDE has weaknesses in its monitoring of the contractor’s certified payroll records. Cause: OSDE’s monitoring process lacks the necessary strength and consistently to determine whether school districts have construction expenditures subject to wage rate requirements Effect: OSDE is at risk for expending state and federal funds without ensuring the school districts comply with the sage rate requirements. Recommendation: We recommend that OSDE strengthen its consolidated monitoring process for all school districts that have applicable Education Stabilization Fund federal expenditures for construction to ensure all certified payroll records are supported by proper documentation prior to approval. The process should include requiring school districts to submit the actual construction contract or payroll certifications exemplifying compliance with the wage rate requirements along with their construction related ESSER and ARP ESSER claims. Additionally, we recommend documenting the process enhancements in OSDE’s policies and procedures to provide an adequate understanding of the requirements, support compliance, and preserve organizational knowledge by providing clear, accessible guidance with consistent expectations of all personnel responsible. Criteria: 2 CFR § 5.5 (3)(ii) states in part: “(A) Frequency and method of submission. The contractor or subcontractor must submit weekly, for each week in which any DBA- or Related Acts-covered work is performed, certified payrolls to the … [applicant, sponsor, owner, or other entity, as the case may be, that maintains such records, for transmission to the [write in name of agency]. … (B) Information required. The certified payrolls submitted must set out accurately and completely all of the information required to be maintained under paragraph (a)(3)(i)(B) of this section, except that full Social Security numbers and last known addresses, telephone numbers, and email addresses must not be included on weekly transmittals. Instead, the certified payrolls need only include an individually identifying number for each worker (e.g., the last four digits of the worker's Social Security number). … (C) Statement of Compliance. Each certified payroll submitted must be accompanied by a “Statement of Compliance,” signed by the contractor or subcontractor, or the contractor's or subcontractor's agent who pays or supervises the payment of the persons working on the contract, and must certify the following: (1) That the certified payroll for the payroll period contains the information required to be provided under paragraph (a)(3)(ii) of this section, the appropriate information and basic records are being maintained under paragraph (a)(3)(i) of this section, and such information and records are correct and complete; (2) That each laborer or mechanic (including each helper and apprentice) working on the contract during the payroll period has been paid the full weekly wages earned, without rebate, either directly or indirectly, and that no deductions have been made either directly or indirectly from the full wages earned, other than permissible deductions as set forth in 29 CFR part 3; and; (3) That each laborer or mechanic has been paid not less than the applicable wage rates and fringe benefits or cash equivalents for the classification(s) of work actually performed, as specified in the applicable wage determination incorporated into the contract.” 2 CFR Appendix A to Part 105-72 (3) states in part: “…When required by Federal program legislation, all construction contracts awarded by the recipients and subrecipients of more than $2000 shall include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 276a to a–7) and as supplemented by Department of Labor regulations (29 CFR part 5, “Labor Standards Provisions Applicable to Contracts Governing Federally Financed and Assisted Construction”). Under this Act, contractors shall be required to pay wages to laborers and mechanics at a rate not less than the minimum wages specified in a wage determination made by the Secretary of Labor…” 2 CFR § 200.303(a) states in part: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” The SFY 24 Uniform Guidance Compliance Supplement, USDOE Davis-Bacon Overview section states in part: … LOCAL EDUCATIONAL AGENCY (LEA) RESPONSIBLITIES An LEA that is using Federal education funds to support a construction project must include all applicable contract clauses found in 29 CFR 5.5. The LEAs must also maintain contractor certified payroll records and submit these records to the State. STATE RESPONSIBILITIES As the grantee, it is the State’s responsibility to monitor subgrantees including LEAs for Davis-Bacon compliance. The State must collect from the LEA and monitor the contractor’s certified payroll records.” Management Response Contact Person: Tammy Smith | Senior Director of Federal Programs Anticipated Completion Date: September 30, 2025 Corrective Action Planned: The Oklahoma State Department of Education agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-023 (Partial Repeat 2023-059) Develop and Implement Internal Controls Over the Record Retention Process for Annual Reports STATE AGENCY: Oklahoma State Department of Education (OSDE) FEDERAL AGENCY: United States Department of Education (USDE) ALN: 84.425 – 84.425D, 84.425U; 84.425R FEDERAL PROGRAM NAME: Education Stabilization Fund (ESF) - Elementary and Secondary Schools Emergency Relief Fund (ESSER II); American Rescue Plan – Elementary and Secondary Schools Emergency Relief Fund (ARP ESSER III); Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance To Non-Public Schools (CRRSA EANS) FEDERAL AWARD NUMBER: S425D210024; S425U210024 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Reporting QUESTIONED COSTS: $0 Condition and Context: During our review and follow up on the prior year finding, we requested the supporting documentation necessary to verify information reported for several key line items on the ESSER II, ARP ESSER III, and CRRSA EANS state fiscal year (SFY) 23 Annual Reports submitted during the audit period. OSDE originally obtained this information via questionnaires sent to local educational agencies (LEAs)/nonpublic schools to collect the FTE, Student Participation data, and expenditures by category and object code. OSDE did not retain this information and was unable to provide it to our office. We were able to obtain other audit evidence sufficient to test compliance for many of the key line items, however, we were unable to test line 3.b10 Number of specific positions supported with ESSER Funds. While testing whether the data reported in the Annual Report was complete, we identified the ESSER II and CRRSA EANS expenditures were under-reported by $7,165,736 (9.86%) and $3,151,331 (55.53%) respectively. During our review of a sample of 73 out of 843 LEA subaward allocations and total expenditures reported on the ESSER Annual Reports, we identified the following issues: • For 65 of 73 subawards (89.04%), the SFY 23 allocations reported on the LEA’s Grant Management System (GMS) application did not agree with the allocation amounts reported on the ESSER II and ARP ESSER Annual Report. In addition, OSDE did not provide supporting documentation for ESSER II re-allocations preventing us from verifying whether the total allocation for these LEAs was reported accurately in the ESSER II Annual Report. The variance represents -0.27% of the total subaward amount reported. • For one of 73 subawards (1.37%), the amounts reported for ARP ESSER III were assigned to the wrong LEA. After identifying the correct LEA, we were able to confirm the reported expenditures; however, the allocation was under-reported by $2,749. The variance represents -0.57% of the subaward amount reported. • For one of 73 subawards (1.37%), we are unable to trace the ARP ESSER reported allocation and expenditures totaling $10,354,934.51 and $2,736,535.55 respectively to any corresponding ARP ESSER allocation or expenditure records in GMS. The variance represents 3.94% of the subaward amount reported and 2.87% of the ARP ESSER expenditures reported. Cause: Staff turnover and inadequate record retention policies and procedures contributed to challenges in locating and/or providing all the supporting documentation used by previous staff members to prepare the reports. Effect: OSDE is at risk for inaccurate and/or incomplete reporting on the USDE website, which prevents OSDE from demonstrating the completeness and accuracy of subaward activity, and may impair oversight and monitoring of subrecipient expenditures. Original source documents are not available for current staff or other entities required to perform audits or reviews. Recommendation: We recommend OSDE develop and implement record retention policies and procedures to ensure all records are appropriately retained, especially when staff turnover is high. Additionally, we recommend OSDE develop and implement policies and procedures and adequate training to ensure the allocations and expenditures reported on the annual report are accurate and properly supported, GMS data is reconciled to the annual report entries prior to submission, and an adequate independent review is established to verify subawards are recorded under the correct subrecipient and reported amounts trace to GMS records. The objective of the policies and procedures should be to provide an adequate understanding of the requirements, support compliance, and preserve organizational knowledge by providing clear, accessible guidance with consistent expectations of all personnel responsible for the annual report. Criteria: 2 CFR § 200.303(a) states in part: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.334 states in part: “The recipient and subrecipient must retain all Federal award records for three years from the date of submission of their final financial report. For awards that are renewed quarterly or annually, the recipient and subrecipient must retain records for three years from the date of submission of their quarterly or annual financial report, respectively. Records to be retained include but are not limited to, financial records, supporting documentation, and statistical records. Federal agencies or pass-through entities may not impose any other record retention requirements except for the following: (a) The records must be retained until all litigation, claims, or audit findings involving the records have been resolved and final action taken if any litigation, claim, or audit is started before the expiration of the three-year period.” United States Department of Education website ESSER Annual Reporting states in part: “All grantees are required to report on ESSER funds received under the Coronavirus Aid, Relief, and Economic Security (CARES) Act; the Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act; and the American Rescue Plan (ARP) Act. Grantees must submit an annual report describing how the State and subrecipients used the awarded funds during the performance period. Similar to CARES Act Year 1 annual reporting, grantees will use the Annual Report Data Collection Tool to submit the State report.” Management Response Contact Person: Tammy Smith | Senior Director of Federal Programs Anticipated Completion Date: August 1, 2026 Corrective Action Planned: The Oklahoma State Department of Education agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-026 (Repeat 2023-045) Strengthen Internal Controls Over Monitoring STATE AGENCY: Oklahoma State Department of Education (OSDE) FEDERAL AGENCY: United States Department of Education (USDE) ALN: 84.425 – 84.425D; 84.425U FEDERAL PROGRAM NAME: Elementary and Secondary School Emergency Relief Fund (ESSER); American Rescue Plan – Elementary and Secondary Schools Emergency Relief Fund (ARP ESSER) FEDERAL AWARD NUMBER: S425D210024; S425U210024 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Equipment and Real Property Management, Monitoring QUESTIONED COSTS: $0 Condition and Context: OSDE has established consolidated monitoring procedures to ensure school districts obtain appropriate approval from OSDE prior to making capital equipment and construction purchases over $5,000. While performing testwork of eleven school districts with equipment expenditures included in OSDE’s consolidated monitoring during the audit period, we determined capital equipment expenditures were listed on the pre-approved equipment list, and capital construction projects included an approved construction application, or the construction project was listed on the pre-approved project list. However, we identified the following: • For three of 11 (27.27%) school districts, their inventory listing submitted in the consolidated monitoring application excluded some of the information required per 2 CFR § 200.313(d)(1) and the missing information was not identified during the monitoring process • For two of 11 (18.18%) of school districts, the required construction contracts were not submitted, and the missing contracts were not identified during the monitoring process During additional testing of OSDE’s consolidated monitoring for the audit period, we identified for one of 19 (5.26%) school districts, the inventory listing excluded some of the information required per 2 CFR§ 200.313(d)(1) in the consolidated monitoring application section Crosscutting Fiscal Requirements (1)(b) and the missing information was not identified during the monitoring process. Cause: OSDE Office of Federal Programs’ existing monitoring activities lacked the necessary strength and consistency to effectively support oversight of compliance with the school district’s inventory and equipment/real property. Effect: Inappropriate monitoring increases the risk of school districts not complying with the Federal program inventory requirements. Recommendation: We recommend OSDE strengthen its consolidated monitoring process to ensure inventory records and construction contracts are timely received and appropriately reviewed. Criteria: 2 CFR § 200.303(a) states in part: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.313(d) states in part: “Regardless of whether equipment is acquired in part or its entirety under the Federal award, the recipient or subrecipient must manage equipment (including replacement equipment) utilizing procedures that meet the following requirements: (1) Property records must include a description of the property, a serial number or another identification number, the source of funding for the property (including the FAIN), the title holder, the acquisition date, the cost of the property, the percentage of the Federal agency contribution towards the original purchase, the location, use and condition of the property, and any disposition data including the date of disposal and sale price of the property. The recipient and subrecipient are responsible for maintaining and updating property records when there is a change in the status of the property.” Management Response Contact Person: Tammy Smith | Senior Director of Federal Programs Anticipated Completion Date: August 2025 Corrective Action Planned: The Oklahoma State Department of Education agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-028 (Repeat 2023-047) Develop and Implement Internal Controls Over the Payroll Allocation Process STATE AGENCY: Oklahoma State Department of Education (OSDE) FEDERAL AGENCY: United States Department of Education (USDE) ALN: 84.010; 84.425 – 84.425D & U FEDERAL PROGRAM NAME: Title I – Grants to Local Educational Agencies; Education stabilization Fund (ESF) - Elementary and Secondary School Emergency Relief (ESER) Fund and American Rescue Plan – Elementary and Secondary Schools Emergency Relief Fund (ARP ESSER) FEDERAL AWARD NUMBER: S010A230036; S425D210024, S425U210024 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed or Unallowed and Allowable Costs/Cost Principles QUESTIONED COSTS: $0 Condition and Context: During our review and follow up on the prior year finding, we requested the time and effort data for payroll charged to the Title IA and the ESF – ESSER II and ARP ESSER III programs; current OSDE staff were not able to provide the data requested due to significant staff turnover and inadequate record retention processes. We were unable to determine the following payroll costs were properly allocated to their respective program during the audit period: • Title I: $1,138,740 (0.49%) compared to total program expenditures of $234,255,756. • ESSER II: $301,888 (1.21%) compared to total program expenditures of $24,855,831.06. • ARP ESSER III: $2,023,891 (0.46%) compared to total program expenditures of $441,707,269. The United States Department of Education (USDE) Consolidated Performance Review of Oklahoma (dated July 25, 2024) covering the SFY 23 audit period noted OSDE had used estimates to allocate payroll costs to federal awards but had not reconciled those estimates to the actual work performed on each federal program as required per 2 CFR § 200.430. The OSDE’s time and attendance system did not allow the agency to accurately charge time for employees who are paid from both State and Federal sources simultaneously. Time would be charged to the Federal funding source for the first split of the fiscal year (FY) and then charged to a state funding source for the remainder of the fiscal year. During our follow-up with OSDE, we were informed that this had not been corrected during the audit period. Cause: Technical issues with the State’s recently adopted time and attendance system did not allow OSDE to accurately charge fringe benefits for employees who are paid from both State and Federal sources and OSDE had not implemented an alternative process to accurately allocate payroll costs to federal awards. In addition, OSDE’s record retention process lacked the necessary strength and consistency to ensure retention of time and effort data. Effect: Charges to Federal awards (Title IA and ESF – ESSER II and ARP ESSER III) for salaries and wages were not based on records that accurately reflect the work performed and were not properly allocated. Inaccurate allocation methods for payroll costs increases the risk of incorrect or unallowable costs charged to Federal programs, which increases the risk of inappropriate allocation of funds between federal and state dollars. Recommendation: We recommend OSDE develop and implement system changes or an alternative process to accurately allocate payroll cost to Federal awards in compliance with the time and effort requirements of 2 CFR § 200.430. We also recommend OSDE develop and provide staff members with policies and procedures and adequate training to understand and appropriately apply 2 CFR § 200.430 federal requirements for recording time and effort data and allocating salaries and wages to Federal awards. Additionally, we recommend OSDE develop record retention policies and procedures to ensure all records are appropriately retained, especially when staff turnover is high. Criteria: 2 CFR § 200.430(g)(1) states in part: “Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient; (iii) Reasonably reflect the total activity for which the employee is compensated by the recipient or subrecipient, not exceeding 100 percent of compensated activities (for IHEs, this is the IBS); (iv) Encompass federally-assisted and all other activities compensated by the recipient or subrecipient on an integrated basis but may include the use of subsidiary records as defined in the recipient's or subrecipient's written policy; (v) Comply with the established accounting policies and procedures of the recipient or subrecipient; and (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (vii) Budget estimates (meaning, estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards, but may be used for interim accounting purposes, provided that: (A) The system for establishing the estimates produces reasonable approximations of the activity performed; (B) Significant changes in the related work activity (as defined by the recipient's or subrecipient's written policies) are promptly identified and entered into records. Short-term (such as one or two months) fluctuations between workload categories do not need to be considered as long as the distribution of salaries and wages is reasonable over the longer term; and (C) The recipient's or subrecipient's system of internal controls includes processes to perform periodic after the- fact reviews of interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made so that the final amount charged to the Federal award is accurate, allowable, and properly allocated. (viii) Because practices vary as to the activity constituting a full workload (for example, the Institutional Base Salary (IBS) for IHEs), records may reflect categories of activities expressed as a percentage distribution of total activities.” 2 CFR § 200.334 states in part: “The recipient and subrecipient must retain all Federal award records for three years from the date of submission of their final financial report. For awards that are renewed quarterly or annually, the recipient and subrecipient must retain records for three years from the date of submission of their quarterly or annual financial report, respectively. Records to be retained include but are not limited to, financial records, supporting documentation, and statistical records. Federal agencies or pass-through entities may not impose any other record retention requirements except for the following: (a) The records must be retained until all litigation, claims, or audit findings involving the records have been resolved and final action taken if any litigation, claim, or audit is started before the expiration of the three year period.” 2 CFR § 200.303(a) states in part: “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Management Response Contact Person: Tammy Smith | Senior Director of Federal Programs Anticipated Completion Date: January 2025 Corrective Action Planned: The Oklahoma State Department of Education agrees with the finding. See corrective action plan located in the corrective action plan section of this report.

Finding No: 2024-102 (Repeat 2023-206) Strengthen controls for capturing and reporting transactions on the SEFA State Agency: Oklahoma Department of Health Federal Agency: United States Department of Health and Human Services Assistance Listing Number: 93.268 Federal Program Name: Immunizations Cooperative Agreements Federal Award Number: NH23IP922575-01-02, NH23IP922575-02-00, NH23IP922575-02-06, NH23IP922575- 03-00, NH23IP922575-04-00, NH23IP922575-05-06, NH23IP922575-05-13 Federal Award Year: 2021, 2022, 2023, 2024 Compliance Category: Reporting Questioned Costs: Unknown Criteria: The Schedule of Expenditures of Federal Awards (SEFA – GAAP Package Schedule Z) should be accurately captured, reconciled, and reviewed by the Oklahoma State Department of Health (the “Department”). Adequate documentation of procedures performed, as well as evidence of thorough reviews, should be in place. According to GAAP, expenditures should be recognized in the period services are performed or goods are received. In accordance with the modified accrual basis of accounting, federal grant revenues should be recognized when applicable eligibility requirements, including reimbursement, time requirements, and other eligibility requirements, are met and the resources are available. Revenues are considered available when they are collectible within the current period or soon enough thereafter to pay liabilities of the current period. In accordance with the State of Oklahoma’s Annual Comprehensive Financial Report, the State considers revenues to be available if they are collected within sixty days of the end of the fiscal year. Lastly, the Uniform Guidance (2 CFR 200.510) requires an auditee to “prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the auditee’s financial statement [that] … at a minimum shall … list individual Federal programs by Federal agency … [and] provide total Federal awards expended for each individual Federal program … [and] include the total amount provided to subrecipients for each Federal program.” In accordance with Uniform Guidance, the Department is required to maintain a structure of internal control to ensure compliance with applicable reporting requirements. Furthermore, the State of Oklahoma’s Schedule Z SEFA Conversion Package states, “The amount reported as provided by the primary recipient to state agencies should be entered in the ‘Amount Transferred to State Agencies’ column. This amount should be included in the Federal revenue but not in expense columns of the primary recipient.” The Government Accountability Office (GAO) Standards for Internal Control in the Federal Government 10.03 states, in part, “Management designs appropriate types of control activities for the entity’s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.” Additionally, GAO Standards for Internal Control in the Federal Government 10.03 states, in part, “Transactions are promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from its initiation and authorization through its final classification in summary records. In addition, management designs control activities so that all transactions are completely and accurately recorded.” Condition: The Department was unable to provide support that record transactions agree to the federal revenues reported in Schedule Z. Cause and Effect: The Department does not have appropriate internal procedures for capturing and reporting the federal expenditures and revenues on the SEFA in accordance with the Uniform Guidance (2 CFR 200.510). Revenues are recorded by the department on a cash basis and deposits are not recorded in the general ledger (GL) with a unique identifier to indicate which fiscal year in which the matching expenditures reside. Also, batched cash deposits containing sources of revenues from differing fiscal years cannot be appropriately allocated to the year in which the revenue was earned. Batched deposits are recorded as a single GL transaction regardless of the year in which the related deposit was earned and contain revenues for which the related expenditures were recorded in differing fiscal years. As a result, the Department’s GL does not possess sufficient detail to accurately account for the required modified accrual basis conversions. The Department has not ensured that the transactional data recorded provides enough detail to accurately report the federal activity in Schedule Z. Recommendation: We recommend the Department review and document the current procedures and implement the necessary changes to ensure adequate reporting of program financial information in the SEFA. Specifically, we recommend the Department continue to review its cash reporting and decipher batch deposits by fiscal year, with a unique identifier recorded at the GL transaction level. Additionally, we recommend retaining evidence that adequate reviews of the SEFA occurred. We also recommend the Department establish procedures to timely reconcile federal revenues to its federal expenditures to ensure completeness of its related federal reporting. Views of Responsible Official(s) Contact Person: Ryon Fields, Interim CFO Anticipated Completion Date: 6/30/26 Management Response: The Oklahoma State Department of Health agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

Finding No: 2024-108 (Repeat 2023-203) Payroll Timekeeping and Payroll Report Monitoring State Agency: Oklahoma Department of Health Federal Agency: United States Department of Health and Human Services Assistance Listing Number: 93.268 Federal Program Name: Immunizations Cooperative Agreements Federal Award Number: NH23IP922575-01-02, NH23IP922575-02-00, NH23IP922575-02-06, NH23IP922575- 03-00, NH23IP922575-04-00, NH23IP922575-05-06, NH23IP922575-05-13 Federal Award Year: 2023, 2024 Compliance Category: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Questioned Costs: None Criteria: 7 CFR § 246.13 - Financial Management System, states in part, “(b) Internal control. The State agency shall maintain effective control over and accountability for all Program grants and funds.” The Government Accountability Office (GAO) Standards for Internal Control in the Federal Government 10.03 states, in part, “Management designs appropriate types of control activities for the entity’s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.” Additionally, GAO Standards for Internal Control in the Federal Government 10.03 states, in part, “Transactions are promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from its initiation and authorization through its final classification in summary records. In addition, management designs control activities so that all transactions are completely and accurately recorded.” Condition: During state fiscal year (SFY) 2024, recorded payroll costs did not accurately reflect the Oklahoma State Department of Health’s (the “Department”) time and effort. Additionally, the Department neglected to perform its existing control activities of timely reviewing time and effort against the payroll expenses recorded in the general ledger. Cause and Effect: The Department did not have adequate internal controls in Workday to limit employee access profiles, which allowed all timecodes to be available for use regardless of an employee’s specific job position and function. Moreover, incorrect timecodes were selected by the employees when completing their timecards and supervisors approved employee timecards without thoroughly reviewing to detect and correct these errors. Inadequate internal control policies and procedures over the payroll cycle could result in an increased risk of non-compliance with federal requirements, and an inability to comply with audit requirements. Recommendation: We recommend the Department continue to monitor the employee access of timecodes related to their specific job function and projects. Supervisors should thoroughly review timecards prior to approval. Additionally, the Department should timely monitor time and effort against recorded payroll to ensure grants are not over or under charged and reconcile validated time to booked payroll costs regularly. Views of Responsible Official(s) Contact Person: Ryon Fields, Interim CFO Anticipated Completion Date: 6/30/27 Management Response: The Oklahoma State Department of Health agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

Finding No: 2024-110 SF-425 Strengthen Preparation and Document Retention Controls over SF-425 State Agency: Oklahoma Department of Health Federal Agency: United States Department of Health and Human Services Assistance Listing Number: 93.268 Federal Program Name: Immunizations Cooperative Agreement Federal Award Number: NH23IP922575-01-02, NH23IP922575-02-00, NH23IP922575-02-06, NH23IP922575- 03-00, NH23IP922575-04-00, NH23IP922575-05-06, NH23IP922575-05-13 Federal Award Year: 2020, 2021, 2022, 2023, 2024 Compliance Category: Reporting Questioned Costs: None Criteria: The Department is required to prepare and submit complete, accurate, and supportable Federal Financial Reports (FFRs, SF425) for Assistance Listing 93.268 in accordance with the grant award terms, the HHS Grants Policy Statement, and 2 CFR 200.302 and 200.333, including maintaining adequate supporting documentation and subsidiary schedules to substantiate amounts reported and to demonstrate proper cutoff of reporting periods. Internal policies and procedures should ensure that all amounts reported on the SF425 are reconciled to the underlying accounting records and retained in accordance with federal record retention requirements. Condition: Supporting schedules to substantiate the reported amounts for Assistance Listing Number (ALN) 93.268 were not available for two of the six (33%) SF‑425 FFRs selected for testing. Known cutoff issues related to financial reporting were also reported in SA‑01 [finding #2024-102], which further affects the accuracy and completeness of the reporting for this program. Additionally, the Department did not retain adequate documentation to support its FFRs for ALN 93.268, resulting in an incomplete audit trail for the amounts reported. Cause and Effect: The Department’s existing procedures for preparing and retaining supporting schedules for SF425 reports under ALN 93.268 were not consistently followed to ensure all supporting documentation was retained. In addition, controls over period end cutoff for reported expenditures and program income, as noted in SA01 [finding #2024-102], were not operating effectively for this program. As a result, two of six SF425 reports tested for ALN 93.268 not fully supported by underlying schedules, and known cutoff issues increase the risk that amounts reported on the FFRs may be incomplete, inaccurate, or misstated. These weaknesses diminish the reliability of the audit trail, impair management’s ability to demonstrate compliance with federal reporting requirements, and increases the likelihood of questioned costs or future compliance findings. Recommendation: The Department should strengthen its internal controls over the preparation and retention of SF‑425 reports for ALN 93.268 by establishing and documenting standardized procedures that require the preparation of reconciled supporting schedules for each FFR, including clear cutoff procedures that reconcile reported amounts to the general ledger and grant sub‑ledgers for the applicable reporting period; requiring an independent review of each SF‑425 and its supporting schedules prior to submission to verify mathematical accuracy, proper cutoff, and agreement to the accounting records; implementing a centralized document‑retention process to ensure that all supporting schedules and related documentation for submitted FFRs are retained in accordance with federal and Department record‑retention requirements; and providing periodic training to staff responsible for grants accounting and reporting on the revised procedures and retention requirements. Views of Responsible Official(s) Contact Person: Kimberly Courtney, Director of Accounting Anticipated Completion Date: 6/30/26 Management Response: The Oklahoma State Department of Health agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

Finding No: 2024-103 (Repeat 2023-207) Strengthen controls for capturing and reporting transactions on the SEFA State Agency: Oklahoma Department of Health Federal Agency: United States Department of Health and Human Services Assistance Listing Number: 93.323 Federal Program Name: Epidemiology and Laboratory Capacity for Infectious Diseases Federal Award Numbers: NU50CK000535-01-11, NU50CK000535-02-03, NU50CK000535-02-06, NU50CK000535-03-00, NU50CK000535-03-01, NU50CK000535-03-02, NU50CK000535-04-00, NU50CK000535-05-00, NU50CK000535-05-07, NU50CK000535-05-08, NU50CK000535-05-12 Federal Award Year: 2020, 2021, 2022, 2023, 2024 Compliance Category: Reporting Questioned Costs: Unknown Criteria: The Schedule of Expenditures of Federal Awards (SEFA – GAAP Package Schedule Z) should be accurately captured, reconciled, and reviewed by the Oklahoma State Department of Health (the “Department”). Adequate documentation of procedures performed, as well as evidence of thorough reviews, should be in place. According to GAAP, expenditures should be recognized in the period services are performed or goods are received. In accordance with the modified accrual basis of accounting, federal grant revenues should be recognized when applicable eligibility requirements, including reimbursement, time requirements, and other eligibility requirements, are met and the resources are available. Revenues are considered available when they are collectible within the current period or soon enough thereafter to pay liabilities of the current period. In accordance with the State of Oklahoma’s Annual Comprehensive Financial Report, the State considers revenues to be available if they are collected within sixty days of the end of the fiscal year. Lastly, the Uniform Guidance (2 CFR 200.510) requires an auditee to “prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the auditee’s financial statement [that] … at a minimum shall … list individual Federal programs by Federal agency … [and] provide total Federal awards expended for each individual Federal program… [and] include the total amount provided to subrecipients for each Federal program” In accordance with Uniform Guidance, the Department is required to maintain a structure of internal control to ensure compliance with applicable reporting requirements. Furthermore, the State of Oklahoma’s Schedule Z SEFA Conversion Package states, “The amount reported as provided by the primary recipient to state agencies should be entered in the ‘Amount Transferred to State Agencies’ column. This amount should be included in the Federal revenue but not in expense columns of the primary recipient.” The Government Accountability Office (GAO) Standards for Internal Control in the Federal Government 10.03 states, in part, “Management designs appropriate types of control activities for the entity’s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.” Additionally, GAO Standards for Internal Control in the Federal Government 10.03 states, in part, “Transactions are promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from its initiation and authorization through its final classification in summary records. In addition, management designs control activities so that all transactions are completely and accurately recorded.” Condition: The Department was unable to provide support that details of record transactions agree to the federal revenues reported in Schedule Z. Cause and Effect: The Department does not have appropriate internal procedures for capturing and reporting the federal expenditures and revenues on the SEFA in accordance with the Uniform Guidance (2 CFR 200.510). Revenues are recorded by the Department on a cash basis and deposits are not recorded in the general ledger (GL) with a unique identifier to indicate which fiscal year in which the matching expenditures reside. Also, batched cash deposits containing sources of revenues from differing fiscal years cannot be appropriately allocated to the year in which the revenue was earned. Batched deposits are recorded as a single GL transaction regardless of the year in which the related deposit was earned and contain revenues for which the related expenditures were recorded in differing fiscal years. As a result, the Department’s GL does not possess sufficient detail to accurately account for the required modified accrual basis conversions. The Department has not ensured that the transactional data recorded provides enough detail to accurately report the federal activity in Schedule Z. Recommendation: We recommend the Department review and document the current procedures and implement the necessary changes to ensure adequate reporting of program financial information in the SEFA. Specifically, we recommend the Department continue to review its cash reporting and decipher batch deposits by fiscal year, with a unique identifier recorded at the GL transaction level. Additionally, we recommend retaining evidence that adequate reviews of the SEFA occurred. We also recommend the Department establish procedures to timely reconcile federal revenues to its federal expenditures to ensure completeness of its related federal reporting. Views of Responsible Official(s) Contact Person: Ryon Fields, Interim CFO Anticipated Completion Date: 6/30/26 Management Response: The Oklahoma State Department of Health agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

Finding No: 2024-109 (Repeat 2023-204) Payroll Timekeeping and Payroll Report Monitoring State Agency: Oklahoma Department of Health Federal Agency: United States Department of Health and Human Services Assistance Listing Number: 93.323 Federal Program Name: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Federal Award Numbers: NU50CK000535-01-11, NU50CK000535-02-03, NU50CK000535-02-06, NU50CK000535-03-00, NU50CK000535-03-01, NU50CK000535-03-02, NU50CK000535-04-00, NU50CK000535-05-00, NU50CK000535-05-07, NU50CK000535-05-08, NU50CK000535-05-12 Federal Award Year: 2023, 2024 Compliance Category: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Questioned Costs: None Criteria: 7 CFR § 246.13 - Financial Management System, states in part, “(b) Internal control. The State agency shall maintain effective control over and accountability for all Program grants and funds.” The Government Accountability Office (GAO) Standards for Internal Control in the Federal Government 10.03 states, in part, “Management designs appropriate types of control activities for the entity’s internal control system. Control activities help management fulfill responsibilities and address identified risk responses in the internal control system.” Additionally, GAO Standards for Internal Control in the Federal Government 10.03 states, in part, “Transactions are promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from its initiation and authorization through its final classification in summary records. In addition, management designs control activities so that all transactions are completely and accurately recorded.” Condition: During state fiscal year (SFY) 2024, recorded payroll costs did not accurately reflect the Oklahoma State Department of Health’s (the “Department”) time and effort. Additionally, the Department neglected to perform its existing control activities of timely reviewing time and effort against the payroll expenses recorded in the general ledger. Cause and Effect: The Department did not have adequate internal controls in Workday to limit employee access profiles, which allowed all timecodes to be available for use regardless of an employee’s specific job position and function. Moreover, incorrect timecodes were selected by the employees when completing their timecards and supervisors approved employee timecards without thoroughly reviewing to detect and correct these errors. Inadequate internal control policies and procedures over the payroll cycle could result in an increased risk of non-compliance with federal requirements, and an inability to comply with audit requirements. Recommendation: We recommend the Department continue to monitor the employee access of timecodes related to their specific job function and projects. Supervisors should thoroughly review timecards prior to approval. Additionally, the Department should timely monitor time and effort against recorded payroll to ensure grants are not over or under charged and reconcile validated time to booked payroll costs regularly. Views of Responsible Official(s) Contact Person: Ryon Fields, Interim CFO Anticipated Completion Date: 6/30/27 Management Response: The Oklahoma State Department of Health agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

Finding No: 2024-111 Strengthen Preparation and Document Retention Controls over SF-425 State Agency: Oklahoma Department of Health Federal Agency: United States Department of Health and Human Services Assistance Listing Number: 93.323 Federal Program Name: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Federal Award Numbers: NU50CK000535-01-11, NU50CK000535-02-03, NU50CK000535-02-06, NU50CK000535-03-00, NU50CK000535-03-01, NU50CK000535-03-02, NU50CK000535-04-00, NU50CK000535-05-00, NU50CK000535-05-07, NU50CK000535-05-08, NU50CK000535-05-12 Federal Award Year: 2023, 2024 Compliance Category: Activities Allowed or Unallowed; Allowable Costs/Cost Principles Questioned Costs: None Criteria: The Department is required to prepare and submit complete, accurate, and supportable Federal Financial Reports (FFRs, SF425) for Assistance Listing 93.323 in accordance with the grant award terms, the HHS Grants Policy Statement, and 2 CFR 200.302 and 200.333, including maintaining adequate supporting documentation and subsidiary schedules to substantiate amounts reported and to demonstrate proper cutoff of reporting periods. Internal policies and procedures should ensure that all amounts reported on the SF425 are reconciled to the underlying accounting records and retained in accordance with federal record retention requirements. Condition: Supporting schedules to substantiate the reported amounts for Assistance Listing Number (ALN) 93.323 were not available for two of the six (33%) SF‑425 FFRs selected for testing. Known cutoff issues related to financial reporting were also reported in SA‑01 [finding #2024-103], which further affects the accuracy and completeness of the reporting for this program. Additionally, the Department did not retain adequate documentation to support its FFRs for ALN 93.323, resulting in an incomplete audit trail for the amounts reported. Cause and Effect: The Department’s existing procedures for preparing and retaining supporting schedules for SF425 reports under ALN 93.323 were not consistently followed to ensure all supporting documentation was retained. In addition, controls over period end cutoff for reported expenditures and program income, as noted in SA01 [finding #2024-102], were not operating effectively for this program. As a result, two of six SF425 reports tested for ALN 93.323 not fully supported by underlying schedules, and known cutoff issues increase the risk that amounts reported on the FFRs may be incomplete, inaccurate, or misstated. These weaknesses diminish the reliability of the audit trail, impair management’s ability to demonstrate compliance with federal reporting requirements, and increases the likelihood of questioned costs or future compliance findings. Recommendation: The Department should strengthen its internal controls over the preparation and retention of SF‑425 reports for ALN 93.323 by establishing and documenting standardized procedures that require the preparation of reconciled supporting schedules for each FFR, including clear cutoff procedures that reconcile reported amounts to the general ledger and grant sub‑ledgers for the applicable reporting period; requiring an independent review of each SF‑425 and its supporting schedules prior to submission to verify mathematical accuracy, proper cutoff, and agreement to the accounting records; implementing a centralized document‑retention process to ensure that all supporting schedules and related documentation for submitted FFRs are retained in accordance with federal and Department record‑retention requirements; and providing periodic training to staff responsible for grants accounting and reporting on the revised procedures and retention requirements. Views of Responsible Official(s) Contact Person: Kimberly Courtney, Director of Accounting Anticipated Completion Date: 6/30/26 Management Response: The Oklahoma State Department of Health agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-041 (Repeat 2023-068) Strengthen Internal Controls Over the G1DX Exception Resolution Process STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services ALN: 93.558 FEDERAL PROGRAM NAME: TANF Program FEDERAL AWARD NUMBER: G2301OKTANF, G2401OKTANF FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Special Tests and Provisions – Income Eligibility and Verification System QUESTIONED COSTS: $0 Condition and Context: The G1DX System is an OKDHS application that compares client information entered by a OKDHS employee and OKDHS IEVS information sources as they are periodically updated. These sources include: • Wage information for the State Wage Information Collection Agency (SWICA) • Unemployment Compensation (UC) • All available information from the Social Security Administration (SSA) • Information from the U.S. Citizenship and Immigration Services • Unearned Income from the Internal Revenue Services (IRS) The purpose of the GIDX Exception and Clearance Report is to report discrepancies detected between agency data and external data sources and then notify staff to promptly address discrepancies so that case information remains accurate, reliable, and compliant with federal program requirements. The Exception and Clearance Report summarizes these discrepancies by worker, supervisor, county, and area, which allows management to monitor not only the type of discrepancy and length of days outstanding, but also to distinguish who is responsible for clearing the discrepancy within the 45 days allowed under current federal regulation and OKDHS policy. We reviewed the state fiscal year (SFY) 2024 (July 1, 2023 – June 30, 2024) G1DX Exception and Clearance Reports to determine whether data exchange discrepancy (exception) messages were resolved within the required 45 calendar days from the date the message was posted on the data exchange inquiry screen. Because the system used to compile the discrepancy messages does not distinguish messages by individual program, our review was conducted at the error type level rather than by program. Therefore, the discrepancies listed below represent a combined set of issues across multiple programs and may not apply to each program individually. Our review determined that 280,897 of the total 590,942 exceptions, or 47.53%, were not resolved within the required 45 calendar day period. The schedule below outlines the specific exceptions by error type and their corresponding delays. ERROR TYPE OPEN & RESOLVED G1DX EXCEPTIONS OVER 45 DAYS TOTAL OPEN & RESOLVED G1DX EXCEPTIONS % OF EXCEPTIONS OVER 45 DAYS BEN 29,366 82,923 35.41% CSE 3,027 4,633 65.34% DOD 34 88 38.64% ENU 17,800 22,945 77.58% IEV 4,407 13,452 32.76% NNH 92,641 179,866 51.51% OWG 49,626 91,048 54.51% PRS 2,446 4,364 56.05% SDX 32,681 97,589 33.49% SNH 44,862 84,069 53.36% UIB 4,007 9,965 40.21% TOTAL 280,897 590,942 47.53% Cause: The OKDHS G1DX exception clearing process in place did not provide a sufficient internal control structure to enable management to effectively monitor the status of G1DX discrepancy resolutions and ensure adequate staffing for timely processing. Because the current controls do not provide accountability or oversight, OKDHS failed to ensure that discrepancies were resolved within the required 45 days. Effect: The untimely resolution of discrepancies not only elevates the risk of program benefits being provided to ineligible individuals, but also elevates the risk of delayed benefits to eligible individuals, Recommendation: We recommend OKDHS enhance its monitoring activities by timely reviewing Exception and Clearance reports created for the G1DX discrepancies, ensuring adequate staff have effective tools and training to timely clear the exception, and holding all responsible individuals accountable. Additionally, we recommend OKDHS establish and follow policies and procedures outlining how the monitoring reports should be used and by whom to ensure discrepancies are timely resolved within the required 45 days. Criteria: 2 CFR Part 200 (June 30, 2024), Appendix XI, Part 4 applicable to the Temporary Assistance for Needy Families program, requires each State to participate in the Income Eligibility and Verification System (IEVS) required by section 1137 of the Social Security Act, as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. 45 CFR 205.56(a)(1)(iv) (June 30, 2024) states in part: “For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary… .” OAC 340:65-3-4(4)(C) states in part: “Automated data exchange with other agencies provides OKDHS with information regarding household members' benefits, wages, taxes, Social Security numbers, and current addresses. The system compares information obtained electronically with data stored within OKDHS electronic records to determine if there are discrepancies that need to be addressed. Automated data exchange information is also available within the OKDHS system to determine discrepancies. The worker is responsible for resolving data exchange discrepancy messages within 45-calendar days of the date the message is posted on the data exchange inquiry screen.” 45 CFR 75.303 (June 30, 2024) states: “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Views of Responsible Official(s): Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: Anticipated 10/5/2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-058 Strengthen Internal Controls over Determining TANF Eligibility For CWS Clients STATE AGENCY: Oklahoma Department of Human Services FEDERAL AGENCY: Department of Health and Human Services ALN: 93.558 FEDERAL PROGRAM NAME: Temporary Assistance for Needy Families FEDERAL AWARD NUMBER: G1901OKTANF, G2001OKTANF, G2101OKTANF, G2301OKTANF and G2401OKTANF FEDERAL AWARD YEAR: 2019, 2020, 2021, 2023, and 2024 CONTROL CATEGORY: Activities Allowed or Unallowed and Level of Effort QUESTIONED COSTS: $24,700 Condition and Context: We requested detailed data supporting the $8,761,065 reported on line 20.a of the ACF-196R reports for SFY24. Based on conversation with OKDHS management, the data represents Child Welfare Services (CWS) clients that are TANF, SNAP, Childcare, or Medicaid eligible and automatically deemed eligible for TANF and is used in the calculation of the applicable percentage rate to be applied to CWS contracts expenditures to determine the amount funded by TANF. We performed procedures on a sample of 55 of 1,428 CWS recipients in the data to determine if they were eligible. We reviewed: • OKDHS Child Abuse and Neglect Information System (KIDS) removal screens documenting the period the child was removed from the home making them Medicaid eligible • Benefit screens on the OKDHS Data Services Division (DSD) Mainframe system to determine if they were receiving TANF, SNAP, or Childcare benefits We noted six (10.91%) CWS clients for which the KIDS removal screen did not contain information the child had been removed from the home during SFY 2024 or the CWS clients were not receiving TANF, SNAP, or Childcare benefits when they were determined eligible for TANF funding. Child Welfare Services for these six clients are considered an unallowable activity under the TANF program. Cause: Adequate internal controls are not in place or were not implemented to ensure that only allowable activities were charged to the TANF program. Effect: An incorrect percentage rate may have been applied to CWS contracts expenditures to determine the amount funded by TANF. Recommendation: We recommend the Department design and implement controls to ensure information used in the calculation of the applicable percentage rate applied to CWS contracts expenditures to determine the amount charged to the TANF program is accurate and that only allowable activities are charged to the TANF program. Criteria: Title 45 CFR §263.2(b) states, “With the exception of paragraph (a)(4)(ii) of this section, the benefits or services listed under paragraph (a) of this section count only if they have been provided to or on behalf of eligible families. An ‘‘eligible family’’ as defined by the State, must: (1) Be comprised of citizens or noncitizens who: (i) Are eligible for TANF assistance; (ii) Would be eligible for TANF assistance, but for the time limit on the receipt of federally funded assistance; or (iii) Are lawfully present in the United States and would be eligible for assistance, but for the application of title IV of PRWORA; (2) Include a child living with a custodial parent or other adult caretaker relative (or consist of a pregnant individual); and (3) Be financially eligible according to the appropriate income and resource (when applicable) standards established by the State and contained in its TANF plan.” The State of Oklahoma State Plan for Title IV-A of the Social Security Act Temporary Assistance for Needy Families (TANF) in the TANF Funded Programs section under Other TANF-Funded Services states in part, “Oklahoma utilizes the TANF block grant to fund several services and programs that meet one of the four TANF goals and which may be provided to families with incomes above the threshold for TANF cash assistance. Income eligibility for these services and programs is limited to families at or below 300% of the Federal Poverty Level (FPL) unless otherwise noted and Programs and Services that address Goals 3 and/or 4 of TANF do not have income limits unless otherwise noted.” Noted for Child Welfare Services Non IV-E TANF goal 1 the description states “Services that are designed to promote and allow children to be cared for in their own home or the homes of relatives; as well as provide emergency assistance. Children receiving TANF, SNAP, Childcare or Sooner Care benefits at the time of service enrollment are automatically deemed eligible for this category.” OAC 340:75-13-61 Medical services to children in placement states in part, “Children in Oklahoma Department of Human Services (DHS) custody and out-of-home placements have fee-for service medical cases. The Oklahoma Health Care Authority pays for each medical service provided at the Medicaid allowable rate. The child welfare specialist: … (2) applies for SoonerCare (Medicaid) for a child following execution of a court order to remove the child by entering the child's removal and placement information into KIDS as soon as possible, but no later than two business days after the child was physically placed in OKDHS custody per OAC 340:75-3-300 ITS 10(6). (A) When the child's removal information is entered into the KIDS Removal screen, a KIDS assignment is generated to the custody specialist. (B) The KIDS assignment to the custody specialist is considered the referral for: (i) Title XIX medical benefits; and (ii) Title IV-E eligibility determination.” 45 CFR §75.303 states, “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: In Progress Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-061 (Repeat 2023-060) Strengthen Internal Controls over Review of the Oklahoma State Regents for Higher Education Year End Reports STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (HHS) ALN: 93.558 FEDERAL PROGRAM NAME: Temporary Assistance for Needy Families (TANF) FEDERAL AWARD NUMBER: G1901OKTANF; G2001OKTANF; G2101OKTANF; G2301OKTANF; G2401OKTANF FEDERAL AWARD YEAR: 2019, 2020, 2021, 2023, 2024 CONTROL CATEGORY: Maintenance of Effort (MOE) QUESTIONED COSTS: $0 Condition and Context: OKDHS receives year end reports from the Oklahoma State Regents for Higher Education (OSRHE) for each college listing the TANF case number/students that attended education activities. We tested a sample of 22 of 218 cases (10%) and determined one case (4.55%) at one of the OSRHE colleges tested during the audit period was not recorded as being placed in a TANF Work activity on the OKDHS Data Services Division (DSD) Mainframe system Education, Training, and Employment (ET&E) screen documenting the student was approved for a TANF Work activity and no documentation was found in the case file for the student's attendance of education activities. Cause: OKDHS’s monitoring process did not require adequate review of the recipients receiving postsecondary/ vocational education needed to gain employment through the OKDHS TANF Work program to ensure qualified expenditures used to meet MOE requirements were made on behalf of TANF eligible families receiving the educational and training activities during the audit period. Effect: OSRHE education and training expenditures reported as TANF MOE may have been made to, or on behalf of, ineligible families during SFY 2024. Furthermore, OKDHS may not have met the MOE requirement for SFY 2024 which places OKDHS at risk to be liable for penalties imposed by HHS as well as for a reduction in future TANF awards. Recommendation: We recommend OKDHS design and implement a comprehensive internal control system, supported by written policies and procedures, to ensure that all reported OSRHE education and training expenditures utilized as TANF MOE are properly verified as being made to, or on behalf of, TANF eligible families during the applicable reporting period. Criteria: 45 CFR 75.303 (June 30, 2024) states: “The non-Federal entity must a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 45 CFR 263.2 (June 30, 2024) What kinds of State expenditures count toward meeting a State's basic MOE expenditure requirement? states, in part: “(a) Expenditures of State funds in TANF or separate State programs may count if they are made for the following types of benefits or services: … (3) Education activities designed to increase self sufficiency, job training, and work (see §263.4); … (4)(ii), “Pro-family healthy marriage and responsible fatherhood activities enumerated in part IV–A of the Act, sections 403(a)(2)(A)(iii) and 403(a)(2)(C)(ii) that are consistent with the goals at §260.20(c) or (d) of this chapter, but do not constitute ‘‘assistance’’ as defined in §260.31(a) of this chapter. … (b) With the exception of paragraph (a)(4)(ii) of this section, the benefits or services listed under paragraph (a) of this section count only if they have been provided to or on behalf of eligible families.” 45 CFR 263.4 (June 30, 2024) When do educational expenditures count? states: “ (a) Expenditures for educational activities or services count if: (1) They are provided to eligible families (as defined in §263.2(b)) to increase self sufficiency, job training, and work; and (2) They are not generally available to other residents of the State without cost and without regard to their income. (b) Expenditures on behalf of eligible families for educational services or activities provided through the public education system do not count unless they meet the requirements under paragraph (a) of this section.” The intergovernmental agreement between DHS and the Oklahoma State Regents for Higher Education (OSRHE) states, in part: “In accordance with this agreement, a 20% match to the Block Grant funding expended by DHS for post-secondary/vocational training programs at local colleges will be provided through OSRHE or local college funds and/or in-kind contributions. In lieu of transfer of matching funds from OSRHE or Local Col1eges to DHS, OSRHE will identify the specific amount of matching funds ascertained and that are available for DHS to use as the nonfederal share of Block Grant expenditures.” . … “the purpose of this agreement is to set forth a process designed to provide post-secondary/vocational education skills (and/or other necessary skills) needed to gain employment for eligible recipients in the DHS TANF WORK program. Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: September 2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-062 (Repeat 2023-078) Strengthen Internal Controls over Review and Approval of the ACF- 196R Financial Report STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (DHHS) ALN: 93.558 FEDERAL PROGRAM NAME: Temporary Assistance for Needy Families FEDERAL AWARD NUMBER: G1901OKTANF G2001OKTANF G2101OKTANF G2301OKTANF G2401OKTANF FEDERAL AWARD YEAR: 2019, 2020, 2021, 2023, & 2024 CONTROL CATEGORY: Reporting QUESTIONED COSTS: $0 Condition and Context: OKDHS completes the ACF-196R, which reports the quarterly expenditures a state use of TANF funds. An independent review and approval of the ACF-196R report is performed to ensure accuracy and completeness of the reported information prior to submission. The independent review performed on the following line-item expenditures reported on the SFY 2024 ACF-196R reports was not adequate as the TANF Reconciliation/supporting worksheet that links the ACF-196R report to accounting records does not agree to the accounting records: • Line 7.a (Child Welfare-Non IVE-Family Foster Care) is overstated by $85,110. • Line 9.b (Adjustment – State Certified Share) is overstated by $324,553. • Line 11.a (CCDF Daycare for MOE assistance) is overstated by $1,513,314. • Line 19 (DDSD TANF Respite) is overstated by $756. • Line 22.a (Cost Pool 303 Adjustments) is understated by $324,553. Cause: OKDHS does not have adequate processes in place to ensure all line-item expenditures reported on the ACF- 196R report are adequately reviewed for accuracy and completeness. Effect: Expenditures reported on the ACF-196R report are incorrect and don’t provide an accurate representation of TANF funds. Recommendation: We recommend OKDHS design and implement internal controls and develop written policies and procedures to ensure an independent review of accuracy and completeness of all aspects of the ACF-196R report occurs. Criteria: 2 CFR §200.303(a) states in part: “The non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Views of Responsible Official(s) OKDHS Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: 9/30/2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-063 (Repeat 2023-079) Strengthen Internal Controls over the TANF Eligibility Redeterminations STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (HHS) ALN: 93.558 FEDERAL PROGRAM NAME: Temporary Assistance for Needy Families (TANF) FEDERAL AWARD NUMBER: G2301OKTANF and G2401OKTANF FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Eligibility QUESTIONED COSTS: $21,372 Condition and Context: OKDHS case workers utilize the CWA03, CWA05, or CWA07 reports to monitor when eligibility re-determinations are required. We tested a sample of 60 of 5,328 TANF cases and identified 16 case files (26.67%) that did not contain documentation indicating an eligibility re-determination for benefits paid during the audit period. Additionally, benefits totaling $21,272 were charged to the grant after the period of eligibility expired. Cause: Monitoring reports were not used to verify eligibility re-determinations were performed timely, and eligibility re-determinations were not documented with supporting documentation retained in the case records. Effect: OKDHS did not comply with stated internal policies and federal program requirements; furthermore, noncompliance places OKDHS at risk for paying TANF benefits to ineligible individuals, and overstating maintenance of effort expenditures. This practice also places OKDHS at risk for paying back additional unallowable costs and losing future TANF funding. Recommendation: We recommend OKDHS follow its policy and complete eligibility re-determinations for all TANF recipients as required and ensure benefits are discontinued when the period of eligibility expires. Also, we recommend OKDHS design and implement monitoring techniques to ensure staff properly document and maintain supporting documentation in the case records, indicating the re-determination of eligible cases. Criteria: 45 CFR 206.10(a)(1)(ii) (June 30, 2024) states in part: “The agency shall require a written application, signed under a penalty of perjury, on a form prescribed by the State agency, from the applicant himself, or his authorized representative, or, where the applicant is incompetent or incapacitated, someone acting responsibly for him… .” OAC 340:65-3-1(a) states in part: “The eligibility determination process includes the applicant filing a signed application, the worker certifying or denying benefits, and all subsequent activities required to receive continuous benefits… .“ OAC 340:65-1-3 states in part: “The case record is the means used by OKDHS to document the factual basis for decisions.” OAC 340:65-3-8(e)(1) states in part: “Benefit renewal interview requirements vary depending on the program. A phone or face-to-face interview is required for a TANF certification renewal.” OAC 340:65-3-8(b)(2)(A) states in part: “A benefit renewal is completed at 12-month intervals, unless an earlier renewal date is warranted, with a TANF recipient.” 45 CFR 75.303 (June 30, 2024) states: “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An effective internal control system provides for proper record retention to ensure that all information and transactions are accurately recorded and retained. Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: In Progress Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-064 (Repeat 2023-080) Strengthen Internal Controls for Utilizing the Income Eligibility and Verification System in the TANF Eligibility Determination Process STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (HHS) ALN: 93.558 FEDERAL PROGRAM NAME: Temporary Assistance for Needy Families (TANF) FEDERAL AWARD NUMBER: G2301OKTANF; G2401OKTANF FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Special Tests and Provisions – Income Eligibility and Verification System QUESTIONED COSTS: $0 Condition and Context: OKDHS case workers utilize income and benefit information from the Income Eligibility and Verification System (IEVS) to verify income when determining eligibility. We tested a sample of 60 of 5,328 TANF cases, and determined one case (1.67%) had no IVES documentation present in the electronic case record or Family Assistance Client Services system (FACS) case notes during the audit period. Cause: The income verification portion of the eligibility determination and renewal process was either omitted or not documented when determining eligibility. Furthermore, OKDHS did not have adequate controls in place to ensure staff consistently follow OKDHS policies and procedures requiring the worker to review data exchange information at application and eligibility renewal. Effect: The unverified income used to determine a TANF applicant’s eligibility may not be accurate, which places OKDHS at risk of allowing for payments to ineligible recipients. This practice also places OKDHS at risk for paying back unallowable costs and losing future TANF funding. Recommendation: We recommend OKDHS strengthen internal controls over utilizing IVES in its eligibility determination process by implementing monitoring techniques to ensure staff follow established policy and procedures regarding the review of data exchange information at application and eligibility renewal. Also, we recommend OKDHS ensure staff properly document and maintain supporting documentation, indicating the review of income verification through data exchange being utilized in eligibility determination or re-determination. Criteria: Section 1137 of the Social Security Act (codified at 42 U.S.C. 1320b-7) establishes the federal Income Eligibility and Verification System (IEVS) , and requires participation in IVES, and under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. DHS Policy 340:65-3-1 (e)(2)(B) & (C) states in part, “During the eligibility determination process, the worker collects information necessary for determining the applicant's initial and continuing eligibility. The applicant is the primary information source. Information is verified when questionable or inconsistent with known facts. Unless questionable, the worker accepts, without further verification, the unearned income information obtained through Beneficiary and Earnings Data Exchange System, from the Social Security Administration (SSA); Supplemental Security Income /State Data Exchange System, from SSA; Unemployment Insurance Benefits, from the Oklahoma Employment Security Commission; and workers' compensation documents from the Workers' Compensation Commission; and alien status information obtained through Systematic Alien Verification for Entitlements (SAVE), from the United States Citizenship and Immigration Services.” 45 CFR 75.303 (June 30, 2024) states: “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: N/A Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-065 (Repeat 2023-073) Strengthen Internal Controls over Review of the CCDF Daycare Assistance reported as MOE STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (HHS) ALN: 93.558 FEDERAL PROGRAM NAME: Temporary Assistance for Needy Families (TANF) FEDERAL AWARD NUMBER: G2301OKTANF; G2401OKTANF FEDERAL AWARD YEAR: 2023 & 2024 CONTROL CATEGORY: Maintenance of Effort (MOE) QUESTIONED COSTS: $0 Condition and Context: An independent review of the monthly TANF reconciliation worksheet is performed to ensure accuracy and completeness of the monthly TANF MOE claimed each month and reported quarterly on the ACF-196R report. The amount reported as Child Care Development Fund (CCDF) Daycare for MOE assistance should agree with supporting documentation. The amount reported as CCDF Daycare for MOE assistance during the audit period was overstated by $1,513,314. The daycare monthly payments worksheet used by the Department to identify the authorized payments for childcare expenditures made to financially eligible families totaled $7,078,351; however, the Department reported $8,591,665 as CCDF Daycare for MOE assistance (8,591,665 – 7,078,351 = 1,513,314). Cause: The OKDHS reporting process for MOE lacked the strength and consistency of a strong review and approval to ensure personnel properly reported daycare expenditures as CCDF Daycare for MOE assistance. It appears the amount reported on Line 11.a of the ACF-196R report was not adequately reviewed. Effect: Childcare expenditures reported as CCDF Daycare for MOE were provided to families who were not determined income eligible. Furthermore, benefits were made to, or on behalf of, non-TANF eligible families causing noncompliance with the TANF MOE requirement, which places OKDHS at risk for HHS to reduce the following year’s TANF grant by the MOE shortage in accordance with 45 CFR 263.8(a). Recommendation: We recommend OKDHS design and implement a comprehensive internal control system, supported by written policies and procedures, to ensure proper review and approval of the monthly TANF reconciliation, which includes verification that any childcare expenditures utilized as TANF MOE have been made to, or on behalf of, TANF eligible families. Criteria: 45 CFR 263.3 (June 30, 2024) When do childcare expenditures count? States: “(a) State funds expended to meet the requirements of the CCDF Matching Fund (i.e., as match or MOE amounts) may also count as basic MOE expenditures up to the State's childcare MOE amount that must be expended to qualify for CCDF matching funds. (b) Childcare expenditures that have not been used to meet the requirements of the CCDF Matching Fund (i.e., as match or MOE amounts), or any other Federal childcare program, may also count as basic MOE expenditures. The limit described in paragraph (a) of this section does not apply. (c) The childcare expenditures described in paragraphs (a) and (b) of this section must be made to, or on behalf of, eligible families, as defined in §263.2(b).” 45 CFR 263.2(b) (June 30, 2024) states: “With the exception of paragraph (a)(4)(ii) of this section, the benefits or services listed under paragraph (a) of this section count only if they have been provided to or on behalf of eligible families. An ‘‘eligible family’’ as defined by the State, must: (1) Be comprised of citizens or non- citizens who: (i) Are eligible for TANF assistance; (ii) Would be eligible for TANF assistance, but for the time limit on the receipt of federally funded assistance; or (iii) Are lawfully present in the United States and would be eligible for assistance, but for the application of title IV of PRWORA; (2) Include a child living with a custodial parent or other adult caretaker relative (or consist of a pregnant individual); and (3) Be financially eligible according to the appropriate income and resource (when applicable) standards established by the State and contained in its TANF plan.” 45 CFR 263.8(a) (June 30, 2024) states: “If any State fails to meet its basic MOE requirement for any fiscal year, then we will reduce dollar-for-dollar the amount of the SFAG payable to the State for the following fiscal year.” 45 CFR 75.303 (June 30, 2024) states: “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: Corrected by DHS prior to SAI audit on the Federal report dated March 2025 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report. Auditor’s Response: SA&I agrees the correction was made in March 2025; therefore the questioned costs were removed.

FINDING NO: 2024-066 (Repeat 2023-079) Strengthen Internal Controls over Performing Eligibility Redeterminations STATE AGENCY: Department of Human Services FEDERAL AGENCY: Department of Health and Human Services ALN: 93.558 FEDERAL PROGRAM NAME: Temporary Assistance for Needy Families FEDERAL AWARD NUMBER: G2301OKTANF and G2401OKTANF FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles and Level of Effort QUESTIONED COSTS: $21,372 Condition and Context: OKDHS case workers utilize the CWA03, CWA05, or CWA07 reports to monitor when eligibility re-determinations are required. We tested a sample of 60 of 5,328 TANF cases and identified 16 case files (26.67%) that did not contain documentation indicating an eligibility re-determination for benefits paid during the audit period. Additionally, benefits totaling $21,272 were charged to the grant after the period of eligibility expired. Cause: Monitoring reports were not used to verify eligibility re-determinations were performed timely, and eligibility re-determinations were not documented with supporting documentation retained in the case records. Effect: OKDHS did not comply with stated internal policies and federal program requirements; furthermore, noncompliance places OKDHS at risk for paying TANF benefits to ineligible individuals, and overstating maintenance of effort expenditures. This practice also places OKDHS at risk for paying back additional unallowable costs and losing future TANF funding. Recommendation: We recommend OKDHS follow its policy and complete eligibility re-determinations for all TANF recipients as required and ensure benefits are discontinued when the period of eligibility expires. Also, we recommend OKDHS design and implement monitoring techniques to ensure staff properly document and maintain supporting documentation in the case records, indicating the re-determination of eligible cases. Criteria: 45 CFR 206.10(a)(1)(ii) (June 30, 2024) states in part: “The agency shall require a written application, signed under a penalty of perjury, on a form prescribed by the State agency, from the applicant himself, or his authorized representative, or, where the applicant is incompetent or incapacitated, someone acting responsibly for him… .” OAC 340:65-3-1(a) states in part: “The eligibility determination process includes the applicant filing a signed application, the worker certifying or denying benefits, and all subsequent activities required to receive continuous benefits… .“ OAC 340:65-1-3 states in part: “The case record is the means used by OKDHS to document the factual basis for decisions.” OAC 340:65-3-8(e)(1) states in part: “Benefit renewal interview requirements vary depending on the program. A phone or face-to-face interview is required for a TANF certification renewal.” OAC 340:65-3-8(b)(2)(A) states in part: “A benefit renewal is completed at 12-month intervals, unless an earlier renewal date is warranted, with a TANF recipient.” 45 CFR 75.303 (June 30, 2024) states: “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An effective internal control system provides for proper record retention to ensure that all information and transactions are accurately recorded and retained. Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: In Progress Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-012 Strengthen Controls Over Source Data Retention for Reporting (Repeat 2023-032) STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (HHS) ALN: 93.568 FEDERAL PROGRAM NAME: Low Income Home Energy Assistance Program (LIHEAP) FEDERAL AWARD NUMBER: 2024G992201; 2023G992201 FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Reporting QUESTIONED COSTS: $0 Condition and Context: The LIHEAP Quarterly Performance and Management report is prepared using data to determine the households assisted produced from a live database and provided by the University of Oklahoma (OU) Energy Assistance staff. For the 3/31/2024 LIHEAP Quarterly Performance and Management report we requested support, only partial support of the source data was provided. Source data to support the amounts reported on Section I and Section II of the Quarterly Performance and Management Report was not available for our review. Cause: OKDHS reporting process for the LIHEAP Quarterly Performance and Management report did not have a strong review and approval process to ensure supporting documentation is accurately reflected in the reports. Snapshots were not taken from the live database when the reports were created. Additionally, OU Energy Assistance staff, who ran queries from the database and provided the results to OKDHS in an email, were unable to provide support directly from the system that supported the amounts reported. Effect: LIHEAP Quarterly Performance and Management reports may not properly reflect actual activity of the LIHEAP program. Because DHS could not provide documentation to support the amounts on the reports, we were unable to verify the number of assisted households was reported correctly. Recommendation: We recommend OKDHS design and implement a comprehensive internal control system, supported by written policies and procedures to ensure proper review and approval of the LIHEAP Quarterly Performance and Management report, which includes verification of the source data obtained from the system used to calculate the LIHEAP Quarterly Performance and Management Report was obtained and retained at the time the report is created, and agrees with the amounts reflected in the report. Criteria: 2 CFR 200.303 (June 30, 2024) Internal Controls states in part: “the recipient and subrecipient: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” The Health and Human Services Administration for Children and Families’ Instructions for Completion of the Quarterly Performance and Management Report for LIHEAP for FFY24 include the following, 1. Section I: Total Households assisted. This section collects information on the total number of households assisted by LIHEAP during a specified quarter. 2. Section II: Performance Management. This section collects information on the total occurrences where LIHEAP assistance prevented the loss of home energy OR restored home energy service for assisted households during the specified quarter. Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: Anticipated 10/31/2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report

FINDING NO: 2024-027 (Repeat 2023-100) Strengthen Internal Controls over Benefit Data for Reporting Purposes STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (HHS) ALN: 93.568 FEDERAL PROGRAM NAME: Low Income Home Energy Assistance Program (LIHEAP) FEDERAL AWARD NUMBER: 2024G992201; 2023G992201 FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Reporting QUESTIONED COSTS: $0 Condition and Context: The LIHEAP Household Report is completed for a federal fiscal year (FFY).The FFY23 report submitted during state fiscal year (SFY)24 was obtained to perform testwork. LIHEAP benefit data for SFY23 and SFY24 was necessary to test the FFY23 report; however, during our prior year audit, OKDHS was unable to provide complete and accurate LIHEAP benefit data for SFY 23. Therefore, it could not be verified for the FFY 2023 report, the FFY23 LIHEAP Household Report tied to the SFY23 benefit data. While performing testwork over the FFY23 LIHEAP Household Report we attempted to trace the reported amounts to OKDHS internal system reports (EN600 reports) which are used to complete the household report. We determined ARPA funds were not reported on the EN600 reports and therefore, we were unable to trace the line item “Any type of LIHEAP assistance (American Rescue Plan Act funding)” to system support. Further, Section 1 Question 9: Crisis of the report, for year-round crisis (ECAP) and year-round (ARPA) households assisted, we determined a variance of 106 more households assisted on the FFY23 report than the EN600 internal system reports. Per the OKDHS LIHEAP Program Manager, this was an oversight and the report should tie to the internal system report. Cause: OKDHS’s system of internal controls lacked consistency and adequacy to ensure the benefit data was complete and accurate in SFY23, to properly review and approve the amounts reported on the LIHEAP Household Report to ensure the reported amounts were accurate and agreed to internal system reports (EN600) used to complete the reports. Furthermore, OKDHS failed to make system edits to add a unique identifiers to properly track ARPA funds within their system. Effect: The figures on the FFY23 LIHEAP Household Report may not be reported accurately. Recommendation: We recommend OKDHS strengthen its internal controls over benefit data for reporting purposes by establishing a set of data screening controls to ensure all relevant and required eligibility data is accurately maintained. We also recommend OKDHS strengthen its internal controls over benefit data for reporting purposes by establishing a set of controls over review and approval of LIHEAP reporting to ensure reports are completed accurately and tie to all supporting data and reports. Criteria: 2 CFR 200.303 (June 30, 2024) Internal Controls states in part: “the recipient and subrecipient: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Instructions for the LIHEAP Household Report Long Form for FFY23 states: Section I – Number of Assisted Households Report households that received a LIHEAP basic benefit for EACH and ANY type of LIHEAP assistance in FFY2023. Unduplicated data also must include households that receive any “other” type of LIHEAP assistance, as explained below. For each type of LIHEAP assistance, report the number of households assisted for the following categories: 1. The first line is for grant recipients to report information for all households regardless of funding source. This is consistent with what grant recipients were required to report in the past. Grant recipients should report the total count of households, counting each household once if it received that type of assistance during FY 2023. Report households assisted with regular LIHEAP funds, LIHEAP CARES Act funds, LIHEAP ARPA funds, or any combination of these funds. 2. The second line is for grant recipients to report information on the subset of households that were assisted with CARES Act supplemental LIHEAP funding. Include households that received a benefit that was fully or partially funded with CARES Act funds. Exclude households that did not receive a benefit that was fully or partially funded by CARES Act funds. Important Note: This is a subset of the households reported in the first line, meaning that a household that received a benefit that was fully or partially funded with CARES Act funds should be reported in this line and in the first line as well. 3. The third line is for grant recipients to report information on the subset of households that were assisted with American Rescue Plan Act supplemental LIHEAP funding. Include households that received a benefit that was fully or partially funded with ARPA Act funds. Exclude households that did not receive a benefit that was fully or partially funded by ARPA Act funds. Important Note: This is a subset of the households reported in the first line, meaning that a household that received a benefit that was fully or partially funded with ARPA Act funds should be reported in this line and in the first line as well. Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: Anticipated 10/31/2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-051 Strengthen Internal Controls and System Edits to Ensure Eligibility STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (DHHS) ALN: 93.568 FEDERAL PROGRAM NAME: Low Income Home Energy Assistance Program (LIHEAP) FEDERAL AWARD NUMBER: 2024G992201; 2023G992201 FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Eligibility QUESTIONED COSTS: $1,136 Condition and Context: While performing analytical procedures over SFY24 LIHEAP benefit (heating, cooling, and Energy Crisis Assistance Program (ECAP)) data we noted the following: • We tested 5 of 42 (11.90%) households that received cooling overpayments per LIHEAP Appendix C-7-A and noted 1 of 5 (20%) households where the income and household size noted in the SFY24 LIHEAP benefit data did not agree to the LIHEAP application or OKDHS LIHEAP case notes. OKDHS paid more than the allowable amount for cooling payments. The overpayment was confirmed by OKDHS management to be an error. This resulted in $80.85 in questioned costs. • We tested 17 of 171 (9.94%) households that received ECAP overpayments and noted: o For 4 of 17 (23.53%) items tested the household received more than $750 in ECAP payments during the federal fiscal year (FFY). Per OKDHS LIHEAP Program Manager, the payments included a Low Income Household Water Assistance Program (LIHWAP) payment that was improperly labeled in the SFY24 LIHEAP benefit data as LIHEAP. Further, the payment type code in DHS IMS does not differentiate between LIHEAP, LIHWAP, or LIHEAP supplemental payments. While the payment did not exceed LIHEAP ECAP maximum limits for the FFY, the data is inaccurate and the recording method in IMS does not allow for proper tracking of payments to ensure ECAP payments do not exceed the allowable FFY limits. o For 3 of 17 (17.65%) items tested the household received more than $750 in ECAP payments during the FFY. Per OKDHS LIHEAP Program Manager, these were overpayments due to the LIHEAP ECAP system edits being removed to permit processing of LIWAP benefits since the payment type code in DHS IMS does not differentiate between LIHEAP or LIHWAP payments. This resulted in $481.01 in questioned costs. o For 10 of 17 (58.82%) items tested the household received more than $750 in ECAP payments during the FFY. However, some of these payments were supplemental payments that appear in the system as ECAP but are not ECAP and do not count toward the maximum payment limit. The payment type code in DHS IMS does not differentiate between LIHEAP, LIHWAP, or LIHEAP supplemental payments. The payments were labeled incorrectly as LIHEAP ECAP in the SFY24 Benefit Payment Data. Therefore, while the payments to the household did not exceed the maximum allowable amount for ECAP for the FFY, the data is inaccurate and the recording method in IMS does not allow for proper tracking of payments to ensure ECAP payments do not exceed the allowable FFY limits. • We tested 49 heating cases with duplicated case numbers and noted 1 of 49 (2.04%) were duplicate payments to the same case number in the FFY that resulted in an overpayment of heating benefits. Per OKDHS LIHEAP Program Manager, the overpayment was an error. This resulted in $37 in questioned costs. The issues noted above resulted in a total of $598.86 questioned costs. While testing 60 of 98,819 LIHEAP benefit payments for non-pre-authorized households totaling $34,010,097.22 we noted the following: • For 5 of 60 (8.33%) items tested the payment was identified as a LIHEAP ECAP payment but was for a LIHEAP supplemental payment for which the household was determined to be eligible per SNAP data. OKDHS did not have a unique identifier in the system to differentiate between LIHEAP ECAP and LIHEAP supplemental payments. • For 3 of 60 (5%) items tested the payment was identified as a LIHEAP ECAP payment but was for a LIHEAP supplemental payment. The household income per the SFY24 LIHEAP benefit data does not agree to the case information in IMS but the household was eligible per SNAP data. While the household is eligible for supplemental payments, it is incorrectly identified as LIHEAP ECAP due to OKDHS not having unique identifiers in the OKDHS IMS system. • For 2 of 60 (3.33%) items tested the payment was not for LIHEAP ECAP but for LIHEAP supplemental payment. Supplement payments do not have their own applications and eligibility is determined using prior LIHEAP applications from FFY23. There was no application or eligibility documentation to determine the household eligible for the supplemental payment. Per OKDHS LIHEAP Program Manager, OKDHS identified a problem with the preauthorization process from controls in the system that allowed households not approved in FFY23 to appear as preauthorized and appear as eligible for supplemental payments which allowed for these improper payments. However, one of the two payments ($112) has been recouped by DHS. Therefore, only one payment will result in $112 in questioned costs. The issues noted above resulted in a total of $112.00 questioned costs. While testing 25 of 49,321 LIHEAP benefit payments for pre-authorized households totaling $15,716,110.92, we noted 1 of 25 (4%) households where the members did not remain the same from the previous FFY and therefore was not eligible for LIHEAP pre-authorization. This resulted in $425 questioned costs. Cause: OKDHS failed to make system edits that would have allowed for a unique identifier to be added to properly differentiate between LIHEAP ECAP, LIHEAP supplemental, and LIHWAP. Additionally, system edits failed to detect when households were not eligible and/or prevent duplicate payments or overpayments. Lastly, OKDHS did not maintain accurate LIHEAP benefit data for SFY24 and did not have sufficient controls over the LIHEAP eligibility process. Effect: Benefit payments exceeded the allowable benefit amount and others were made to ineligible households. Additionally, excessive time was required to perform audit testing due to the lack of program identifiers in the OKDHS IMS system resulting in increased audit costs. OKDHS payment system and benefit data are inaccurate and are not useful in tracking payment limits. Recommendation: We recommend OKDHS establish distinct identifiers in the LIHEAP payment system when there are payments for programs other than LIHEAP Heating, Cooling, or ECAP paid using the LIHEAP system. OKDHS should evaluate and revise system edits to ensure households are eligible and payments do not exceed the established maximum for the FFY. We further recommend OKDHS establish internal controls over eligibility that ensure all eligibility determinations are reviewed for accuracy, properly documented, and retained for audit purposes. Lastly, we recommend OKDHS establish data screening controls to ensure all relevant and required eligibility data is accurately captured and agree to system data used to determine eligibility. Criteria: 2 CFR § 200.303 – Internal Controls (June 30, 2024) states in part: “the recipient and subrecipient: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” OAC 340:20-1-14 (3) Approvals states, “Households may be approved for LIHEAP during each of the three designated application periods per fiscal year. (A) Certain households may be approved for ECAP outside of a designated application period when there is a life threatening emergency, per OAC 340:20-1-17(g). (B) Households are approved for LIHEAP when they: (i) submit a signed and completed application during the designated application period, per OAC 340:20-1-12; (ii) provide required verification, per OAC 340:20-1-13; and (iii) meet program factors, per OAC 340:20-1-10.” OAC 340:20-1-14(6) LIHEAP payments states, “LIHEAP payment amounts are estimated and reserved for each application period based on available funding and may be adjusted as needed. Refer to OKDHS Appendix C-7-A, Estimated Low Income Home Energy Assistance Program (LIHEAP) Benefit Level for all Households, for maximum payment amounts. (A) Payment amounts are determined based on the household's size, income, and primary energy source. (B) One payment is made per approved application directly to: (i) designated energy suppliers on behalf of approved households responsible for their utilities; or (ii) the household when the: (I) utilities are included in the rent; or (II) energy supplier is not designated to receive direct payments from OKDHS.” OAC 340:20-1-17 (c) Maximum benefit amount states, “When the household applies for ECAP more than once in the same fiscal year, the maximum benefit amount approved for all applications combined may not exceed the amount allowed per fiscal year for ECAP on OKDHS Appendix C-7-A, Estimated Low Income Home Energy Assistance Program (LIHEAP) Benefit Level For All Households. An additional benefit amount may be approved when additional funds are authorized during a federally declared disaster.” OAC 340:65-1-3. Case records states, “The purposes and objectives of the Oklahoma Department of Human Services (OKDHS) are carried out on a case-by-case basis. The decision on each case must be based on facts, be free of error and prejudice, fair to the person, and within the law and OKDHS policy. The case record is the means used by OKDHS to document the factual basis for decisions.” Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: In progress Corrective Action Planned: The Department of Human Services partially agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-060 Strengthen Internal Controls Related to Segregation of Duties and System Edits to Ensure Eligibility STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (USDA) ALN: 93.568 FEDERAL PROGRAM NAME: Low Income Home Energy Assistance Program (LIHEAP) FEDERAL AWARD NUMBER: 2024G992201; 2023G992201 FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Eligibility QUESTIONED COSTS: $315,990 Condition and Context: LIHEAP non-pre-authorized households are those households that are required to complete an application for all LIHEAP benefits (heating, cooling, and Energy Crisis Assistance Program). Once the applicant is determined eligible, the benefits are paid to the utility company providing the services, in most cases. While testing 60 of 98,819 LIHEAP benefit payments totaling $23,037 of $34,010,097 (0.07%) for non-pre-authorized households, we noted for that 2 of 60 (3.33%) items tested, DHS was unable to locate eligibility documentation, program application and/or Family Assistance Client Services system FACS case notes. We determined that both cases that lacked eligibility documentation were paid to the same vendor, which we will call Vendor #1. While reviewing payments to Vendor #1, we noted the address listed on data did not agree to the address on Vendor #1’s website and appeared to be fraudulent. We tested an additional 25 of 446 (5.61%) cases paid to Vendor #1 in SFY 2024 and all 25 were missing eligibility documentation. We have since determined Vendor #1 to be fraudulent; therefore, we questioned all 446 cases paid to Vendor #1 per Sulphur, OK address in the amount of $281,520. We then analyzed the data further and noted there were two additional vendors with the same Sulphur OK address (Vendor #2 & Vendor #3). We then reviewed the data for two vendors to see if they were using any addresses other than the Sulphur, OK location, which could result in other potential fraudulent vendors. We determined there were other addresses used for these two vendors in Enid, OK and Bokchito, OK. This resulted in Vendor #4 requiring further analysis. Below is our analysis of Vendors #2 through #4: We investigated Vendor #2 and noted 13 total cases for SFY 2024 with the addresses noted above. We reviewed a sample of 5 (38.46%) cases and were unable to locate eligibility documentation for any of the cases. Through discussion with DHS Office of Inspector General (OIG), we determined Vendor 2 does not exist. Therefore, payments made for all 13 cases totaling $8,470 are questioned. Also, for Vendor #3 we noted 28 cases with no vendor listed in the LIHEAP data that were paid to the three vendor addresses noted above. Upon review of these cases, we noted no eligibility documentation was present in the case file. We determined these payments were all fraudulent. Therefore, payments made for all 28 cases in SFY 2024 for Vendor #3 totaling $21,000 are questioned. Next, we noted 10 cases paid to Vendor #4 in Bokchito, OK and determined none of these case files contained eligibility documentation. This vendor was also determined to not exist; therefore, payments made for all 10 cases to Vendor #4 in SFY 2024 totaling $5000 are questioned. Lastly, OKDHS failed to separate the LIHEAP benefit data from the Low-Income Household Water Assistance Program (LIHWAP – ALN #93.499) benefit payment data. Therefore, we searched the LIHWAP data for the 4 fraudulent vendors noted above and identified payments to the same vendor (Vendor #2). Since we knew Vendor #2 did not exist, we questioned all SFY ’24 LIHWAP payments (see Effect). Cause: A lack of segregation of duties in the LIHEAP area allowed one individual to create new vendors, set up vendor bank accounts, change existing vendor bank account information, and approve eligibility runs prior to them being processed by Finance for payment. Further, bank account confirmations were forged by this individual allowing the perpetrator to conceal the personal bank accounts used for the four vendors. Also, because of the lack of segregation, this same individual used applicant cases that were eligible in prior years to pay the four fraudulent vendors, to help avoid detection. Additionally, system edits failed to detect when households were not eligible. Effect: LIHEAP program made 497 fraudulent payments in SFY 2024 to four vendors totaling $315,990. Also, 389 LIHWAP payments were paid to one fraudulent vendor in SFY 2024 totaling $372,422 for ineligible and unsupported cases. Based on discussion with DHS-OIG about the fraudulent cases noted above, they were able to do further analysis of the individual’s bank accounts to which these four vendors were paid and determined that the fraudulent activity went back to state fiscal year 2018. Recommendation: We recommend OKDHS establish proper segregation of duties to prevent vendor address and banking information from being created or changed by anyone within the program area. Further, we recommend that the program area not have the ability to request and/or approve bank confirmations for new or existing vendors. Lastly, we recommend OKDHS evaluate and revise system edits to ensure vendors are eligible at the time of payment, and vendor addresses are legitimate. Criteria: 2 CFR § 200.303 – Internal Controls states in part: “the recipient and subrecipient: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” OAC 340:65-1-3. Case records states: “The purposes and objectives of the Oklahoma Department of Human Services (OKDHS) are carried out on a case-by-case basis. The decision on each case must be based on facts, be free of error and prejudice, fair to the person, and within the law and OKDHS policy. The case record is the means used by OKDHS to document the factual basis for decisions.” Standards for Internal Control in the Federal Government (Green Book) 10.13 states: “Segregation of duties helps prevent fraud, waste, and abuse in the internal control system. Management considers the need to separate control activities related to authority, custody, and accounting of operations to achieve adequate segregation of duties.” Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: In progress Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-082 Strengthen Internal Controls Over the G1DX Exception Resolution Process STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (HHS) ALN: 93.568 FEDERAL PROGRAM NAME: Low-Income Home Energy Assistance Program (LIHEAP) FEDERAL AWARD NUMBER: 2023G992201, 2024G992201 FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Eligibility QUESTIONED COSTS: $0 Condition and Context: The G1DX System is an OKDHS application that compares client information entered by a OKDHS employee and OKDHS IEVS information sources as they are periodically updated. These sources include: • Wage information for the State Wage Information Collection Agency (SWICA) • Unemployment Compensation (UC) • All available information from the Social Security Administration (SSA) • Information from the U.S. Citizenship and Immigration Services • Unearned Income from the Internal Revenue Services (IRS) The purpose of the GIDX Exception and Clearance Report is to report discrepancies detected between agency data and external data sources and then notify staff to promptly address discrepancies so that case information remains accurate, reliable, and compliant with federal program requirements. The Exception and Clearance Report summarizes these discrepancies by worker, supervisor, county, and area, which allows management to monitor not only the type of discrepancy and length of days outstanding, but also to distinguish who is responsible for clearing the discrepancy within the 45 days allowed under current federal regulation and OKDHS policy. We reviewed the state fiscal year (SFY) 2024 (July 1, 2023 – June 30, 2024) G1DX Exception and Clearance Reports to determine whether data exchange discrepancy (exception) messages were resolved within the required 45 calendar days from the date the message was posted on the data exchange inquiry screen. Because the system used to compile the discrepancy messages does not distinguish messages by individual program, our review was conducted at the error type level rather than by program. Therefore, the discrepancies listed below represent a combined set of issues across multiple programs and may not apply to each program individually. Our review determined that 280,897 of the total 590,942 exceptions, or 47.53%, were not resolved within the required 45 calendar day period. The schedule below outlines the specific exceptions by error type and their corresponding delays. ERROR TYPE OPEN & RESOLVED G1DX EXCEPTIONS OVER 45 DAYS TOTAL OPEN & RESOLVED G1DX EXCEPTIONS % OF EXCEPTIONS OVER 45 DAYS BEN 29,366 82,923 35.41% CSE 3,027 4,633 65.34% DOD 34 88 38.64% ENU 17,800 22,945 77.58% IEV 4,407 13,452 32.76% NNH 92,641 179,866 51.51% OWG 49,626 91,048 54.51% PRS 2,446 4,364 56.05% SDX 32,681 97,589 33.49% SNH 44,862 84,069 53.36% UIB 4,007 9,965 40.21% TOTAL 280,897 590,942 47.53% Cause: The OKDHS G1DX exception clearing process in place did not provide a sufficient internal control structure to enable management to effectively monitor the status of G1DX discrepancy resolutions and ensure adequate staffing for timely processing. Because the current controls do not provide accountability or oversight, OKDHS failed to ensure that discrepancies were resolved within the required 45 days. Effect: The untimely resolution of discrepancies not only elevates the risk of program benefits being provided to ineligible individuals, but also elevates the risk of delayed benefits to eligible individuals, Recommendation: We recommend OKDHS enhance its monitoring activities by timely reviewing Exception and Clearance reports created for the G1DX discrepancies, ensuring adequate staff have effective tools and training to timely clear the exception, and holding all responsible individuals accountable. Additionally, we recommend OKDHS establish and follow policies and procedures outlining how the monitoring reports should be used and by whom to ensure discrepancies are timely resolved within the required 45 days. Criteria: 2 CFR Part 200 (June 30, 2024), Appendix XI, Part 4 applicable to the Temporary Assistance for Needy Families program, requires each State to participate in the Income Eligibility and Verification System (IEVS) required by section 1137 of the Social Security Act, as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. 45 CFR 205.56(a)(1)(iv) (June 30, 2024) states in part: “For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary… .” OAC 340:65-3-4(4)(C) states in part: “Automated data exchange with other agencies provides OKDHS with information regarding household members' benefits, wages, taxes, Social Security numbers, and current addresses. The system compares information obtained electronically with data stored within OKDHS electronic records to determine if there are discrepancies that need to be addressed. Automated data exchange information is also available within the OKDHS system to determine discrepancies. The worker is responsible for resolving data exchange discrepancy messages within 45-calendar days of the date the message is posted on the data exchange inquiry screen.” 45 CFR 75.303 (June 30, 2024) states: “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Views of Responsible Official(s): Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date:10/5/2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-031 (Repeat 2023-104) Strengthen Internal Controls over Monitoring for Desert Grant Awards STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services ALN: 93.575 FEDERAL PROGRAM NAME: CCDF Cluster FEDERAL AWARD NUMBER: 2101OKCDC6 FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility QUESTIONED COSTS: $12,616,296 Condition and Context: OKDHS begam implementing a new Childcare Desert Grant (DG) program starting in August 2022 in order to help increase accessibility to quality childcare for working families living in a county where there is not enough licensed childcare to support the needs of the residents. The grants were available for new or existing daycare homes or centers seeking to increase licensed capacity. Funds awarded under this program were intended to be used for minor construction, program materials, or technology and software for business development necessary to meet licensing requirements. For new daycares, applicants could receive a total of $10,000 per child with an initial advance of $5,000 per child payment made at the time of approval based on the licensed capacity, and a second $5,000 payment made at 12 months based on the enrollment and attendance. For expansion/ existing daycares, applicants could receive a total of $10,000 per child with an initial advance of $5,000 per child payment made at the time of approval based on the number of expanded slots, and a second $5,000 per child payment made at 12 months based on the number of children enrolled and attending in the expanded slots. We tested a sample of 71 (55 new and 14 existing sites) Child Care Centers (CCC) or Family Daycare Homes (FDCH) that received American Rescue Plan (ARP) Desert grant supplemental funds during SFY 2024 (July 1, 2023 – June 30, 2024). The universe included 253 Child Care providers with $24,050,000 in total awards. Tested awards for sampled providers totaled $13,295,000. We noted the following Desert grant Eligibility or Activities Allowed expenditure exceptions: ACTIVITIES ALLOWED and ELIGIBILITY • The 2nd round DG payment was based on both the attendance records and the enrollment records for the recertification month. However, OKDHS did not obtain the attendance records and ensure enrollment records agreed to attendance records for 10 of 71 (14.08%) facilities. Questioned costs totaled $1,956,582. We also noted that OKDHS did not obtain the attendance records for any of the facilities that had their 2nd round recertification performed in October of 2023. Total award amount paid by OKDHS without verifying attendance records is $3,450,000, of which nine facilities are already included in the questioned costs of $1,956,582 and an additional 22 facilities not in our sample were paid the remaining $1,493,418. • For 30 of 71 (42.25%) awards paid, the Desert grant award amount per CCC/FDCH was not calculated correctly based on the attendance and enrollment records submitted: overpayments totaled $1,340,000. We questioned these costs. • Eligibility criteria per the 2nd round Desert Grant Application was not met prior to the application approval date for the following: o For 4 of 71 (5.63%) new facilities, the CCC had a change in ownership or change in license number without a break in operations. Questioned costs totaled $1,080,000 for the 2nd round award. In addition, the CCC’s should not have received the 1st round of awards totaling $1,765,000 as the facilities did not meet the DG requirements for a new facility. o For 1 of 71 (1.41%) the amount of the 2nd round payment exceeds the amount of the 1st round payment. Questioned costs totaled $10,000. • The new/expanded CCC's/FDCH's did not comply with all post application approval eligibility criteria applicable to the SFY24 time period as follows: o For eight of 71 (11.27%) of facilities, the facility closed prior to two years from the date of the 1st round award payment; overpayments totaled $575,000 We questioned these costs. We also noted that six of 71 (8.45%) facilities closed prior to two years from the date the facility first started offering childcare, and another 11 of 71 (15.49%) had closed as of 11/6/2025 per OKDHS. The total amount of DG funds (1st and 2nd rounds) paid to facilities that are no longer operating is $8,190,000. o For 24 of 71 (33.80%) awardees paid a totaling total $2,091,582 (15.73% of total award amount of $13,295,000), the CCC/FDCH did not provide program expenditure records as required o For the 47 of 71 (66.20%) of Desert Grant awardees that reported expenditures for the 2nd round of Desert Grant awards, $10,534,714 (79.24% of the total award amount of $13,295,000), was spent on activities not designated as allowable per the Desert Grant application and OKDHS program objectives. We questioned these costs Inadequate Desert Grant program design and administration resulted in mismanagement of funds by OKDHS per the following: • For 55 of 71 (77.46%) Desert Grant awardees, OKDHS awarded STARS under the OKDHS Quality Rating Improvement System (QRIS) without any monitoring visits to verify the program met the requirements for the STAR level awarded. • For 32 of 71 (45.07%) Desert Grant awardees, the number of children present during monitoring visits does not reasonably support the number of children claimed in attendance and/ or enrollment in the documentation submitted by the facilities and used by OKDHS to calculate the 2nd round DG award amount. Fifteen of the 32 facilities had closed as of 11/6/2025. Eleven of the 32 facilities did not provide any expenditure records to SAI. Twenty-five of the 32 facilities received an increased STAR level without any monitoring visits to verify the program met the requirements for the STAR level awarded. While reviewing monitoring activities, we identified one recipient of the 1st round DG award who applied as a new childcare center and received $600,0000 in DG funds. However, the facility was already an existing childcare center. We determined the total number of facilities awarded DG funds in rounds 1 and 2 that closed as of 11/6/2025 is 128 (36.78 % of 348 total awarded the DG) with total desert grant payments for closed facilities totaling $19,865,000 or 29.31% of $67,775,000 in total DG payments made. Note: Because a tested provider may have questioned costs for one type of exception that overlaps with other types of exceptions, we are providing the following information: • Total non-compliance for exceptions related to issues with attendance/ enrollment support, facility closures, non-compliance with eligibility requirements and failure to provide records are $ 4,841,582 and projected non-compliance is $8,057,287 • Total non-compliance for exceptions related to issues with reported expenditures for activities not designated as allowable per the Desert Grant application and DHS program objectives are $7,774,714 and projected noncompliance is $15,028,104. • Total combined questioned costs for all exceptions (netted to ensure amounts do not exceed 2nd round award payment) are $12,616,296 and projected non-compliance is $23,085,391. Cause: The Department did not design the Desert grant program to ensure ARP Act CCDF funds were only used to expand access to childcare assistance to more income eligible families and improve the quality and availability of childcare. • The Department did not award funds based on the actual costs necessary for each individual CCC or FDCH to meet licensing requirements, which resulted in many providers that had large amounts of cash at their disposal even after meeting licensing requirements. • The Department advanced Desert grant funds to awardees in two lump sums instead of on an incremental basis ensuring planned remodeling work and program equipment and materials were being completed and/or acquired appropriately and were reasonable and necessary to meet program requirements. • The Department awarded Desert Grant funds based first on potential capacity and then enrollment and attendance but did not consider any other significant factors (i.e., business experience, number of children likely to be enrolled, ability to hire, train and retain qualified staff, etc.) essential to the operational sustainability of the new CCC or FDCH at the capacity level awarded. This contributed to many instances in which the CCC/ FDCH has already closed or is currently operating at an enrollment level significantly below the awarded capacity. • The Desert Grant Application included language that was insufficient to adequately inform the Desert grant awardees of all unallowable uses of the funds, including remodeling funding limits, limitations for sectarian organizations, and expenditures that were only allowable under other ARP CCDF stabilization grants. • The Department did not have adequate safeguards in place to ensure Desert Grant funds were appropriately awarded only to awardees that met the requirements to be considered a ‘new’ daycare center. • The Department allowed programs with the least restrictive licensing requirements (i.e., out of school, after school, summer programs) to receive the same amount per child as a program offering full time infant to school age childcare. The Department has not established adequate policies and procedures to monitor Desert Grant funds expended by childcare providers. The Desert Grant program may not effectively increase and/or sustain the increase in total capacity of childcare centers in low-income areas as intended. OKDHS CCDF did not normally create or administer new grant programs other than CCDF regular childcare subsidy program. In addition, the ARP CCDF Discretionary and supplemental funds had to be obligated by September 30, 2023, and liquidated by September 30, 2024, which reduced the timeline available to develop the new grant programs. However, OKDHS CCDF did have extensive experience with childcare licensing requirements and associated costs of operating the various types of childcare programs. Effect: The Desert Grant program may not effectively increase and/or sustain the increase in total capacity of childcare centers in low-income areas as intended. The combined effects of making advanced payments for all Desert Grant awards and the failure to monitor the use of Desert grant funds may lead to the Departments inability to recover grant funds not used in accordance with the grant requirements and/or used for non-childcare expenditures or misappropriated for other uses. Desert grant funds were not used by majority of CCC and FDCH to expand daycare attendance within desert regions; there were no repercussions to not meeting the licensing capacity they were paid on. Recommendation: We recommend the Department enhance its program design and planning processes to ensure that key elements—such as funding mechanisms and implementation workflows—are fully developed prior to launch. Strengthening the upfront design phase will help prevent challenges like those experienced with this grant and support more effective program execution in the future. We recommend the Department develop policies and procedures to ensure providers are adequately monitored to ensure Desert grant funds are expended properly to meet the objective of the grant. We recommend the Department perform a review of all Desert grant funds awarded and expended, identify all funds not used for the Desert grants intended purposes, and ensure remaining funds are expended appropriately or returned. We also recommend the Department recoup all funds for the following: o Funds awarded based on incorrect capacity counts and enrollment and attendance counts o Funds awarded to facilities that did not meet the requirements to be considered a new CCC/FDCH. o Expenditures for non-childcare purposes o Expenditures that benefited entities other than the facility awarded the desert grant o Excessive or unreasonable expenditures o Unexpended funds not needed to meet program requirements o Unaccounted for funds (i.e., funds transferred out or comingled with investment accounts, personal accounts, or other business/non-profit accounts) We recommend the Department improve their monitoring procedures to ensure significant discrepancies between the number of children claimed in attendance and the number of children present during monitoring visits are appropriately follow-up on. We also recommend that monitoring visits are performed during non-traditional hours and during before and after care hours for all providers offering these services at these times. Criteria: 2 CFR § 200.303(a) – Internal Controls states in part, “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.403 Factors affecting allowability of costs states in part, “Costs must…(a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles, and (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items, and (g) Be adequately documented.” The Desert grant FAQs state in part, …“How much are the Child Care Desert grants? For New Programs: Applicants may receive a total of $10,000 per child with an initial payment made at the time of approval based on license capacity, and a second $5,000 per child payment made at 12 months based on enrollment. The second payment cannot exceed the amount of the first payment. For Expansion Programs: Applicants may receive a total of $10,000 per child with an initial payment made at the time of approval based on the number of expanded slots, and a second $5,000 per child payment made at 12 months based on the number of children enrolled in the expansion slots. … What are the Qualifications for grant eligibility? … • Must accept subsidy payments • Must participate in the Quality Rating Improvement System (QRIS/STARS) • Must operate for a minimum of two years after date of initial award. • Be located in an identified child care desert. (A list of Child Care Desert counties can be reviewed at the end of this document.) • Make services available to families regardless of race, color, creed, religion, national origin, sex, marital status, disability, age, sexual orientation, or familial status. • Complete grant participation agreement, located at the end of the application. • Complete and return questionnaire that will be provided to you via email after you submit the grant application. • Be determined eligible by Oklahoma Human Services staff who review the applications. NOTE: Programs that have recently closed and reopen without an increase in capacity do not qualify OR Programs that have recently had a change in ownership without a break in operation do not qualify. … Childcare providers must NOT use the funds for any of the following purposes: • Purchase of land or property • Major construction or renovations. Major renovation means: (1) structural changes to the foundation, roof, floor, exterior or load-bearing walls of a facility or the extension of a facility to increase its floor area; or (2) extensive alteration of a facility such as to significantly change its function and purpose, even if such renovation does not include any structural change. • Consumable supplies (diapers, wipes, soap, paper products) or office supplies (paper, staples, pens) • One-time field trips for children • Child care tuition (scholarships) • Items prohibited by licensing • Used items • Non-childcare expenses … How long do I have to start operating my program after I receive the initial award? Childcare programs will have 90 days from receipt of the awarded grant funds to complete the application process and be placed on a six-month permit. Once you have a permit, you can begin serving children. If you are not on permit within 90 days, you may be required to return the initial award amount. … You must be approved for a 2-star level or higher within 12 months of receipt of initial award. If you do not meet this requirement, you may be required to return the initial award and will not qualify for a second award. You must be approved for a subsidy contract within 12 months of receipt of initial award. If you do not meet this requirement, you may be required to return the initial award and will not qualify for a second award. Childcare programs must participate in QRIS at two star or higher in order to receive a subsidy contract. The Desert Grant application states in part, “By signing this application, I understand that it is my responsibility to maintain records and other documentation to support the use of funds I receive, as well as to document my compliance with the requirements. I understand I must provide these documents to Oklahoma Human Services if requested. … Allowable uses of Grant Funds: Grant funds can be used to cover minor construction projects or program materials per application. All materials must be new, and must be purchased from a retail store, not a private party. In the event the grant recipient wishes to have the cost of assembly and/or installation covered by a grant, the labor must be performed by a licensed and bonded contractor. The grant may be used for technology and software to create and maintain business management systems. Provider Affirmation The following signature affirms that I will adhere to the qualifications listed above and will only spend the funds on allowable uses. I understand that I may be required to re-pay grant funds if I do not adhere to all the terms of this agreement. 42 U.S. Code § 9858 c(c)(2)(I) states in part, “In the case of a sectarian agency or organization, no funds made available under this subchapter may be used for the purposes described in paragraph (1) except to the extent that renovation or repair is necessary to bring the facility of such agency or organization into compliance with health and safety requirements…” 42 U.S. Code § 9858k(a) states, “No financial assistance provided under this subchapter, pursuant to the choice of a parent under section 9858c(c)(2)(A)(i)(I) of this title or through any other grant or contract under the State plan, shall be expended for any sectarian purpose or activity, including sectarian worship or instruction.” 42 U.S. Code § 9858k(b) states in part, “With regard to services provided to students enrolled in grades 1 through 12, no financial assistance provided under this subchapter shall be expended for— (1) any services provided to such students during the regular school day; (2) any services for which such students receive academic credit toward graduation.” 42 U.S. Code § 9858d(b) states in part, “…no funds shall be expended for the purchase or improvement of land, or for the purchase, construction, or permanent improvement (other than minor remodeling) of any building or facility. 45 CFR § 98.2, states in part, Definitions states in part, “Major renovation means any renovation that has a cost equal to or exceeding $350,000 in CCDF funds for child care centers and $50,000 in CCDF funds for family child care homes, which amount shall be adjusted annually for inflation and published on the Office of Child Care website. If renovation costs exceed these thresholds and do not include: (1) Structural changes to the foundation, roof, floor, exterior or load-bearing walls of a facility, or the extension of a facility to increase its floor area; or (2) Extensive alteration of a facility such as to significantly change its function and purpose for direct child care services, even if such renovation does not include any structural change; and improve the health, safety, and/or quality of child care, then it shall not be considered major renovation;” Views of Responsible Official(s) Contact Person: Kayla Urtz Anticipated Completion Date: N/A Corrective Action Planned: The Department of Human Services partially agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report. Auditor Response: Per OKDHS disagreement with SAI’s characterization of questioned costs, the treatment of unsupported expenditures as unallowable expenditures: For Single Audits, SAI is required to comply with 2 C.F.R. § 200.1 which states in part “(1) Questioned cost means an amount, expended or received from a Federal award, that in the auditor's judgment: (i) Is noncompliant or suspected noncompliant with Federal statutes, regulations, or the terms and conditions of the Federal award; (ii) At the time of the audit, lacked adequate documentation to support compliance; or (iii) Appeared unreasonable and did not reflect the actions a prudent person would take in the circumstances. (2) The questioned cost amount under (1)(ii) is calculated as if the portion of a transaction that lacked adequate documentation were confirmed noncompliant. We are required to report as questioned costs the $2,091,582 in Desert Grant funds, for which 24 providers did not submit any records. These providers were required to maintain these records and agreed to this per their Desert Grant application agreement which states in part, “Child Care Desert Grant Agreement - By signing this application, I understand that it is my responsibility to maintain records and other documentation to support the use of funds I receive, as well as to document my compliance with the requirements. I understand I must provide these documents to Oklahoma Human Services if requested.” Of note, 21 of the 24 providers that refused to provide records for the Desert Grant award also had other questioned costs related to enrollment and/or attendance records that did not support the award amount paid, the facility closed prior to the 2 year minimum an/or the facility was not a new daycare but received Desert Grant funds for being a new daycare. We also identified numerous other exceptions for these daycares that did not result in questioned costs due to the nature of the exception. SAI has also noted that investigations carried out by the OKDHS OIG unit also treat unsupported costs as questioned costs. With regard to sampling methodology and the extrapolation of questioned costs, SAI follows the AICPA Government Auditing Standards and Single Audits audit guide. All questioned costs identified in individually selected items (ISI’s) (not part of the sampled population) are not extrapolated, only the questioned costs identified in the sample. The sampling methodology we used for testing Desert Grant payments is appropriate for the attributes tested in this population and reflects the separate requirements for the daycare centers and family daycare homes related to the Desert Grant. The types and amounts of questioned costs identified in our audit are presented separately in the ‘Condition’ of the finding and the extrapolation methodology used does not duplicate any overlapping exception amounts. Please see the paragraph right above the ‘Cause’ section which breaks out the exception types between 1) expenditures reported by providers that did not align with the allowable uses of funds stated in the Desert grant application and 2) all other non-compliance issues that resulted in questioned costs. Also, there are not any questioned costs identified that are associated with “retrospective assessments regarding how the program could have been structured differently”. The Department of Human Services advanced all Supplemental Desert grant funds without having proper controls in place to ensure the funds were spent on allowable CCDF costs. Federal regulations state the lead agency (i.e., DHS) is responsible for fiscal controls and accounting procedures sufficient to permit the tracing of funds to a level adequate to establish that CCDF funds have not been used in violation of this grant.

FINDING NO: 2024-032 (Partial Repeat 2023-074) Strengthen Internal Controls over Monitoring for Childcare Providers STATE AGENCY: Department of Human Services (OKDHS) FEDERAL AGENCY: United States Department of Health and Human Services ALN: 93.575 FEDERAL PROGRAM NAME: Child Care and Development Fund (CCDF) Cluster FEDERAL AWARD NUMBER: 2101OKCDC6; 2301OKCCDF and 2401 OKCCDF FEDERAL AWARD YEAR: 2021, 2023 and 2024 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Special Tests and Provisions - Health and Safety Requirements; Special Tests and Provisions – Fraud Detection and Repayment QUESTIONED COSTS: $1,208,202 Condition and Context: During the Coronavirus disease of 2019 (COVID-19) emergency period, OKDHS implemented temporary enhancements to the Child Care Subsidy program to support childcare providers and stabilize service delivery. These enhancements included allowing providers: • An additional $5 per child, per day of care to offset pandemic-related operating costs. • Conversion of blended (part-time) rates to full-time weekly rates for care of school-age children, including: o Conversion of to full-time weekly rates for simplified billing. o Modified attendance tracking requirements for children needing childcare before and/or after school as follows:  Reduced to one “in” swipe if the child would be in care part-time (less than 4 hours) for that day) or,  Required parents to complete four swipes (to capture each arrival and departure time to and from school) per day if the time in care would exceed 4 hours per day. o Relaxed absent-day requirements for children on weekly rates, reducing the attendance threshold from 14 full time days to 11 full time days before providers qualified for absent-day payments. However, OKDHS stipulated per the OKDHS Childcare Subsidy Provider Handbook Section S COVID-19 Emergency Subsidy Changes, which states in part, "Children must attend the minimum number of full-time days in the month in order to receive absent day payments. (Parttime days paid at a full-time rate do not count towards the minimum number days required for absent day payments.)” See Finding # 2024-037 for details of how the ECC system rate code operations and identified exceptions related to the change from the blended rate to the weekly rate for school-age children, which resulted in unallowable costs charged to the cluster. OKDHS also implemented a new Quality Rating and Improvement System (QRIS) known as Stars, effective January 1, 2023. Under the new system, the State of Oklahoma has five levels (1-5) of quality ratings for all licensed childcare programs, which immediately qualifies all licensed programs as a 1 Star. In preparation of the new system, all daycares were asked to submit an updated Stars application, also called reapplication period. The application asked each daycare to provide their “Stars Level Requested”; the higher the Stars level approved the greater the subsidy payments per child. OKDHS did not perform a visit to verify that the centers/homes met the requirements for the Stars level requested prior to approving Stars applications. Daycares were informed that Stars criteria reviews would not be performed during the reapplication period unless serious non-compliance was observed during a regular monitoring visit. Also, the Stars yearly monitoring visit, and two partial visits, were waived by OKDHS for calendar year 2023. Therefore, OKDHS paid the increased subsidy payments to the providers without verifying the centers/homes met the Stars program requirements for the level requested by the provider for a minimum of one year. For further context, here are some examples of the combined effect of the COVID-19 childcare provider rate enhancements and the Stars program on the subsidy payments per child: For an infant in full time care prior to COVID-19, a childcare center with a 2 Star rating received $22.80 per day ($524.40 per month at 23 days). If the facility requested a change to 5 Stars, the center would receive the 5 Star rate of $50.60 per day and an additional $5 per day bringing the daily rate to $55.60 ($1,278.80 per month at 23 days), resulting in an increase of $32.80 per day and $754.40 per month. For a school-age child in part time care (before and/or after school) prior to COVID-19, a childcare center with a 2 Star rating would receive the blended rate of $12.60 per day ($289.80 per month at 23 days). At a 5 Star rating, the childcare facility would receive $17.40 per day ($400.20 per month). Also, the blended rate did not allow for the payment of absent days or any non-traditional hour’s payments ($14 per day if the child attended at least 2 hours from 6 pm to 6 am M-F and/or weekends). Additional COVID-19 enhancements for school-age children included switching the ECC system coding from a blended rate to a weekly rate (full-time), which allowed childcare providers to receive the increased weekly rate per day. A childcare center with a 2 Star rating would receive $21.10 per day ($485.30 per month at 23 days). If the facility requested a change to 5 Stars, the center would receive the 5 Star rate of $28.80 per day ($662.40 per month at 23 days) resulting in an increase of $16.20 per day and $372.60 per month. Also, switching from the blended rate to the weekly rate allowed for the payment of absent days and nontraditional hours payments ($14 per day). The allowance of non-traditional hours payments increased the amount a 5 Star childcare center could possibly receive to $984.40 per month. Decreasing the number of days a child must be in attendance from 14 to 11 days allows the childcare center to have two children enrolled in the same time slot and still collect full time payments for both children without exceeding the license capacity for that time slot. While centers and homes would not realistically have children enrolled and actually attending in this pattern, the childcare provider rate enhancements increase the risk of improper payments or overpayments. Additionally, OKDHS uses an Electronic Child Care (ECC) system through which, parents record their children's time and attendance at licensed facilities using either a traditional Electronic Benefit Transfer (EBT) card on a Point of Sale (POS) machine or the ECC Connect mobile application. Our review of the system indicated that use of the ECC Connect Application poses a significant risk of possible overpayments and/or fraud due to the way the application is designed. OKDHS began using the ECC Connect Application in July of 2021, which allows for the parent to use their cell phone to check their children in and out without physically swiping their Access Oklahoma EBT cards which must be physically swiped into the POS terminal at the childcare center. According to the OKDHS website, “Oklahoma Human Services (OKDHS) introduces the ECC Connect app -- a new, easier way for parents with children in subsidized child care to check their children in and out, all without the use of a benefits card. The time and attendance app reduces wait time in providers’ businesses, gives parents fewer cards to carry and offers a faster process for parents and providers.” Use of the ECC Connect Application provides opportunities to increase efficiency; however, discussions with OKDHS indicated mechanisms were not in place to properly monitor the application for potential fraud and/or abuse. During our discussions with OKDHS, documentation of internal controls over Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Special Tests and Provisions - Health and Safety Requirements, and our prior year audit procedures, we determined that OKDHS did not establish adequate oversight procedures for the various COVID-19 programs and enhancements. Our testwork (see below) over Part N1 monitoring for health and safety requirements and our additional review of the claims for monitored childcare providers further reflects these inadequacies and the increased risks associated with improper oversight. We tested a sample of 77 of 2,241 daycare centers and homes and determined the following: For Health and Safety Requirements: • 12 of 77 centers/homes (15.58%) were not monitored according to the visit plan in the Monitoring Frequency Plan (MFP). • 10 of 77 centers/homes (12.99%) for at least one of their monitoring checklists, the monitoring checklist included blank sections and/or discrepancies within the forms; therefore, we are unable to determine that all relevant health and safety requirements were reviewed appropriately for SFY 2024. • 7 of 77 centers/homes (9.09%) for which noncompliance issues noted in the monitoring visits were not followed up on timely and/or sufficiently. • 15 of 77 centers/homes (19.48%) for which one or more of the following was either not tested or was not up to date and the issue was not noted as non-compliance on the monitoring checklist: o Smoke Detector o Carbon Monoxide Detector o Fire Inspection Visit o Physical inventory Checklist o Annual Insurance o Fire Extinguisher o Equipment Inventory For Activities Allowed or Unallowed; Allowable Costs/Cost Principles; and Health and Safety Requirements: • 1 of 77 centers/homes (1.30%) for which OKDHS did not perform periodic visits during the time the provider communicated to OKDHS that children were actually in care. • 30 of 77 centers/homes (38.96%) for which a full Stars visit was not performed verifying the facility met all requirements for the Star level awarded and paid at. We also noted that OKDHS published the Star rating awarded on the Childcare Locator website even if OKDHS had not verified that the provider had met all the requirements for the level awarded. We note that OKDHS could have paid the providers at the Star level requested and still not published the Star level to the public until OKDHS verified that the provider actually met all the requirements. • 16 of 16 centers/homes (100%) for which the center/home received OKDHS subsidy payments (great than $1,000) for non-traditional hours care (6 pm to 6 am M-F and/or weekends); however, OKDHS did not perform at least one periodic monitoring visit during the non-traditional hours for the applicable MFP. For Activities Allowed or Unallowed; Allowable Costs/Cost Principle: • 42 of 77 centers/homes (54.55%) for which OKDHS did not perform any periodic visits during before school and/or after school hours. • 18 of 77 centers/home (23.38%) for which the center/home received full time equivalent OKDHS subsidy payments for a number of children that significantly exceeds the number of children actually present for all monitoring visits and/or significantly exceeds the license capacity of the facility indicating possible overpayments. Because there is not any indication on the monitoring forms of whether children present during monitoring all receive OKDHS subsidies, this variance may be even greater. Due to the issues noted in our monitoring sample testwork above related to the lack of monitoring visits for centers/home providing non-traditional hours childcare, we selected an additional 35 providers receiving high amounts of non-traditional hours payments for further review and determined the following: • 31 of 35 centers/homes (88.57%) for which the center/home received OKDHS subsidy payments for nontraditional hours care (6 pm to 6 am M-F and/or weekends): however, OKDHS did not perform at least one periodic monitoring visit in SFY24 during the non-traditional hours for the applicable MFP. • For 32 of 35 centers/homes (91.43%) with total CCDF subsidy payments totaling $8,530,284, we noted the following indicators of possible overpayments and/or fraud: o The attendance per the swipe data is unreasonably higher than the license capacity of the center/home. o The average CCDF subsidy paid per child is unreasonably higher than expected. o The number of children present during monitoring does not support the number of children claimed monthly by the provider. o The swipe data does not reflect expected or normal attendance patterns. • 12 of 35 centers/homes (34.29%) were closed as of the date of our testwork (end of March 2026). We also performed an additional, detailed review of the swipe data, CCDF case notes and/or monitoring visits for selected subsidy cases and identified overpayments and possible fraud in 11 of 35 centers/homes (31.43%) totaling $1,208,201.50. We questioned these costs. Cause: OKDHS does not have adequate internal controls to ensure Monitoring checklists are always complete and all health and safety requirements are reviewed and documented on the monitoring checklists appropriately. OKDHS does not have adequate policies and procedures to ensure monitoring visits are performed during all times children are in care, especially during non-traditional hours and before school and after school hours. OKDHS did not establish adequate oversight over increased payment amounts for COVID-19 enhancements and increased Star levels awarded that would address the increased risk of overpayments and misuse of federal funds. OKDHS did not ensure the Star level published on the OKDHS Childcare Locator website reflected the Star level the provider had actually achieved. Based on our sample tested and additional testwork performed for centers/home providing non-traditional hours childcare, it appears that the CCDF claims review process is not sufficient to adequately verify that OKDHS subsidy payments are only paid for children approved for subsidy payments that are in attendance for the time period paid. Effect: OKDHS is not in compliance with the above-mentioned requirements. By not performing procedures to periodically review inconsistencies in ECC system swipe data and review centers and homes’ attendance claims against actual child presence, OKDHS greatly increases the risk that overpayments, misuse of funds, or fraudulent activity may not be detected. For centers/homes offering non-traditional hours childcare and/or before school and after school childcare, OKDHS is not adequately monitoring whether the center/home is following health and safety requirements at these times and children in these facilities are at greater risk for illness and injury. By not regularly monitoring centers/homes during non-traditional hours and/or before school and after school hours, OKDHS increases the risk that providers may not comply with license capacity limits and also increases the risk of overclaims and possible fraudulent claims. Publishing the Star rating awarded on the Childcare Locator website for providers that had not yet met all the requirements for that Star level is misleading to the public as the public may choose a provider based on inaccurate information, and/or providers that have already met the requirements for the Star level awarded may be unfairly disadvantaged as they are competing with providers that have not invested the same time and resources required to actually attain and sustain the rating. Recommendation: We recommend the agency strengthen procedures to ensure monitoring visits are consistently completed and properly documented, including clear evidence that all health and safety requirements were reviewed. Monitoring staff should receive training to promote uniform practices and adequate documentation. We recommend the agency only publish Star ratings on the Childcare Locator website after OKDHS has verified the provider has met all the requirements for the published level. We also recommend the agency ensure the MFP includes monitoring visits during all hours’ childcare services are provided. Additionally, we recommend the agency strengthen the claim review process by including additional procedures to periodically review inconsistencies in ECC system swipe data and review centers and homes’ attendance claims against actual child presence to increase detection of potential overpayments, misuse of funds, or fraudulent activity. Criteria: CFR 45 98.41 states: Health and safety requirements states, in part, “(a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to childcare providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to §98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (i) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, the following provisions apply: (A) As part of their health and safety provisions in this area, Lead Agencies shall assure that children receiving services under the CCDF are age-appropriately immunized. Those health and safety provisions shall incorporate (by reference or otherwise) the latest recommendation for childhood immunizations of the respective State, territorial, or tribal public health agency. (B) Notwithstanding this paragraph (a)(1)(i), Lead Agencies may exempt: (1) Children who are cared for by relatives (defined as grandparents, great grandparents, siblings (if living in a separate residence), aunts, and uncles), provided there are no other unrelated children who are cared for in the same setting. (2) Children who receive care in their own homes, provided there are no other unrelated children who are cared for in the home. (3) Children whose parents object to immunization on religious grounds. (4) Children whose medical condition contraindicates immunization. (C) Lead Agencies shall establish a grace period that allows children experiencing homelessness and children in foster care to receive services under this part while providing their families (including foster families) a reasonable time to take any necessary action to comply with immunization and other health and safety requirements. (1) The length of such grace period shall be established in consultation with the State, Territorial or Tribal health agency. (2) Any payment for such child during the grace period shall not be considered an error or improper payment under subpart K of this part. (3) The Lead Agency may also, at its option, establish grace periods for other children who are not experiencing homelessness or in foster care. (4) Lead Agencies must coordinate with licensing agencies and other relevant State, Territorial, Tribal, and local agencies to provide referrals and support to help families of children receiving services during a grace period comply with immunization and other health and safety requirements; (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a mancaused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of bio contaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and … .” Oklahoma Administrative Code (OAC) 340:110-3-11(a)(8) states in part: “Ongoing approvals by fire and health are required every two years.” OAC 340:110-1-9 (b) states: “Ongoing monitoring: During monitoring visits, the licensing staff observes the entire facility, including outdoor play space and vehicles used for transportation, if available. At or subsequent to each visit, licensing staff checks: • (1) compliance with licensing regulations; • (2) records for new staff including personnel sheets and compliance with background investigations per OAC 340:110-1-8.1; • (3) personnel professional development records; • (4) Oklahoma Department of Human Services (OKDHS) computer checks on applicable persons per OAC 340:110-1-8.1; • (5) fire and health inspections within the last 24 months, (when) applicable; • (6) Form 07LC092E, Insurance Verification, within the last 12 months, or posting of Form 07LC093E, Insurance Exception Notification; and • (7) other documentation requiring renewal.” 45 CFR 98.67 states, “(a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part.” 2 CFR 200.303(a) states in part: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Instructions to Staff OAC 340:110-1-9(3) states in part: “Licensing staff: (1) documents observations and discussions on the appropriate monitoring checklists, enters the information from the monitoring checklists onto the licensing database, provides copies of the monitoring summary to the program’s owner/operator and files the original in the program’s file in the local Oklahoma Department of Human Services (OKDHS) office.” Views of Responsible Official(s): Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: Completed Corrective Action Planned: The Department of Human Services partially agrees with this finding. Please see the corrective action plan located in the corrective action plan section of this report. Auditor Response: The exceptions related to licensing monitoring for Health and Safety Requirements are only applicable to the evaluation of compliance with health and safety requirements. While our office used the number of children present at monitoring for some of our evaluations, we did this because monitoring visits for health and safety are the only time there is a periodic count of the number of children physically present at a certain time at the daycare centers/ homes. We do not have any exceptions noted in this finding based on the licensing monitoring visits not including claim review activities. With regard to the following response: “Non-traditional hours enhancements are payable only when established eligibility, attendance, and reimbursement requirements have been satisfied in accordance with the approved Child Care Provider Rate Schedule. Accordingly, the Agency does not believe the hypothetical examples contained in the finding accurately reflect how non-traditional hours payments are authorized or processed.” While an earlier version of this finding did include an incorrect length of time the child must attend the daycare during non-traditional hours in order to trigger the non-traditional hours payment in the ECC system, the finding now states the correct period of time and, we verified this with OKDHS personnel. The questioned costs for identified overpayments and possible fraud in 11 of 35 centers/homes (31.43%) totaling $1,208,201.50 are not related to just one weakness in internal control but are largely related to childcare subsidy payments that are made in one or more of the following instances: • Children swiped in as present at the daycare center/home when monitoring visits show zero kids in attendance or significantly less children than are being claimed. • Children swiped in as present at the daycare when the case notes reflect that the children would not have been in the daycare at that time or, the work/school schedule of the parent does not align with the hours the children are swiped in and/or the hours of care are not reasonable (Example: The parent has on/off jobs or school during the daytime hours only but the children are swiped in/out for late evening to midnight or overnight at the daycare center) • Multiple families with the exact same swipe in and swipe out times for almost two years • Children swiped in with 100% attendance and the case notes do not support this level of attendance. • Childcare subsidy payments are made for children not recorded in attendance records submitted for the Desert grant. Due to time constraints, we were only able to review a small number of individual cases in 11 of 35 centers/homes, therefore, we would expect the questioned costs would be much higher if we had been able to review cases from all of these 35 centers by the end of the audit period. In addition, while we did not include any questioned costs for centers/homes that only had one or more of the risk patterns noted below, we did note that, for every case included in questioned costs, the daycare center/home also had most of the following issues o The attendance per the swipe data is unreasonably higher than the license capacity of the center/home. o The average CCDF childcare subsidy amount paid per child is unreasonably higher than expected o The provider is claiming attendance rates that are unreasonably higher than expected o The number of children present during monitoring does not support the number of children claimed monthly by the provider. o The swipe data does not reflect expected or normal attendance patterns or swipe patterns. The overriding issue we noted is that OKDHS did not establish adequate oversight over increased payment amounts for COVID-19 enhancements and increased Star levels awarded that would address the increased risk of overpayments and misuse of federal funds. The same lack of oversight is also applicable to regular CCDF claims. In addition, we also noted other very significant control deficiencies related to the ECC Connect Application that are not detailed in this finding due to the proprietary nature of the identified risks and, OKDHS has not established adequate oversight procedures in relation to these risks.

FINDING NO: 2024-033 (Repeat 2023-099) Strengthen Internal Controls over Monitoring for Stabilization Awards STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services ALN: 93.575 FEDERAL PROGRAM NAME: CCDF Cluster FEDERAL AWARD NUMBER: 2101OKCSC6 FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility QUESTIONED COSTS: $698,608 Condition and Context: OKDHS began implementing a new Quality Rating and Improvement System (QRIS), also known as Stars, that became effective January 1, 2023. Under the new system, the State of Oklahoma has five levels (1-5) of quality ratings for all licensed childcare programs. All licensed programs immediately qualify as a 1 Star. In preparation of the new system, all daycares were asked to submit an updated Stars application (also called reapplication period). A Stars resource booklet, applicable to the daycare type, facility, small home, or large home, and a cover letter was e-mailed to each daycare on June 1, 2022, to provide guidance when requesting a Stars level. OKDHS offered a financial incentive to those daycares who submitted an application on or before November 30, 2022. The application asked each daycare to provide Stars Level Requested; the higher the Stars level approved the greater the grant funding and subsidy payments. For example, if you were a 1 Star facility for cycles 5 & 6 and you requested and were approved to become a 5 Star facility for cycles 7 & 8, you would receive approximately 3 times more funding for those cycles. Daycares were informed that Stars criteria reviews would not be performed during the reapplication period unless a serious non-compliance was observed during a regular monitoring visit. Also, the Stars yearly monitoring visit, and two partial visits, were waived by OKDHS for calendar year 2023. OKDHS provided Childcare ARP Act Stabilization grant funding to daycare homes and centers for SFY 2024 (July 1, 2023 to June 30, 2024) based on an approved grant application per cycle. Stabilization grant funding for cycle 9 (July 2023 – September 2023) were awarded based on licensed capacity and Stars rating. When attempting to obtain the supporting documentation for discretionary stabilization benefit payments, we were informed by OKDHS that no financial documentation was requested from the homes or centers for the funding provided in SFY 2024 and no monitoring of these payments to ensure the funds were used appropriately was performed. As a result, we requested the documentation directly from the homes and centers in order to determine if grant funds were spent in accordance with the objectives of the DHS child-care stabilization program. We tested a total of 84 daycare homes and centers that received ARP Act Discretionary stabilization funds during SFY 2024 (July 1, 2023 – June 30, 2024). The universe included 2,488 providers with $86,335,000 in total awards. Tested awards for daycare homes and centers totaled $3,419,000. We noted the following issues for the 84 grant recipients tested: • For 4 (4.76%) of 84 daycare providers tested, stabilization funds were not expended on allowable activities. Expenditures for unallowable activities totaled $20,014. • For 25 (33.33%) of 84 daycare providers tested, stabilization funds could not be supported with adequate documentation; therefore, we could not determine whether the stabilization funds were expended on allowable activities. Expenditures for unsupported activities totaled $678,595. • For 42 (50%) of 84 daycare providers tested, the Stars rating increased by at least 2 from cycles 5-6 to cycles 7-8. This greatly increased the amount of child-care subsidy payments these providers received, often doubling the amount. For example, a childcare center provider with a 2 Star rating would receive $22.80 per day for an infant aged 0 to 12 months. By increasing the star rating to 5, the daily rate is increased to $50.60. Other COVID-19 exceptions also increased the subsidy amounts by $5 per day per child and decreased the number of days a child must attend the day care from (14 to 11) before receiving subsidy payments for all absent days as well. SAI noted a large number of childcare centers received increased star ratings during the period DHS did not review the Stars requirements that later were not able to qualify for Star rating they received. Cause: OKDHS had no process or internal controls in place to adequately monitor stabilization funds awarded to childcare providers to ensure the grant funds were actually spent on the approved activities per the application. Also, OKDHS did not have adequate controls in place to support the increase in Stars rating for homes and centers since there were no reviews and/or monitoring performed on which to quantify their assessments. Effect: Stabilization funds were not expended in compliance with Section 2202(e)(1) of the ARP Act of 2021. Further, allowing daycares to request their own Star level increase dramatically increased the amount of funding most daycare homes or centers received, and the increased Star level may not have been appropriate based on the actual performance, or quality and safety level, of the daycare. Lastly, without OKDHS monitoring stabilization funds expended by providers, grant funds could continue to be expended on unallowable activities that did not align with the objectives of the DHS child-care stabilization program. Recommendation: We recommend OKDHS continue to strengthen its internal controls over monitoring daycares to ensure stabilization funds are expended in accordance with the objectives of the DHS child-care stabilization program. Further, we recommend OKDHS ensure adequate Stars reviews and/or monitoring have been performed prior to increasing grant funding and subsidy payments. Lastly, we recommend OKDHS develop an appropriate process to ensure daycare homes and centers are adequately documenting and supporting grant expenditures and that the records are available for review. Criteria: 45 CFR 98.67 states: “Fiscal Requirements. (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part.” 2 CFR § 200.303(a) states in part, “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.403 states in part, “Costs must…(a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles, (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items, … and (g) Be adequately documented.” American Rescue Plan Act of 2021 (ARP) § 2202(e)(1) states in part, USES OF FUNDS-, ”In GENERAL - A qualified child care provider that receives funds through such a subgrant shall use the funds for at least one of the following: (A) Personnel costs, including payroll and salaries or similar compensation for an employee (including any sole proprietor or independent contractor), employee benefits, premium pay, or costs for employee recruitment and retention. (B) Rent (including rent under a lease agreement) or payment on any mortgage obligation, utilities, facility maintenance or improvements, or insurance. (C) Personal protective equipment, cleaning and sanitization supplies and services, or training and professional development related to health and safety practices. (D) Purchases of or updates to equipment and supplies to respond to the COVID–19 public health emergency. (E) Goods and services necessary to maintain or resume childcare services. (F) Mental health supports for children and employees.” Views of Responsible Official(s) Point of Contact: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: N/A Corrective Action Planned: The Department of Human Services partially agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report. Auditor Response: SAI would like to clarify our position with regard to OKDHS responsibility to ensure funds awarded under any COVID-19 program are expended for the purposes for which they were awarded. The term ‘monitoring’ in this finding refers to OKDHS oversight and review of how the Stabilization funds were expended. While there are portions of the CCDF regulations that the Stabilization funds are exempted from, including formal subrecipient monitoring under Uniform Guidance (45 CFR Part 75), the following regulations do apply: Per the Notice of Grant Award for Child Care Stabilization Funds American Rescue Plan (Arp) Act: “APPLICABLE LEGISLATION, STATUTE, REGULATIONS 1. The administration of this program is subject to: … Child Care and Development Block Grant (CCDBG) Act and related regulations a. The CCDBG Act is codified at 42 U.S.C. §9857 et seq., b. Implementing program regulations are located at 45 CFR Part 98 and 99 … Financial Reporting and Requirements 10. Federal funds awarded under this grant must be expended for the purposes for which they were awarded. 11. Each grantee's fiscal and accounting procedures must be sufficient to permit the preparation of required reports and the tracing of expenditures to a level necessary to establish that Federal funds have not been used in violation of the terms and conditions.” The applicable regulations include the following: 45 CFR 98.67 states: “Fiscal Requirements. (a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part.” The Stabilization program award application includes the following attestation: “To receive a stabilization grant, I agree to use the funds only for the categories and purposes indicated on this application and have marked above which categories I plan to fund. I also understand that it is my responsibility to maintain records and other documentation to support the use of funds I receive, as well as to document my compliance with the requirements described in A, B, and C. By signing this application, I am certifying that I will meet requirements throughout the period of the subgrant, including the following: 1. When open and providing services, I will implement policies in line with guidance and orders from corresponding state, territorial, Tribal, and local authorities and, to the greatest extent possible, implement policies in line with guidance from the U.S. Centers for Disease Control and Prevention (CDC). I will remain open during the grant periods. 2. For each employee (including lead teachers, aides, and any other staff who are employed by the child care provider to work in transportation, food preparation, or other type of service), I must continue paying at least the same amount of weekly wages and maintain the same benefits (such as health insurance and retirement) for the duration of the subgrant. I understand that I may not furlough employees from the date of application submission through the duration of the subgrant period. 3. I will provide relief from copayments and tuition payments for the families enrolled in the child care program, to the extent possible, and prioritize such relief for families struggling to make either type of payment. Note: Child care providers must agree to use the funds for one or more of the following purposes: 1. Personnel costs, benefits, premium pay, and employee recruitment and retention for an employee (someone who owns their own business, like a sole proprietor or an independent contractor, can count themselves as an employee) 2. Rent or mortgage payments, utilities, facilities maintenance and improvements, or insurance 3. Personal protective equipment, cleaning and sanitation supplies and services, or training Provider Affirmation The following signature affirms that I will adhere to the items noted in A, B, and C. It also affirms I will only use the funds in the areas noted in section 5 of this application.” It is the position of SAI that OKDHS cannot adequately ensure the funds were expended appropriately without implementing procedures for oversight and review of amounts actually expended. This would require OKDHS to have procedures to obtain and review the records and other documentation the provider has to determine whether the provider complied with the required use of funds per the Stabilization agreement for at least a sample (or other selected number) of providers receiving the award. SAI would also like to clarify our position with regard to questioned costs related to providers that failed to submit any records requested which the providers are required to maintain and provide for audit purposes. For Single Audits, SAI is required to comply with 2 C.F.R. § 200.1 which states in part “(1) Questioned cost means an amount, expended or received from a Federal award, that in the auditor's judgment: (i) Is noncompliant or suspected noncompliant with Federal statutes, regulations, or the terms and conditions of the Federal award; (ii) At the time of the audit, lacked adequate documentation to support compliance; or (iii) Appeared unreasonable and did not reflect the actions a prudent person would take in the circumstances. (2) The questioned cost amount under (1)(ii) is calculated as if the portion of a transaction that lacked adequate documentation were confirmed noncompliant. We are required to report as questioned costs the $678,595 in Stabilization funds for which 23 providers did not submit any records. These providers were required to maintain these records and agreed to this per their application attestation. Of note, eight of the providers that refused to provide records for the Stabilization award also received the Desert grant award for which they also did not provide any records among other exceptions noted. SAI has also noted that investigations carried out by the OKDHS OIG unit also treat unsupported costs as questioned costs. Lastly, with regard to sampling methodology and the extrapolation of questioned costs, SAI follows the AICPA Government Auditing Standards and Single Audits audit guide. All questioned costs identified in individually selected items (ISI’s) (not part of the sampled population) are not extrapolated, only the questioned costs identified in the sample. The sampling methodology we used for testing Stabilization payments is appropriate for the attributes tested in this population. Questioned Costs Projected Questioned Costs Noncompliance noted in ISI's for records not provided by Provider $146,750 N/A Noncompliance noted in sample for unallowable uses of funds $20,014 $15,624,863 Noncompliance noted in sample for records not provided by Provider $531,845 Total noncompliance noted in sample $551,858 Total Questioned Costs $698,608 Total Projected Questioned Costs $15,771,613

FINDING NO: 2024-037 Strengthen Internal Controls over Rates Paid to Childcare Providers STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services ALN: 93.575 FEDERAL PROGRAM NAME: CCDF Cluster FEDERAL AWARD NUMBER: 2101OKCDC6; 2301OKCCDF and 2401 OKCCDF FEDERAL AWARD YEAR: 2021, 2023 and 2024 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility QUESTIONED COSTS: $2,621 Condition and Context: During the Coronavirus disease of 2019 (COVID-19) emergency period, OKDHS implemented temporary enhancements to the Child Care Subsidy program to support childcare providers and stabilize service delivery. These enhancements included allowing providers: • An additional $5 per child, per day of care to offset pandemic-related operating costs. • Conversion of blended (part-time) rates to full-time weekly rates for care of school-age children, including: o Conversion of full-time weekly rates for simplified billing. o Modified attendance tracking requirements for children needing childcare before and/or after school as follows:  Reduced to one “in” swipe if the child would be in care part-time (less than 4 hours) for that day) or,  Required parents to complete four swipes (to capture each arrival and departure time to and from school) per day if the time in care would exceed 4 hours per day. o Relaxed absent-day requirements for children on weekly rates, reducing the attendance threshold from 14 full time days to 11 full time days before providers qualified for absent-day payments. However, OKDHS stipulated per the OKDHS Childcare Subsidy Provider Handbook Section S COVID-19 Emergency Subsidy Changes, which states in part, "Children must attend the minimum number of full-time days in the month in order to receive absent day payments. (Parttime days paid at a full-time rate do not count towards the minimum number days required for absent day payments.)” Additionally, OKDHS uses an Electronic Child Care (ECC) system through which, parents record their children's time and attendance at licensed facilities using either a traditional Electronic Benefit Transfer (EBT) card on a Point of Sale (POS) machine or the ECC Connect mobile application. The ECC system rate codes allowed providers to receive a significant increase in the childcare subsidy amount for school-age children under the following COVID-19 enhancements: • Weekly (full-time) rates which allowed the ECC system to pay: o The weekly rate for any day the child is ‘swiped in’ whether the time between the ‘swipe in’ and the ‘swipe out’ is considered part-time (4 hours or less) or full-time (4 hours and one second or more) o Absent day payments where the system calculates the time between the ‘swipe in’ and ‘swipe out’ and pay for absent days when the child attends at least 11 full-time days (COVID-19 flexibilities) or 14 full-time days (non-COVID-19). If the parent only ‘swipes in’ and does not ‘swipe out’, the system will not record any time accrual and therefore, will not count that day towards the absent day threshold o Non-traditional hours payments where the system calculates the time between the ‘swipe in’ and ‘swipe out’ and pays a non-traditional hour’s payment of $14 per day when 2 hours or more are recorded from 6pm to 6 am. • Blended (part-time) rates which allowed the ECC system to pay the blended rate for any day a child coded to a blended rate is ‘swiped in’ whether the time between the ‘swipe in’ and the ‘swipe out’ is considered part-time (4 hours or less) or full-time (4 hours and one second or more). In contrast to the weekly (fulltime) rates, the system does not allow a child coded to a blended rate the following: o Absent day payments o Non-traditional hours’ payments. A review of the ECC system log identified several cases where children coded to a blended rate were switched to a weekly rate, which allowed the childcare providers to receive the increased weekly rate per day, as well as both absent day payments and non-traditional hours payments resulting in an increased amount of subsidy payments for school age children. Our review also indicated the ECC system coding change created a situation in which absent day payments were made when a parent/caregiver ‘swiped in’ and ‘swiped out’ instead of only completing a ‘swipe in’ or, completing four swipes (to capture each arrival and departure time to and from school) per day on those days that part-time before and after school care is needed. While the increase to a full-time rate for school-age children was included in the Oklahoma Child Care and Development Fund (CCDF) State Plan (which includes the emergency COVID-19 State Plan Amendments) and was submitted to and approved by the U.S. Department of Health and Human Services (HHS), Administration for Children and Families (ACF), the payment of absent days for children while in school was not a part of the approved State Plan and is unallowable per federal regulations. The OKDHS quarterly Childcare Services Newsletters (dated March 2023, August 2023 and March 2024) indicated OKDHS was aware of the possible overpayment issue created by the change from blended rates to weekly rates and communicated the following to childcare providers: “As you are aware, OKDHS is currently reimbursing providers at a fulltime rate for school-age children even when they only attend part-time (four hours or less per day). To ensure accurate payment and avoid overpayments, Child Care Providers have the option of either: 1) requiring parents complete a single “in” swipe, or 2) requiring parents complete four swipes (to capture each arrival and departure time to and from school) per day on those days that part-time before and after school care is needed. Children who attend school full-time should never be swiped in all day while they are at school (one “in” swipe and one “out” swipe). Although OKDHS is currently reimbursing part time attendance with full time pay as part of our COVID initiatives, these part-time days do not count towards the minimum number of days required for absent day payments. Thus, it is imperative the swiping rules above be followed to ensure you don’t incur an overpayment which must be paid back. For further clarification, please review your child care handbook Section C.” Additionally, the OKDHS newsletter dated November 2024 states in part: “Ensure accurate and timely payment by reviewing children's Time-Attendance Payment (TAP) Transactions on the Provider Portal daily. Providers are responsible for confirming all attendance is accounted for and any errors are corrected within the 10-day grace period.” While OKDHS did communicate clarification of allowable payments to providers, our sample of 64 of 63,274 CCDF case files identified: • 11 of 64 case files for which full-time payments were made for school-age children (turned 6 years old by 9/1/2023) during time periods that school was in session. These full-time payments resulted in $12,049 paid over the regular blended rate amount. For five of these 11 case files (7.81% of cases tested) a provider was paid absent days for school-age children during the time school was in session because the parent/caregiver failed to record the times the child was actually in school in the ECC system as required per the Childcare Subsidy Provider Handbook Section S Covid-19 Emergency Subsidy Changes (4 card swipes or ECC application entries) and only recorded the time the child was first dropped off at the daycare and then picked up from the daycare (2 card swipes or ECC application entries). Total questioned costs are $2,621. Likely questioned costs are $2,313,951. Our review of the system indicated that use of the ECC Connect Application also poses a significant risk of possible overpayments and/or fraud due to the way the application is designed. These issues are identified and included in Finding # 2024-032. Cause: OKDHS did not establish adequate oversight of increased payment rates for COVID-19 enhancements. While the OKDHS Childcare Subsidy Provider Handbook Section S Covid-19 Emergency Subsidy Changes and the OKDHS quarterly newsletters did communicate that children who attend school full-time should never be swiped in all day while they are at school (one “in” swipe and one “out” swipe), OKDHS did not establish adequate oversight for the system coding changes which allowed time the children were actually in school to be counted towards the calculation of full-time days accrued for absent payments. Effect: Childcare assistance payments were made in excess of the allowable amount. Recommendation: We recommend OKDHS strengthen internal controls to ensure all COVID-19 enhancement payments adhere to OKDHS and federal program requirements. We recommend that OKDHS review the ECC system swipe data for the period the COVID-19 enhancements were in place to determine if absent day overpayments were made for school-age children in the ECC system and perform necessary recoupment procedures for identified overpayments. We also recommend OKDHS design and implement ECC system related controls and/or queries to run periodically against all the ECC swipe data to identify swipe patterns that indicate possible overpayments and /or fraud and followup on any anomalies identified. Criteria: 45 CFR §75.303 states, in part, “The Non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO); (b) comply with federal statutes, regulations, and the terms and conditions of federal awards; (c) evaluate and monitor the non-federal entity’s compliance with statutes, regulations and the terms and conditions of federal awards; (d) take prompt action when instances of noncompliance are identified including noncompliance identified in audit findings.” 45 CFR 98.67 states, “(a) Lead Agencies shall expend and account for CCDF funds in accordance with their own laws and procedures for expending and accounting for their own funds. (b) Unless otherwise specified in this part, contracts that entail the expenditure of CCDF funds shall comply with the laws and procedures generally applicable to expenditures by the contracting agency of its own funds. (c) Fiscal control and accounting procedures shall be sufficient to permit: (1) Preparation of reports required by the Secretary under this subpart and under subpart H; and (2) The tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of the provisions of this part.” 42 U.S. Code § 9858k (b) states in part, “Tuition - With regard to services provided to students enrolled in grades 1 through 12, no financial assistance provided under this subchapter shall be expended for — (1) any services provided to such students during the regular school day;” The OKDHS Childcare Subsidy Provider Handbook Section S Covid-19 Emergency Subsidy Changes, states in part, “To assist childcare providers, school-age children who attend part-time will be reimbursed at a full-time rate through [August 2024]. For children who need before and after school care, 4 swipes per day will be required. There will not be any changes to absent day policies. Children must attend the minimum number of full-time days in the month in order to receive absent-day payments. (Part-time days paid at a full-time rate do not count towards the minimum number days required for absent-day payments.) Accurate time and attendance must continue to be recorded on the POS machine in order to prevent overpayment. Providers have the option of only requiring an “in” swipe on those days that part-time before and after school care is needed. Part-time is 4 hours or less per day. These part-time days will pay at the full-time rate. However, you still have the option to require 4 swipes if you choose.” Views of Responsible Official(s): Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: N/A Corrective Action Planned: The Department of Human Services does not agree with this finding. Please see the corrective action plan located in the corrective action plan section of this report. Auditor Response: SAI respectfully disagree that the questioned costs are based on application of standard Child Care payment requirements rather than the temporary COVID-19 payment flexibilities that governed the program during the audit period. All questioned costs identified in this finding are based on the rules for Oklahoma's temporary Childcare payment flexibilities that were included in the OKDHS Oklahoma Child Care and Development Fund (CCDF) State Plan Amendments. The OKDHS Childcare Subsidy Provider Handbook Section S COVID-19 Emergency Subsidy Changes, states in part, “To assist childcare providers, school-age children who attend part-time will be reimbursed at a full-time rate through [August 2024]. For children who need before and after school care, 4 swipes per day will be required. There will not be any changes to absent day policies. Children must attend the minimum number of full-time days in the month in order to receive absent-day payments. (Part-time days paid at a full-time rate do not count towards the minimum number days required for absent-day payments.) Accurate time and attendance must continue to be recorded on the POS machine in order to prevent overpayment. SAI would also reiterate OKDHS communications to providers via the OKDHS quarterly Childcare Services Newsletters (dated March 2023, August 2023 and March 2024) which indicated OKDHS was aware of the possible overpayment issue created by the change from blended rates to weekly rates and communicated the following to childcare providers: “As you are aware, OKDHS is currently reimbursing providers at a fulltime rate for school-age children even when they only attend part-time (four hours or less per day). To ensure accurate payment and avoid overpayments, Child Care Providers have the option of either: 1) requiring parents complete a single “in” swipe, or 2) requiring parents complete four swipes (to capture each arrival and departure time to and from school) per day on those days that part-time before and after school care is needed. Children who attend school full-time should never be swiped in all day while they are at school (one “in” swipe and one “out” swipe). Although OKDHS is currently reimbursing part time attendance with full time pay as part of our COVID initiatives, these part-time days do not count towards the minimum number of days required for absent day payments. Thus, it is imperative the swiping rules above be followed to ensure you don’t incur an overpayment which must be paid back. For further clarification, please review your child care handbook Section C.” The questioned costs included in this finding are only related to instances in which the school-age child (at least 6 years old as of 9/1/2023) was swiped in all day while they were at school (one “in” swipe and one “out” swipe) and, the absent payments were paid based on time accrued for periods the child was actually in school. This is not allowed per the approved OKDHS COVID-19 rules and, it is also not allowed per 42 U.S. Code § 9858k (b) states in part, “Tuition - With regard to services provided to students enrolled in grades 1 through 12, no financial assistance provided under this subchapter shall be expended for — (1) any services provided to such students during the regular school day;” SA&I also noted that, although OKDHS was aware of the possible overpayment issue created by the change from blended rates to weekly rates, OKDHS did not establish adequate internal controls to ensure overpayments were identified timely and adequately follow-up was performed to recoup overpayments.

FINDING NO: 2024-067 Strengthen Internal Controls Over Review and Approval of Workforce Bonus Payments STATE AGENCY: Oklahoma Department of Human Services FEDERAL AGENCY: Department of Health and Human Services ALN: 93.575 FEDERAL PROGRAM NAME: CCDF Cluster FEDERAL AWARD NUMBER: 2101OKCSC6 FEDERAL AWARD YEAR: 2021 CONTROL CATEGORY: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Eligibility QUESTIONED COSTS: $2,000 Condition and Context: In July of 2022, OKDHS’ Child Care Services (CCS) launched the Workforce Support Grant. The Workforce Support Grant (Bonus Payment for Child Care Staff) was part of a retention and recruitment initiative funded by the Oklahoma Department of Human Services (OKDHS) and managed by the Center for Early Childhood Professional Development (CECPD). OKDHS managed the application process and the CECPD coordinated the payment process. It was designed to monetarily assist childcare workers and entice them to remain in the industry. OKDHS offered a one-time, $1,000 bonus to all childcare center/home workers. This also included ancillary staff that worked in the childcare program. The final application cycle for this $1,000 bonus closed on May 15, 2023, with the last payments made in March of 2024. To qualify for the 2023 bonus, applicants had to meet the following requirements: be employed in a licensed or permitted childcare facility; work directly with children or in a role supporting daily operations, and have an active, current profile in the Oklahoma Professional Development Registry (OPDR). The center director or home provider was required to apply on behalf of the staff. DHS has policies and procedures in place to review and approve the workforce bonus applications. We tested a total of 60 workforce bonus payments totaling $60,000. The universe included 7,148 bonus payments totaling $7,148,000 in total awards. We noted that for 2 of 60 (3.33%) payments totaling $2,000, the employee had a termination date that preceded the workforce bonus application date, indicating the employee was not employed in a licensed or permitted childcare facility at the time of the application and was not eligible for the award. We questioned the $2,000 as an unallowable cost. Cause: It appears the Department did not have an adequate review process to ensure that applicants with termination dates prior to the application date were not paid a bonus payment. Effect: Bonus payments totaling $2,000 were made to individuals ineligible for the Workforce Support Grant program. Recommendation: We recommend DHS strengthen its review and approval process with regard to all Covid-19 related programs to ensure funds are spent only for individuals that meet the eligibility requirements of the program. Criteria: 2 CFR § 200.303(a) states in part, “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: N/A Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-081 (Repeat 2023-070) Strengthen Internal Controls Over the G1DX Exception Resolution Process STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services ALN: 93.575, 93.596 FEDERAL PROGRAM NAME: CCDF Cluster FEDERAL AWARD NUMBER: 2301OKCCDF, 2401OKCCDF FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Eligibility QUESTIONED COSTS: $0 Condition and Context: The G1DX System is an OKDHS application that compares client information entered by a OKDHS employee and OKDHS IEVS information sources as they are periodically updated. These sources include: • Wage information for the State Wage Information Collection Agency (SWICA) • Unemployment Compensation (UC) • All available information from the Social Security Administration (SSA) • Information from the U.S. Citizenship and Immigration Services • Unearned Income from the Internal Revenue Services (IRS) The purpose of the GIDX Exception and Clearance Report is to report discrepancies detected between agency data and external data sources and then notify staff to promptly address discrepancies so that case information remains accurate, reliable, and compliant with federal program requirements. The Exception and Clearance Report summarizes these discrepancies by worker, supervisor, county, and area, which allows management to monitor not only the type of discrepancy and length of days outstanding, but also to distinguish who is responsible for clearing the discrepancy within the 45 days allowed under current federal regulation and OKDHS policy. We reviewed the state fiscal year (SFY) 2024 (July 1, 2023 – June 30, 2024) G1DX Exception and Clearance Reports to determine whether data exchange discrepancy (exception) messages were resolved within the required 45 calendar days from the date the message was posted on the data exchange inquiry screen. Because the system used to compile the discrepancy messages does not distinguish messages by individual program, our review was conducted at the error type level rather than by program. Therefore, the discrepancies listed below represent a combined set of issues across multiple programs and may not apply to each program individually. Our review determined that 280,897 of the total 590,942 exceptions, or 47.53%, were not resolved within the required 45 calendar day period. The schedule below outlines the specific exceptions by error type and their corresponding delays. ERROR TYPE OPEN & RESOLVED G1DX EXCEPTIONS OVER 45 DAYS TOTAL OPEN & RESOLVED G1DX EXCEPTIONS % OF EXCEPTIONS OVER 45 DAYS BEN 29,366 82,923 35.41% CSE 3,027 4,633 65.34% DOD 34 88 38.64% ENU 17,800 22,945 77.58% IEV 4,407 13,452 32.76% NNH 92,641 179,866 51.51% OWG 49,626 91,048 54.51% PRS 2,446 4,364 56.05% SDX 32,681 97,589 33.49% SNH 44,862 84,069 53.36% UIB 4,007 9,965 40.21% TOTAL 280,897 590,942 47.53% Cause: The OKDHS G1DX exception clearing process in place did not provide a sufficient internal control structure to enable management to effectively monitor the status of G1DX discrepancy resolutions and ensure adequate staffing for timely processing. Because the current controls do not provide accountability or oversight, OKDHS failed to ensure that discrepancies were resolved within the required 45 days. Effect: The untimely resolution of discrepancies not only elevates the risk of program benefits being provided to ineligible individuals, but also elevates the risk of delayed benefits to eligible individuals, Recommendation: We recommend OKDHS enhance its monitoring activities by timely reviewing Exception and Clearance reports created for the G1DX discrepancies, ensuring adequate staff have effective tools and training to timely clear the exception, and holding all responsible individuals accountable. Additionally, we recommend OKDHS establish and follow policies and procedures outlining how the monitoring reports should be used and by whom to ensure discrepancies are timely resolved within the required 45 days. Criteria: 2 CFR Part 200 (June 30, 2024), Appendix XI, Part 4 applicable to the Temporary Assistance for Needy Families program, requires each State to participate in the Income Eligibility and Verification System (IEVS) required by section 1137 of the Social Security Act, as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. 45 CFR 205.56(a)(1)(iv) (June 30, 2024) states in part: “For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary… .” OAC 340:65-3-4(4)(C) states in part: “Automated data exchange with other agencies provides OKDHS with information regarding household members' benefits, wages, taxes, Social Security numbers, and current addresses. The system compares information obtained electronically with data stored within OKDHS electronic records to determine if there are discrepancies that need to be addressed. Automated data exchange information is also available within the OKDHS system to determine discrepancies. The worker is responsible for resolving data exchange discrepancy messages within 45-calendar days of the date the message is posted on the data exchange inquiry screen.” 45 CFR 75.303 (June 30, 2024) states: “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Views of Responsible Official(s): Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: Anticipated 10/5/2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-025- Improve Subrecipient Monitoring (Repeat 2023-006) STATE AGENCY: Oklahoma Department of Human Services (DHS) FEDERAL AGENCY: Department of Health and Human Services (DHHS) ALN: 93.658 FEDERAL PROGRAM NAME: Foster Care – Titel IV-E FEDERAL AWARD NUMBER: 2301 OKFOST and 2401 OKFOST FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Subrecipient Monitoring QUESTIONED COSTS: $0 Condition and Context: We judgmentally selected 2 of the 11 subrecipients (18.18%) to determine whether controls were designed and implemented to ensure a risk assessment of the subrecipient was performed by the Pass-Through Entity (PTE) and noted the following: For 2 subrecipients (100%), we determined a risk assessment was performed based on previous year’s performance to determine the appropriate subrecipient monitoring of each subrecipient; however, the date the risk assessments were performed are not documented, the award amount on the risk assessment equals the amount of funds paid during SFY24, and the line items Results of Single Audit are dated in July 2024. We randomly selected 4 of the 11 subrecipients (36.36%) to determine if all requirements imposed by the PTE on the subrecipient so that the federal award was used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR section 200.331(a)(2)); and any additional requirements that the PTE imposed on the subrecipient in order for the PTE to meet its own responsibility for the federal award and we noted: • Two of four (50%) subawards, cost allocation plans were not received per the contract. • Four of four (100%) subawards, the statement of work had insufficient detail to determine if deliverables were met. For both of our samples, we reviewed the subrecipient contracts to determine whether they included information required in accordance with 2 CFR 200.332(b) and we noted: • Two of six (33.33%) subawards did not include the subrecipient name and unique entity identifier • Six of six (100%) subawards did not include the Federal Award Identification Number (FAIN) • Six of six (100%) subawards did not include the Federal Award Date • One of six (17%) subawards did not include the Federal Award project description • Two of six (33.33%) subawards did not include the name of Federal awarding agency, pass through entity (PTE), and PTE awarding official contact information in the award document • One of six (16.67%) subawards did not include the ALN (Assistance Listings number) and title as required on the contract • Six of six (100%) subawards did not include identification of whether the award was for Research & Development • Three of six (50%) subawards did not include an indirect cost rate negotiated between the subrecipient and the Federal Government and also did not include an appropriate rate determined by the PTE in collaboration with the subrecipient. Cause: Management does not properly understand the program requirements. This is a prior audit finding dating back to SFY2017; however, DHS Management has shown some corrective action has been implemented to address identifying the award and applicable requirements and monitoring as required in 2 CFR 200.332. DHS does not have adequate controls in place to properly monitor subrecipients to ensure the contractual obligations are met. Effect: DHS is not in compliance with the monitoring requirements for this program. Therefore, subrecipients may not administer federal funds in accordance with program requirements. Recommendation: We recommend DHS further modify its subrecipient agreements and related documentation to ensure all required award information is provided and that any additional requirements imposed by DHS in their subrecipient agreements are complied with. Further, the contract should explicitly state the program duties to be performed by the subrecipient. Additionally, we recommend DHS perform risk assessments on all subrecipients at the start of the fiscal year to determine the level of monitoring necessary. Criteria: 45 CFR §75.303(a) states in part: “The Non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Per 2 CFR §200.1 Definitions defines subaward as “Subaward means an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract [emphasis added].” 2 CFR §200.332 Requirements for pass-through entities states in part “All pass-through entities must: … (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. (i) Subrecipient name (which must match the name associated with its unique entity identifier); (ii) Subrecipient's unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; (v) Subaward Period of Performance Start and End Date; (vi) Subaward Budget Period Start and End Date; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; (viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; (ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; (x) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; (xiii) Identification of whether the award is R&D; and (xiv) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per § 200.414. (2) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award; (3) Any additional requirements that the pass-through entity imposes on the subrecipient for the passthrough entity to meet its responsibilities under the Federal award. This includes information and certifications (see § 200.415) required for submitting financial and performance reports that the pass-through entity must provide to the Federal agency; (4) Indirect cost rate: (i) An approved indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, a pass-through entity must determine the appropriate rate in collaboration with the subrecipient. (c) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a federal awarding agency) … (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports.” Paragraph 7 of the agency’s subrecipient contract states in part “Sub-Recipient will provide a cost allocation plan to OKDHS within thirty (30) calendar days of this Agreement being signed. In the event there are any changes to the Cost Allocation Methodology, Sub-Recipient will notify OKDHS of those changes before submitting any affected quarterly claim invoice. Views of Responsible Official(s) Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: 9/30/2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-078 Strengthen Internal Controls over Review and Approval of the CB-496 Report STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (DHHS) ALN: 93.658 FEDERAL PROGRAM NAME: Foster Care – Titel IV-E FEDERAL AWARD NUMBER: 2301 OKFOST and 2401 OKFOST FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Reporting QUESTIONED COSTS: $0 Condition and Context: OKDHS completes the CB-496, which reports financial and caseload data for foster care. An independent review and approval of the CB-496 report is performed to ensure accuracy and completeness of the reported information prior to submission. We tested 2 of the 4 quarterly CB-496 reports submitted during SFY 2024 (7/1/2023 – 6/30/24) and noted the following exceptions on the Quarter Ending (QE) 12/31/2023 report: • Line 5. In Placement Administrative Costs – Care Planning and Management (subrecipient claims) was overstated by $2,697,218. • Line 8. In Placement Administrative Costs – Legal Representation – Child or Parent (subrecipient claims) was understated by ($1,267,827). • Line 12b. CCWIS Project Operational Costs Using CCWIS Cost Allocation - was overstated by $106,045. We also noted that amounts reported on the CB-496 did not trace to amounts from the cost allocation reports, which support the Schedule of Expenditures of Federal Awards (SEFA). Cause: OKDHS does not have adequate processes in place to ensure all line-item expenditures on the CB-496 report are adequately reviewed for accuracy and completeness. Effect: Expenditures reported on the QE 12/31/2023 CB-496 report are overstated by $1,535,436. Recommendation: We recommend OKDHS design and implement internal controls and develop written policies and procedures to ensure an independent review for accuracy and completeness of all aspects of the CB-496 report. Criteria: 45 CFR §75.303(a) states in part “The Non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” CB-496 Reporting Instructions state in part: • “Line 5 In-Placement Administrative Costs - Case Planning and Management. Enter the amount expended for title IV-E eligible children in a Foster Care placement for the development, review or revision of case plans or the supervision or management of cases.” • “Line 8. In-Placement Administrative Costs – Legal Representation – Child or Parent. Enter the amount of expenditures to provide independent legal representation by an attorney for a title IV-E eligible child in foster care or the child's parents to prepare for and participate in judicial determinations in all stages of foster care related legal proceedings that are required under title IV-E of the Act.” • “Line 12b - CCWIS Project Operational Costs Using Non-CCWIS Cost Allocation. Enter expenditures and estimates allocable to any title IV-E program (including Foster Care) made for operational costs for all CCWIS designated projects where the automated function is not eligible for application of the CCWIS cost allocation method as specified at 45 CFR § 1355.57.” Views of Responsible Official(s) OKDHS Contact Person: Kayla Urtz, Director of Internal Audit Anticipated Completion Date: 9/30/2026 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-071 Strengthen Internal Controls over Review of Draw Request Form STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (DHHS) ALN: 93.667 FEDERAL PROGRAM NAME: Social Services Black Grant (SSBG) FEDERAL AWARD NUMBER: 2301OKSOSR, 2401OKSOSR FEDERAL AWARD YEAR: 2023, 2024 CONTROL CATEGORY: Cash Management and Reporting QUESTIONED COSTS: $0 Condition and Context: Oklahoma Department of Human Services (OKDHS) completes a Cash Management Improvement Act (CMIA) verification form and a GrantsPLUS draw request form for each grant award draw. The GrantsPLUS draw request totals are carried forward to the Schedule of Expenditures of Federal Awards (SEFA) and the CMIA verification form is used to calculate the draw amount. The forms are reviewed for completeness by an OKDHS program accountant separate from the requesting OKDHS accountant. There were seven Social Services Block Grant (SSBG) draw requests during SFY 2024, we selected three draw requests (42.86%) to test. For one of the draw requests tested, we noted a difference of $90,000 between the CMIA verification form and the GrantsPLUS draw request due to figures being transposed. Further review of the SEFA resulted in a prior year correction for the TANF Transfer to SSBG for SFY2023 quarter 1 (9/30/2022) that was not reported during SFY 2023. This results in an overstatement of $3,450,197 for SFY 2024 SEFA revenues and expenditures and an understatement of $3,450,197 for the SFY 2023 SEFA revenues and expenditures. Cause: Internal controls are not being followed consistently to ensure errors are detected during the review process of the grant award draws. Effect: The correct amount was drawn; however, OKDHS’ GrantsPLUS draw request contained a transposed figure and the incorrect expenditure amount was reported on the SEFA. The SFY 2024 SEFA included an additional $3,450,197 in expenditures and revenues that should have been reported on the SFY 2023 SEFA. Recommendation: We recommend the agency strengthen internal controls and develop written policies and procedures to ensure review of the GrantsPLUS draw requests, CMIA verification forms, and SEFA are performed thoroughly to ensure accuracy and completeness. Criteria: 45 CFR 75.303 states: “The non-Federal entity must a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Views of Responsible Official(s) Contact Person: Kevin Haddock, Director, and Amber Kelley, Deputy Director of CARE Anticipated Completion Date: N/A Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-010 (Repeat 2023-004) Strengthen Process for Medical Claim Reviews STATE AGENCY: Oklahoma Health Care Authority (the Authority) FEDERAL AGENCY: United States Department of Health and Human Services ALN: 93.767 FEDERAL PROGRAM NAME: Children’s Health Insurance Program FEDERAL AWARD NUMBER: 2305OK5021 and 2405OK5021 FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Activities Allowed or Unallowed and Allowable Costs/Cost Principles; Matching QUESTIONED COSTS: $1,996 Condition and Context : Medical payments are direct medical costs that are 1) initiated by the provider based on services rendered through the Medicaid Management Information System (MMIS) or 2) manually paid by OHCA Finance. The MMIS claims processing system includes the following processes which ensure the proper payment of claims: • Edit/Audit Processing – ensures claim records are processed in accordance with state policy and that the recipient is eligible for the services being billed. • Claims Pricing – calculates the payment amount for each service according to the rules and limitations applicable to each claim type, category of service, and type of provider. • Adjustment Processing – supports the adjustment of previously adjudicated claims. • Claims Resolution – supports the review and correction of suspended claims. • Point of Sale (POS) Prospective Drug Utilization Review (ProDUR) – provides for the online processing of pharmacy claims submitted in real time by pharmacists and prevents the dispensing of inappropriate drugs through direct intervention. The editing process in the MMIS system consists of general data field verifications, such as ensuring the correct recipient number, correct provider number, required fields are complete, and that fields are in appropriate format (numeric vs. alpha). Next, claims are edited for eligibility to ensure the provider is an eligible provider, the provider has a current contract and license, and the provider is authorized to bill for the type of service for which the claim is being submitted. In addition, recipient eligibility is checked to ensure the recipient is eligible for the service being billed. The claims auditing process involves performing checks against historical claims data. The audit process verifies such things as ensuring the procedure is not a once-in-a-lifetime procedure that has been claimed before (for example, appendix removal), drug utilization (for example, received a 30-day supply of a drug and are submitting a claim for another prescription only 15 days later), and determines only the authorized units have been used by the recipient for claims which require prior authorization. Based on a medical professional’s review of 113 medical claims initiated by the provider for Children’s Health Insurance Program (CHIP) recipients, we noted the following: • Three claims out of 113 (2.65%) had payment errors totaling $1,477, of which $1,146 ($1,051 x the applicable Federal Medical Assistance Percentage (FMAP) rate (77.27% for QE 3/31/24 and $426 x the applicable Federal Medical Assistance Percentage (FMAP) rate (78.32% for QE 12/31/23) is the federal questioned costs. o One claim was unsupported by medical records. o One claim was for an evaluation that lacked supporting documentation for the start/stop time. o One claim was for services performed by a provider not contracted as a Medicaid provider. • Two claims had documentation errors. One claim had a progress note in the medical records that was not signed by the rendering provider. The second was a DRG claim that billed for a beginning date of service that was prior to the doctor’s admission order. None of these claims resulted in an underpayment or overpayment. Based on a medical professional’s review of 17 medical claims manually paid by OHCA Finance for Children’s Health Insurance Program (CHIP) recipients, we noted the following: • One claim had a payment error totaling $1,100, of which $850 ($1,100 x the applicable Federal Medical Assistance Percentage (FMAP) rate (77.27% for QE 6/30/24) is the federal questioned costs. • One claim had a documentation error. The dates of service were entered incorrectly, resulting in 16 days instead of the correct 15 days. This claim did not result in an underpayment or overpayment. Cause: Providers submitted claims through the MMIS that did not meet CHIP program requirements. In addition, since support for provider claims is not scanned in the system, the only way these exceptions are detected is through audits or reviews. Effect: The Oklahoma Health Care Authority (OHCA) may be paying for services that were not properly supported by medical records. Recommendation: We recommend the Authority strengthen its claims processing system to ensure CHIP claims are meeting program requirements. Criteria: 45 CFR § 75.403 Factors affecting allowability of costs states in part, “Costs must…(a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles, and (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items, and (g) Be adequately documented.” Management Response Contact Person: Kristin Edwards, OHCA Senior Director of Program Integrity and Accountability, James Keethler, OHCA Director Data Analytics & Payment Accuracy Anticipated Completion Date: September 30, 2026 Corrective Action Planned: The Oklahoma Health Care Authority agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report

FINDING NO: 2024-005 (Repeat 2023-037) Strengthen Internal Controls Over Eligibility Determination STATE AGENCY: Oklahoma Health Care Authority (the Authority) FEDERAL AGENCY: United States Department of Health and Human Services ALN: 93.767; 93.778 FEDERAL PROGRAM NAME: Children’s Health Insurance Program; Medicaid Cluster FEDERAL AWARD NUMBER: 2305OK5021 and 2405OK5021; 2305OK5MAP and 2405OK5MAP FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Activities Allowed or Unallowed and Allowable Costs/Cost Principles; Eligibility QUESTIONED COSTS: $0 Condition and Context: Medicaid MAGI (Modified Adjusted Gross Income) and CHIP MAGI eligibility are determined using the same methodology. The Authority’s on-line enrollment system is the digital application process for Oklahoma's Medicaid program (SoonerCare) and related managed care plans. Individuals use the portal to apply for, renew, or manage benefits. The on-line enrollment system was developed by Gainwell Technologies, the contracted vendor who manages the Medicaid Management Information System (MMIS), as a subsystem in the MMIS system; however, the Authority internally developed the rules engine and is responsible for maintaining the rules engine. The rules engine sets the parameters for eligibility in the system and enables eligibility to be defined, tested, executed, and maintained separately from the application code. To ensure the rules engine is operating properly, the Authority tests the rules engine two separate ways. Regression testing is performed by running a set of criteria through the rules engine to ensure it is functioning as expected. This is performed prior to the testing phase. End to end testing is performed when a new rule is deployed to ensure not only that the application deploys the new rule correctly, but that the application runs properly as a whole. We tested a non-statistical sample of 72 Medicaid MAGI beneficiaries for Medicaid eligibility requirements using the documentation in the Authority’s eligibility case records. The universe included 1,274,922 Medicaid MAGI beneficiaries with 18,529,740 medical claims and 16,852,479 capitation payments totaling $5,550,067,881. We sampled one medical claim or capitation payment tied to a specific date of service per beneficiary tested and we tested whether the member’s eligibility renewal was completed within 14 months of the beginning of OHCA/OKDHS’s unwinding plan. Tested medical claims and capitation payments for sampled beneficiaries totaled $20,078. • For one (1.39%) of 72 cases tested, the member’s household income was calculated incorrectly due to a system error that did not recognize the parent/child relationship. The exception did not result in any questioned costs. Additionally, during our initial review of the design and implementation of the Authority’s internal controls, we noted one case with unverified income previously reported by the applicant that was erroneously removed from the case by a workorder designed to remove old income that has not been recently matched by the OESC data exchange. This workorder should only remove income that has previously matched through OESC but no longer matches. The exception did not result in any questioned costs. We tested a non-statistical sample of 72 Medicaid Non-MAGI beneficiaries for Medicaid eligibility requirements using the documentation in the Authority’s eligibility case records. The universe included 191,972 Medicaid Non- MAGI beneficiaries with 9,887,245 medical claims and 2,162,549 capitation payments totaling $2,982,306,837. We sampled one medical claim or capitation payment tied to a specific date of service per beneficiary tested and we tested whether the member’s eligibility renewal was completed within 14 months of the beginning of OHCA/OKDHS’s unwinding plan. Tested medical claims and capitation payments for sampled beneficiaries totaled $26,019. • For 52 (72.22%) of 72 cases tested, DHS failed to notify the beneficiaries of their most recent eligibility determination. We tested a non-statistical sample of 40 CHIP Non-MAGI (TEFRA) beneficiaries for Medicaid eligibility requirements using the documentation in the Authority’s eligibility case records. The universe included 266 CHIP Non-MAGI beneficiaries with 18,893 medical claims and 738 capitation payments totaling $7,661,709. We sampled one medical claim or capitation payment tied to a specific date of service per beneficiary tested and we tested whether the member’s eligibility renewal was completed within 14 months of the beginning of OHCA/OKDHS’s unwinding plan. Tested medical claims and capitation payments for sampled beneficiaries totaled $12,128. • For 17 (42.50%) of 40 cases tested, DHS failed to notify the beneficiaries of their most recent eligibility determination. • For 2 (5.00%) of 40 cases tested, the Member did not receive a proper renewal before the end of the PHE unwinding period. The exceptions did not result in any questioned costs. Cause: The Authority’s processes implemented to ensure MAP and CHIP MAGI and MAP Non-MAGI eligibility renewals were completed within 14 months of the beginning of OHCA/OKDHS’s unwinding plan were largely effective. However, the Authority lacked adequate procedures to ensure the system accurately recognizes all parent/child relationships and all workorders are designed appropriately. Also, the Authority lacked adequate internal controls over the CHIP Non-MAGI eligibility determinations to ensure a proper renewal was performed before the end of the PHE unwinding period for all cases. The Authority did not complete system changes to ensure beneficiaries are appropriately notified of their most recent eligibility determination during the audit period. Effect: The Authority’s methodology does not comply with state and federal regulations and the Authority may be paying for services for which the recipient is not entitled. Recommendation: We recommend the Authority continue to strengthen its internal controls over eligibility determinations. We also recommend the Authority ensure adequate system changes are implemented and workorders are designed appropriately. Criteria: 45 CFR §75.303 states, “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 42 CFR §435.900 through .965 (Subpart J) describes the federal regulations applicable to Medicaid eligibility. The specific federal regulations applicable to this finding are listed below. • 42 CFR §435.916 (a)(2) • 42 CFR §435.916 (c) • 42 CFR §435.916 (d)(1) and (2) • 42 CFR §435.916 (e) • 42 CFR §435.945 (b) • 42 CFR §435.948 (a) and (b) (c) • 42 CFR §435.952 (a) and (c)(2) Oklahoma Administrative Code (OAC) 317:35 contains the State’s administrative code applicable to Medicaid eligibility. The specific OAC sections applicable to this finding are listed below. • OAC 317:35-6-60.1 (c) • OAC 317:35-10-26 Additionally, a component objective of generally accepted accounting principles is to provide accurate and reliable information. Management Response Contact Person: Chris Dees, Eligibility and Coverage Services Technical Director; April Anonsen, Deputy State Medicaid Director; Aubrey McDonald, OKDHS Medicaid Program Administrator; Tana Parrott, OHCA Director of Member Audits, Kristin Edwards OHCA Senior Director of Program & Accountability Anticipated Completion Date: August 1, 2026 Corrective Action Planned: The Oklahoma Health Care Authority agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-006 (Partial Repeat #2023-030) Strengthen Controls over Monitoring Fraud Related Overpayments STATE AGENCY: Oklahoma Health Care Authority (the Authority) FEDERAL AGENCY: United States Department of Health and Human Services ALN: 93.778 FEDERAL PROGRAM NAME: Medicaid Cluster (MAP) FEDERAL AWARD NUMBER: 2305OK5MAP and 2405OK5MAP FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Special Tests and Provisions – Medicaid Fraud Control Unit (MFCU) Condition and Context: The Authority is required to refund the federal share of Medicaid and CHIP overpayments made to providers and report such overpayments to CMS. Overpayments are either self-disclosed by providers or identified during the audit process by Program Integrity (PI) through Provider Audits. They are also identified by the Medicaid fraud control unit (MFCU) and the Office of Attorney General if the overpayments are a result of fraud. Once an overpayment is discovered, Authority will have one year from the date of discovery to recover or attempt to recover the overpayment from the provider before the federal share must be refunded to CMS. The refunded overpayment is reported to CMS via Form CMS-64 Summary regardless of whether or not the overpayment was recovered from the provider. Based on review of the overpayment records, it appears the Authority only reports MFCU overpayments when they receive notice of actual collections from MFCU, instead of monitoring the fraud related cases to ensure they are refunded to CMS within 1 year of discovery (Final Written Notice) or, if no final determination of the amount of the overpayment has been made within 1 year of discovery, within 30 days after the date on which a final judgment (including, if applicable, a final determination on an appeal) is made. Because complete data was not available to identify overpayments that have not been reported at 6/30/2024, and interest on those not reported timely, SAI was unable to calculate possible questioned costs. In addition, the Authority did not identify and track the status of MAP overpayments referred to and adjudicated by the MFCU during the audit period. Cause: The Authority did not establish adequate policies and procedures to track the status of fraud related cases reported to the MFCU during the audit period. The Authority’s staff did not have an effective system in place to properly monitor MAP overpayments to ensure they are properly reported on the CMS 64 during the audit period. Effect: MAP overpayments were not reported in compliance with 42 CFR § 433.316. Also, when refunding overpayments past the allowable period as indicated in 42 CFR § 433.320(a)(2), the Authority could be liable for interest as outlined at 42 CFR § 433.320(a)(4). Recommendation: The Authority has already developed a Corrective Action Plan in response to a prior year finding which they began implementing in September of 2024. We recommend the Authority continue to implement their Corrective Action Plan processes which include collaborating with the Medicaid Fraud Control Unit at the Oklahoma Attorney General’s office quarterly to track the status of closed cases, obtain sufficient supporting documentation, and timely report and refund identified overpayments on the CMS-64. Criteria: 45 CFR §75.303 states, “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 42 CFR § 455.21 Cooperation with State Medicaid fraud control units, states in part, “In a State with a Medicaid fraud control unit established and certified under subpart C of this part…(c) The agency must enter into a written agreement with the unit under which:… (3) The agency and the unit will agree to—(i) Establish a practice of regular meetings or communication between the two entities; (ii) Establish procedures for how they will coordinate their efforts;…” SFY 24 Compliance Supplement, ALN #93.778, Section 4, Part N6 Audit Objective states in part, “Determine whether the state has established and implemented procedures to: (1) identify suspected fraud cases; (2) investigated these cases; and (3) referred credible allegations of fraud cases to the MFCU, …and to ensure that the state accurately reports overpayment recoveries resulting from MFCU activities on the CMS-64 in accordance with sections 1903(d)(2)(C) and (D) of the Act. 42 CFR § 433.300 Basis states in part, “This subpart implements - … (b) Section 1903(d)(2)(C) and (D) of the Act, which provides that a State has 1 year from discovery of an overpayment for Medicaid services to recover or attempt to recover the overpayment from the provider before adjustment in the Federal Medicaid payment to the State is made; and that adjustment will be made at the end of the 1-year period, whether or not recovery is made, unless the State is unable to recover from a provider because the overpayment is a debt that has been discharged in bankruptcy or is otherwise uncollectable.” 42 CFR § 433.304 Definitions states, “Discovery (or discovered) means identification by any State Medicaid agency official or other State official, the Federal Government, or the provider of an overpayment, and the communication of that overpayment finding or the initiation of a formal recoupment action without notice as described in § 433.316.” 42 CFR § 433.304 Definitions states, “Final written notice means that written communication, immediately preceding the first level of formal administrative or judicial proceedings, from a Medicaid agency official or other State official that notifies the provider of the State's overpayment determination and allows the provider to contest that determination, or that notifies the State Medicaid agency of the filing of a civil or criminal action.” 42 CFR § 433.312 Basic Requirements for Refunds states in part, “(a) Basic rules. (1) … the State Medicaid agency has 1 year from the date of discovery of an overpayment to a provider to recover or seek to recover the overpayment before the Federal share must be refunded to CMS. (2) The State Medicaid agency must refund the Federal share of overpayments at the end of the 1-year period following discovery in accordance with the requirements of this subpart, whether or not the State has recovered the overpayment from the provider. 42 CFR § 433.316(a) General rule states, “The date on which an overpayment is discovered is the beginning date of the 1-year period allowed for a State to recover or seek to recover an overpayment before a refund of the Federal share of an overpayment must be made to CMS.” 42 CFR § 433.316(b) Requirements for notification states, “Unless a State official or fiscal agent of the State chooses to initiate a formal recoupment action against a provider without first giving written notification of its intent, a State Medicaid agency official or other State official must notify the provider in writing of any overpayment it discovers in accordance with State agency policies and procedures and must take reasonable actions to attempt to recover the overpayment in accordance with State law and procedures.” 42 CFR § 433.316(d) Overpayments resulting from fraud states, (1) An overpayment that results from fraud is discovered on the date of the final written notice (as defined in § 433.304 of this subchapter) of the State's overpayment determination.” (2) When the State is unable to recover a debt which represents an overpayment (or any portion thereof) resulting from fraud within 1 year of discovery because no final determination of the amount of the overpayment has been made under an administrative or judicial process (as applicable), including as a result of a judgment being under appeal, no adjustment shall be made in the Federal payment to such State on account of such overpayment (or any portion thereof) until 30 days after the date on which a final judgment (including, if applicable, a final determination on an appeal) is made. 42 CFR § 433.316(h) Effect of administrative or judicial appeals states, “Any appeal rights extended to a provider do not extend the date of discovery.” 42 CFR § 433.320 Procedures for Refunds to CMS states, “(a) Basic Requirements. (1) The agency must refund the Federal share of overpayments that are subject to recovery to CMS through a credit on its Quarterly Statement of Expenditures (Form CMS-64). (2) The agency must credit CMS with the Federal share of overpayments subject to recovery on the earlier of - (i) The Form CMS-64 submission due to CMS for the quarter in which the State recovers the overpayment from the provider; or (ii) The Form CMS-64 due to CMS for the quarter in which the 1-year period following discovery, established in accordance with § 433.316, ends. (3) A credit on the Form CMS-64 must be made whether or not the overpayment has been recovered by the State from the provider. (4) If the State does not refund the Federal share of such overpayment as indicated in paragraph (a)(2) of this section, the State will be liable for interest on the amount equal to the Federal share of the non-recovered, nonrefunded overpayment amount. Interest during this period will be at the Current Value of Funds Rate (CVFR), and will accrue beginning on the day after the end of the 1-year period following discovery until the last day of the quarter for which the State submits a CMS-64 report refunding the Federal share of the overpayment.” Management Response Contact Person: Kristin Edwards OHCA Senior Director of Program and Integrity Anticipated Completion Date: Review at end of State Fiscal Year (SFY) 2025 Corrective Action Planned: The Oklahoma Health Care Authority agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-042 (Partial Repeat 2023-008 & 2023-009) Strengthen Internal Controls Over Review and Approval of the Schedule of Expenditures of Federal Awards (SEFA) STATE AGENCY: Oklahoma Health Care Authority (the Authority) FEDERAL AGENCY: United States Department of Health and Human Services ALN: 93.767; 93.778 FEDERAL PROGRAM NAME: Children’s Health Insurance Program; Medicaid Cluster FEDERAL AWARD NUMBER: 2305OK5021 and 2405OK5021; 2305OK5MAP and 2405OK5MAP FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Reporting QUESTIONED COSTS: $0 Condition and Context: The SEFA is required by the Office of Management and Enterprise Services (OMES) to be prepared according to instructions and forms which are contained in the GAAP Conversion Manual (OMES Form Z- 1). Based upon testwork performed on the GAAP Package Z – Schedule of Expenditures of Federal Awards, we noted the following: • The Medicaid Total Federal Expenditures were recorded at $6,768,237,101. However, based on a recording error, the Medicaid Total Federal Expenditures amount should have been $6,774,069,774. • The CHIP (Covid) Total Federal Expenditures were recorded at ($595,297). However, based on a recording error, the CHIP (Covid) Total Federal Expenditures amount should have been ($844,885). • The CHIP Total Federal Expenditures were recorded at $248,368,556. However, based on a calculation error, the CHIP Total Federal Expenditures amount should have been $239,977,890. Cause: We noted the following: • The Medicaid Total Federal Expenditures were incorrectly calculated on the “CAFR Package Z Federal Expenditures” worksheet to the GAAP Package Z. The variance occurred because the administrative portion of the Medicaid Total Federal Expenditures for the Q.E. 6/30/24 inadvertently included an amount from the prior year instead of the current year figure. • The CHIP (Covid) Total Federal Expenditures were incorrectly calculated on the “Package Z Fed Exp Rev Admin” worksheet to the GAAP Package Z. The variance occurred because the Soon-to-be-Sooners portion of the CHIP (Covid) Total Federal Expenditures for the Q.E. 12/31/23 was updated on a supporting worksheet but not carried forward to the SEFA. • The CHIP Total Federal Expenditures were incorrectly calculated on the “64.21 Totals” worksheet to the GAAP Package Z. The variance occurred because the CHIP Net Expenditures for the Q.E. 03/31/24 & 06/30/24 were not reduced by the 64.21 “Line 4 collections”. Effect: The errors on the GAAP Package Z resulted in Medicaid Total Federal Expenditures being understated by $5,832,673, CHIP (Covid) Total Federal Expenditures being overstated by $249,588 and CHIP Total Federal Expenditures being overstated by $8,390,666. Recommendation: We recommend the Authority strengthen its SEFA review and approval process to ensure the accuracy of data reported for GAAP Package Z. Criteria: 2 CFR §200.510(b) states, “The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended…” A basic objective of Generally Accepted Accounting Principles is to provide accurate and reliable information. A component objective of an effective internal control system is to ensure accurate and reliable information through a proper review and approval process. Management Response Contact Person: Calvin Cole, OHCA Director Financial Accountability & Compliance, Susan Crooke, OHCA Senior Director Accountability & Compliance Anticipated Completion Date: December 31, 2026 Corrective Action Planned: The Oklahoma Health Care Authority agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-084 (Repeat 2023-071) Strengthen Internal Controls Over the G1DX Exception Resolution Process STATE AGENCY: Oklahoma Department of Human Services (OKDHS) FEDERAL AGENCY: Department of Health and Human Services (HHS) ALN: 93.778 FEDERAL PROGRAM NAME: Medicaid Cluster FEDERAL AWARD NUMBER: 2305OK5MAP and 2405OK5MAP FEDERAL AWARD YEAR: 2023 and 2024 CONTROL CATEGORY: Eligibility QUESTIONED COSTS: $0 Condition and Context: The G1DX System is an OKDHS application that compares client information entered by a OKDHS employee and OKDHS IEVS information sources as they are periodically updated. These sources include: • Wage information for the State Wage Information Collection Agency (SWICA) • Unemployment Compensation (UC) • All available information from the Social Security Administration (SSA) • Information from the U.S. Citizenship and Immigration Services • Unearned Income from the Internal Revenue Services (IRS) The purpose of the GIDX Exception and Clearance Report is to report discrepancies detected between agency data and external data sources and then notify staff to promptly address discrepancies so that case information remains accurate, reliable, and compliant with federal program requirements. The Exception and Clearance Report summarizes these discrepancies by worker, supervisor, county, and area, which allows management to monitor not only the type of discrepancy and length of days outstanding, but also to distinguish who is responsible for clearing the discrepancy within the 45 days allowed under current federal regulation and OKDHS policy. We reviewed the state fiscal year (SFY) 2024 (July 1, 2023 – June 30, 2024) G1DX Exception and Clearance Reports to determine whether data exchange discrepancy (exception) messages were resolved within the required 45 calendar days from the date the message was posted on the data exchange inquiry screen. Because the system used to compile the discrepancy messages does not distinguish messages by individual program, our review was conducted at the error type level rather than by program. Therefore, the discrepancies listed below represent a combined set of issues across multiple programs and may not apply to each program individually. Our review determined that 280,897 of the total 590,942 exceptions, or 47.53%, were not resolved within the required 45 calendar day period. The schedule below outlines the specific exceptions by error type and their corresponding delays ERROR TYPE OPEN & RESOLVED G1DX EXCEPTIONS OVER 45 DAYS TOTAL OPEN & RESOLVED G1DX EXCEPTIONS % OF EXCEPTIONS OVER 45 DAYS BEN 29,366 82,923 35.41% CSE 3,027 4,633 65.34% DOD 34 88 38.64% ENU 17,800 22,945 77.58% IEV 4,407 13,452 32.76% NNH 92,641 179,866 51.51% OWG 49,626 91,048 54.51% PRS 2,446 4,364 56.05% SDX 32,681 97,589 33.49% SNH 44,862 84,069 53.36% UIB 4,007 9,965 40.21% TOTAL 280,897 590,942 47.53% Cause: The OKDHS G1DX exception clearing process in place did not provide a sufficient internal control structure to enable management to effectively monitor the status of G1DX discrepancy resolutions and ensure adequate staffing for timely processing. Because the current controls do not provide accountability or oversight, OKDHS failed to ensure that discrepancies were resolved within the required 45 days. Effect: The untimely resolution of discrepancies not only elevates the risk of program benefits being provided to ineligible individuals, but also elevates the risk of delayed benefits to eligible individuals, Recommendation: We recommend OKDHS enhance its monitoring activities by timely reviewing Exception and Clearance reports created for the G1DX discrepancies, ensuring adequate staff have effective tools and training to timely clear the exception, and holding all responsible individuals accountable. Additionally, we recommend OKDHS establish and follow policies and procedures outlining how the monitoring reports should be used and by whom to ensure discrepancies are timely resolved within the required 45 days. Criteria: 2 CFR Part 200 (June 30, 2024), Appendix XI, Part 4 applicable to the Temporary Assistance for Needy Families program, requires each State to participate in the Income Eligibility and Verification System (IEVS) required by section 1137 of the Social Security Act, as amended. Under the state plan the state is required to coordinate data exchanges with other federally assisted benefit programs, request and use income and benefit information when making eligibility determinations and adhere to standardized formats and procedures in exchanging information with other programs and agencies. 45 CFR 205.56(a)(1)(iv) (June 30, 2024) states in part: “For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary… .” OAC 340:65-3-4(4)(C) states in part: “Automated data exchange with other agencies provides OKDHS with information regarding household members' benefits, wages, taxes, Social Security numbers, and current addresses. The system compares information obtained electronically with data stored within OKDHS electronic records to determine if there are discrepancies that need to be addressed. Automated data exchange information is also available within the OKDHS system to determine discrepancies. The worker is responsible for resolving data exchange discrepancy messages within 45-calendar days of the date the message is posted on the data exchange inquiry screen.” 45 CFR 75.303 (June 30, 2024) states: “The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Views of Responsible Official(s): Contact Person: Kayla Urtz, DHS Director of Internal Audit and Tana Parrott, OHCA Director of Member Audits Anticipated Completion Date:10/5/2026 and OHCA will continue monitoring through SFY2025 Corrective Action Planned: The Department of Human Services agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-093 Strengthen Internal Controls Over Period of Performance and Monitoring STATE AGENCY: Oklahoma Department of Emergency Management FEDERAL AGENCY: Department of Homeland Security - Federal Emergency Management Agency (FEMA) ALN: 97.036 FEDERAL PROGRAM NAME: Disaster Grants – Public Assistance (Presidentially Declared Disasters) FEDERAL AWARD NUMBER: 4222-PA, 4299-PA, 4315-PA, 4438-PA, 4453-PA, 4530-PA, 4575-PA, 4587-PA, 4706-PA, 4721-PA FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Period of Performance; and Subrecipient Monitoring QUESTIONED COSTS: $0 Condition and Context: While testing 30 of 139 SFY24 Public Assistance Large Projects we noted the following: • For 30 of 30 (100%) projects tested, OEM was unable to provide documentation to support that risk assessments were conducted for subrecipients during SFY24. While testing 36 of 202 SFY24 Public Assistance Small Projects we noted the following: • For 6 of 36 (16.67%) projects tested, the work completion date was not prior to the period of performance and no extension was received. Per discussion with management, small projects cannot request close out until all projects on the grant have been completed and the dates submitted as the completion date are often after the work was actually completed. While this is common due to the nature of the projects, OEM recognizes that the official work completion date is after the required deadline. • For 36 of 36 (100%) projects tested, OEM was unable to provide documentation to support that risk assessments were conducted for subrecipients during SFY24. In addition, upon further inquiry of OEM, we confirmed that 100% of the subrecipient population had not received risk assessments during SFY24. Cause: Inadequate controls over project closeouts allowed for projects to remain open past the period of performance without receiving proper time extensions. Further, adequate controls were not designed and implemented to ensure each subrecipient’s risk of noncompliance are evaluated to determine that appropriate monitoring was performed. We were initially unable to determine if any risk assessments were performed for SFY 2024 due to turnover and the lack of proper controls over subrecipient monitoring record retention. Effect: OEM did not appropriately monitor and access risk for all subrecipients to ensure compliance with Federal regulations for the subaward, increasing the risk of undetected noncompliance. Recommendation: We recommend OEM strengthen their internal controls pertaining to payment approval and period of performance to ensure all costs occur within the period of performance. We also recommend OEM review the procedures/internal controls pertaining to subrecipient monitoring to ensure all forms are properly signed indicating the subrecipient has received required information, as well as ensuring risk assessments are appropriately performed and documented. Criteria: 2 CFR §3002.10 - Adoption of 2 CFR Part 200 states in part, “the Department of Homeland Security adopts the Office of Management and Budget (OMB) Guidance in 2 CFR part 200. Thus, this part gives regulatory effect to the OMB guidance and supplements the guidance as needed for the Department.” 2 CFR §200.303 - Internal controls states in part, “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.332(c) – Requirements for pass-through entities states in part, “Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring … .” 2 CFR § 200.332(e) – Requirements for pass-through entities states in part, “Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” 2 CFR § 200.344(a) – Closeout states in part, “The Federal agency or pass-through entity must close out the Federal award when it determines that all administrative actions and required work of the Federal award have been completed.” (b) “A subrecipient must submit all reports (financial, performance, and other reports required by a subaward) to the pass-through entity no later than 90 calendar days after the conclusion of the period of performance of the subaward (or an earlier date as agreed upon by the pass-through entity and subrecipient). When justified, the Federal agency or pass-through entity may approve extensions for the recipient or subrecipient.” Management Response: The agency concurs with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-094 Strengthen Internal Controls Over SEFA Reporting STATE AGENCY: Oklahoma Department of Emergency Management FEDERAL AGENCY: Department of Homeland Security - Federal Emergency Management Agency (FEMA) ALN: 97.036 FEDERAL PROGRAM NAME: Disaster Grants – Public Assistance (Presidentially Declared Disasters) FEDERAL AWARD NUMBER: 4222-PA, 4299-PA, 4315-PA, 4438-PA, 4453-PA, 4530-PA, 4575-PA, 4587-PA, 4706-PA, 4721-PA, 4776-PA FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Reporting QUESTIONED COSTS: $0 Condition and Context: In auditing the GAAP Package Z – Schedule of Expenditures of Federal Awards (SEFA) for the Public Assistance (#97.036) grant for SFY 2024, we noted the following variances when reconciling to the data per the Statewide Accounting System (SAS): Category on SEFA Reported Total Total per SAS Federal Expenditures $89,489,594 $92,273,127 Federal Revenue $103,468,303 $92,451,686 Cause: The Agency Business Services (ABS) division within the Office of Management and Enterprise Services (OMES) prepared the SEFA, and OEM staff did not implement management review controls designed to ensure all required data elements were accurate and included on the SEFA. Additionally, OEM did not maintain supporting documentation for the revenues and expenditures reported on the SEFA and was unable to obtain the information from ABS during our audit. Effect: The amounts reported on OEM’s SFY 2024 SEFA for ALN 97.036 overstated Federal Revenue by $11,016,617 and understated Federal Expenditures by $2,783,533. Additionally, due to the lack of a detailed review of the SEFA performed by OEM, there is an insufficient level of assurance as to the accuracy of the SEFA, diminishing the reliability of the report and increasing the risk of material noncompliance. Recommendation: We recommend the OEM strengthen its management review controls to ensure GAAP Packages are accurately completed and reported to OMES, and that all supporting documentation is properly obtained and retained. We further recommend OEM assess and address training needs for staff responsible for reviewing the SEFA: staff should have a clear understanding of the SEFA reporting elements and how those requirements relate to the underlying expenditure or revenue data. Criteria: 2 CFR §3002.10 - Adoption of 2 CFR Part 200 States in part “the Department of Homeland Security adopts the Office of Management and Budget (OMB) Guidance in 2 CFR part 200. Thus, this part gives regulatory effect to the OMB guidance and supplements the guidance as needed for the Department.” 2 CFR §200.303 - Internal controls states in part, “The Non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR §200.502 (a) states, “Determining Federal awards expended. The determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs. Generally, the activity pertains to events that require the non-Federal entity to comply with Federal statutes, regulations, and the terms and conditions of Federal awards, such as: expenditure/expense transactions associated with awards including grants, cost reimbursement contracts under the FAR, compacts with Indian Tribes, cooperative agreements, and direct appropriations; the disbursement of funds to subrecipients; the use of loan proceeds under loan and loan guarantee programs; the receipt of property; the receipt of surplus property; the receipt or use of program income; the distribution or use of food commodities; the disbursement of amounts entitling the non-Federal entity to an interest subsidy; and the period when insurance is in force.” 2 CFR §200.510 (b) states, “Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements which must include the total Federal awards expended as determined in accordance with § 200.502. While not required, the auditee may choose to provide information requested by Federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may list the amount of Federal awards expended for each Federal award year separately. At a minimum, the schedule must: (1) List individual Federal programs by Federal agency. For a cluster of programs, provide the cluster name, list individual Federal programs within the cluster of programs, and provide the applicable Federal agency name. For R&D, total Federal awards expended must be shown either by individual Federal award or by Federal agency and major subdivision within the Federal agency. For example, the National Institutes of Health is a major subdivision in the Department of Health and Human Services. (2) For Federal awards received as a subrecipient, the name of the pass-through entity and identifying number assigned by the pass-through entity must be included. (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. For a cluster of programs also provide the total for the cluster. … (4) Include the total amount provided to subrecipients from each Federal program. (5) For loan or loan guarantee programs described in § 200.502(b), identify in the notes to the schedule the balances outstanding at the end of the audit period. This is in addition to including the total Federal awards expended for loan or loan guarantee programs in the schedule. (6) Include notes that describe that significant accounting policies used in preparing the schedule, and note whether or not the auditee elected to use the 10% de minimis cost rate as covered in § 200.414.” Management Response: The agency concurs with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-096 (repeat finding 2023-109) STATE AGENCY: State of Oklahoma and Office of Management and Enterprise Services FEDERAL AGENCY: Multiple ALN: Multiple FEDERAL PROGRAM NAME: Multiple FEDERAL AWARD NUMBER: Multiple FEDERAL AWARD YEAR: 2022, 2023, 2024 CONTROL CATEGORY: Procurement and Suspension and Debarment QUESTIONED COSTS: $0 Condition and Context: While performing federal compliance testing of all major programs for SFY2022 Single Audit, we were made aware that Office of Management and Enterprise Services (OMES) created a pilot program (starting in SFY 2019/2020) wherein vendors were put on Statewide Contract, thus no longer requiring them to competitively bid their services. These pilot programs are known as Rolling Request for Proposal (RFP) or Rolling Solicitations. In SFY2022, we noted certain non-IT Consulting Service (SW0133 Statewide Contracts) and Deliverable-Based IT Service (SW1050 Statewide Contracts) vendors were added to Statewide Contract pilot program and are now receiving federal funds through this process. In SFY2023, OMES added two additional Statewide Contract pilot programs: SW1025 Information Technology Staff Augmentation Services and SW0132 Non-IT Temporary Employment Services. Vendors under this contract category will also be receiving federal funding. Further, there were no written policies and procedures implemented by June 30, 2024 (SFY 2024), for any of the Statewide Contracting pilot programs (Rolling RFP’s) to describe how these contracts are to be executed to meet both federal and state law. Since there were no written policies and procedures, we were unable to determine how OMES conducted their evaluation process relevant to the scope of services and contract price, to ensure vendors are properly vetted. Lastly, OMES has provided no evidence to the State Legislature on how the Statewide Contract pilot programs have helped state procurement become more effective and efficient for the State of Oklahoma as required by law. As a result, the longer the pilot programs remain open without recommendations to the Legislature, entities on Statewide Contract pilot programs are allowed to charge what they feel are appropriate rates per their federal contracts, without any competitive or vetting process in place. Cause: The OMES does not have adequate controls in place, including policies and procedures, to ensure federal Rolling RFP’s contracts are properly executed. Effect: The OMES is not complying with 2 CFR § 200.317 Procurements by states since the agency has no policies and procedures in place for the Statewide Contracting pilot programs. As a result, federal contracts awarded under the Statewide Contracting pilot programs, do not appear to meet State of Oklahoma competitive bidding requirements. Also, contracts with vendors may not contain the applicable provisions required by 2 CFR § 200.327. Lastly, under the existing Statewide Contract pilot programs, OMES can receive increased federal contract fees because vendors are not compelled to charge reasonable rates per 2 CFR § 200.404. Recommendation: We recommend the OMES develop and implement policies and procedures for the Statewide Contract pilot programs (Rolling RFP’s) to ensure all federal contracts are properly executed. Further, we recommend OMES provide justification on how vendors/consultants put on the Statewide Contract pilot programs are exempt from competitive bidding requirements. Lastly, we recommend the OMES work in a timely manner to either bring the Statewide Contract pilot programs before the legislature to explain the benefits to the state and what should be written into law or eliminate the program. Criteria: 2 CFR § 200.317 Procurements by states, says in part, “When procuring property and services under a Federal award, a State must follow the same policies and procedures it uses for procurements from its non-Federal funds. The State will … ensure that every purchase order or other contract includes any clauses required by § 200.327. 2 CFR § 200.317 Contract Provisions states, “The recipient’s or subrecipient's contracts must contain the applicable provisions described in Appendix II of this part.” 2 CFR § 200.404 Reasonable costs, states in part, “A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person under the circumstances prevailing at the time the decision was made to incur the cost. The question of reasonableness is particularly important when the non-Federal entity is predominantly federally-funded. In determining reasonableness of a given cost, consideration must be given to … : (a) Whether the cost is of a type generally recognized as ordinary and necessary for the operation of the non-Federal entity or the proper and efficient performance of the Federal award. (b) The restraints or requirements imposed by such factors as: sound business practices; arm's-length bargaining; Federal, state, local, tribal, and other laws and regulations; and terms and conditions of the Federal award. (c) Market prices for comparable goods or services for the geographic area. (d) Whether the individuals concerned acted with prudence in the circumstances considering their responsibilities to the non-Federal entity, its employees, where applicable its students or membership, the public at large, and the Federal Government. (e) Whether the non-Federal entity significantly deviates from its established practices and policies regarding the incurrence of costs, which may unjustifiably increase the Federal award's cost.” 74 O.S. §85.5 Powers and Duties of State Purchasing Director, states in part, “H. 1. The State Purchasing Director may develop and test new contracting policies, procedures and innovations that hold potential for making state procurement more effective and efficient and identify, and make recommendations to the Legislature of, any appropriate changes in law. Such development and testing, proof of concept, pilot project or other similar test shall not be considered an acquisition subject to the Oklahoma Central Purchasing Act. 2. The State Purchasing Director is authorized to explore and investigate cost savings in energy, resource usage and maintenance contracts and to identify and negotiate contract solutions including, but not limited to, pilot projects to achieve cost savings for this state.” Views of Responsible Official(s) Contact Person: Amanda Otis Anticipated Completion Date: Ongoing Corrective Action Planned: The Office of Management Enterprise Services partially agrees with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-098 Strengthen Internal Controls over Excessive Defined Contributions (Pathfinder) Charged to Federal Grant STATE AGENCY: Oklahoma Department of Emergency Management (OEM) FEDERAL AGENCY: Federal Emergency Management Agency (FEMA) ALN: 97.036 FEDERAL PROGRAM NAME: Disaster Grants – Public Assistance (Presidentially Declared Disasters) FEDERAL AWARD NUMBER: 4222-PA, 4299-PA, 4315-PA, 4438-PA, 4453-PA, 4530-PA, 4575-PA, 4587-PA, 4706-PA, 4721-PA, 4776-PA FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed or Unallowed; and Allowable Costs/Cost Principles QUESTIONED COSTS: $14,242 Condition and Context: For employees in Oklahoma’s Pathfinder Defined Contribution (DC) retirement plan, the employer provides a defined contribution match based on the employee’s pay. When the employee’s work benefits Public Assistance or other grants, that portion of the employer match may appropriately be charged to the grant. Additionally, the employer is required to remit an extra amount to the retirement system so total employer contributions meet the standard rate. This extra amount cannot be charged to the grant and must be paid with state funds. During our review, we noted $146,777 was charged to account 513300 for Pathfinder DC costs. Of this amount, the agency recorded $132,535 in payroll corrections. The remaining $14,242 for Pathfinder was not corrected. Consequently, these costs are unallowable and will be reported as questioned costs. Cause: The OEM adjusted for all excess Pathfinder costs charged to employees on regular payroll; however, OEM did not have controls to detect and correct payroll entries for supplemental payroll employees. Effect: Unallowable personnel costs totaling $14,242 were charged to the Public Assistance grant, resulting in improper use of federal funds which are required to be refunded to the Federal agency. Recommendation: We recommend OEM strengthen its internal control system over payroll and cost allocation to ensure only allowable employer DC contributions are charged to federal grants. This should include: • Implementing clear procedures to identify and remove excess DC/Pathfinder charges from federal cost pools. • Reviewing account classifications (including Account 513300) to confirm compliance with federal requirements. • Training payroll and accounting staff on allowable personnel cost rules under 2 CFR Part 200. • Performing periodic reconciliations to verify DC charges billed to federal programs do not exceed the permitted employer contribution rate. Criteria: 2 CFR 200.403 (a) Factors affecting allowability of costs states, “Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles.” 2 CFR 200.431 (c) Compensation – fringe benefits states, . . . “Such benefits, must be allocated to Federal awards and all other activities in a manner consistent with the pattern of benefits attributable to the individuals or group(s) of employees whose salaries and wages are chargeable to such Federal awards and other activities, and charged as direct or indirect costs in accordance with the non-Federal entity's accounting practices.” A basic objective of Generally Accepted Accounting Principles is to provide accurate, reliable, and timely information. Management Response: The agency concurs with the finding. Please see the corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-014 (Repeat 2023-026) Strengthen Internal Controls Over Monitoring of Subrecipient Agreements and Expenditures STATE AGENCY: State of Oklahoma, Office of Management and Enterprise Services (OMES) FEDERAL AGENCY: US Department of Treasury ALN: 21.023 FEDERAL PROGRAM NAME: Emergency Rental Assistance (ERA 1 and ERA 2) FEDERAL AWARD NUMBER: ERA028 and ERAE0259 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Subrecipient Monitoring QUESTIONED COSTS: $0 Condition and Context: Oversight and management of the ERA program has been transferred at the beginning of SFY25 from the office of the Director of Budget, Policy and Gaming Compliance to the OMES Grant Management Office (OMES-GMO), which has staff with several years of grant experience. OMES-GMO recently hired additional staff, and the two staff members dedicated to the management of the ERA program have 20+ years of combined federal grant specific experience. The GMO implemented a multi-level system of internal controls for grant management and oversight that includes routine monitoring, desk review, and site visits for all projects and associated project/administrative expenditures to ensure allowability, accuracy, and assist in the detection of fraud. SAI began working on the SFY24 audit of the ERA program in the fall of 2025 and the OMES GMO actively facilitated all of our audit requests (to the extent the subrecipients would provide the requested information), worked to implement corrective action for all prior year audit findings and implemented oversight and monitoring activities over the remaining unexpended ERA grant funds. However, because these activities did not start until after the SFY24 audit period, most of the prior year audit findings remained uncorrected during the SFY24 audit period resulting in repeat findings. The following issues associated with monitoring occurred prior to the current OMES GMO assuming responsibility for the oversight of the State of Oklahoma ERA program. The State of Oklahoma entered into an agreement with a non-profit entity, Communities Foundation of Oklahoma (CFO), to administer the ERA program for the State of Oklahoma. SAI reviewed the agreement for this entity during our SFY 2021 audit and determined the agreement constituted a subrecipient relationship that would be subject to Part M Subrecipient Monitoring requirements, which was communicated to OMES in findings from the SFY 2021 audit sent to OMES 9/7/2022, The subrecipient expended $8,936,468 in Federal funds during State Fiscal Year (SFY) 2024; however, the Office of Management Enterprise Services (OMES) did not perform any subrecipient monitoring procedures; . OMES advanced program funds, totaling $343,173,664.69, to CFO during SFY 2021-SFY 2023 for which CFO did not submit any documentation to support program expenditures incurred. While OMES did obtain summary information related to rental and utility payments and housing stability payments made for reporting purposes, OMES did not request, obtain or review any support for administrative or program costs to ensure that the costs were attributable to providing financial assistance and housing stability services to eligible households. 1 See SEFA Footnote 10 explaining why the ERA program is not a major program for 2024. However, even though the program is not material based on State of Oklahoma expenditures, we noted Material Weaknesses and Significant Deficiencies in Internal Controls, Material Noncompliance, and Questioned Costs greater than $25,000 when auditing the subrecipient expenditures. Therefore, these deficiencies will be reported under non-major program classification. Until the end of FY2025, OMES did not have a process in place to review potential fraud identified by the subrecipients and ensure that the agency’s response was adequate. OMES also did not have a process to ensure subrecipients were adequately evaluated for the types of fraud that may occur or identifying fraud risk factors applicable to the ERA program. OMES was unable to provide documentation to support that a risk assessment was performed in which each subrecipient would have been verified to have maintained an active status in the SAM.gov system, and that subrecipients were not suspended or disbarred. Cause: OMES did not timely take corrective action to address prior year findings from the SFY 21 - SFY 23 audits. OMES did not timely take corrective action to require OMES personnel to obtain, review, approve, or maintain adequate supporting documentation for all subrecipient expenditures. The required corrective action would have included transferring administration of the ERA grant to the GMO office or other personnel with the experience and expertise to administer Federal grant funds before the majority of the ERA funds were expended by the subrecipient. Additionally, OMES subrecipient monitoring process lacked the strength and consistency to ensure subrecipients established and maintained effective internal control over the Federal award to provide reasonable assurance that the non-Federal entity was managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: Inadequate risk assessment procedures and the lack of appropriate monitoring resulted in non-compliance with award terms and mismanagement of award funds. Furthermore, noncompliance increases the risk of Federal claw backs, which impacts state dollars. OMES decisions to delay appropriate oversight of the ERA program and to delay implementation of adequate corrective action until after the majority of grant funds have been expended by a subrecipient increases the risk that funds may not be successfully recouped from the subrecipient and greatly increases the risk that the state taxpayers will be required to pay back accumulated questioned costs of over $23 million in unallowable costs. Subrecipient agreements were not maintained for the period of performance of the Federal award. As a result, Federal funds may not have been authorized, increasing the risk of improper use of Federal funds. Recommendation: We recommend that the OMES GMO continue implementing the corrective action plan established in FY 2025 to provide proper oversight and monitoring of ERA program expenditures. Criteria: 2 CFR § 200.303(a) states in part, “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” 2 CFR § 200.332 states in part, “All pass-through entities must: … b. evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring, which may include consideration of such factors as: 1. The subrecipient's prior experience with the same or similar subawards; 2. The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; 3. Whether the subrecipient has new personnel or new or substantially changed systems; and 4. The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). … d. Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: … 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. … f. Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in § 200.501.” 2 CFR § 200.334 states in part, “Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient.” 2 CFR § 200.337 states in part, “(a) Records of non-Federal entities. The Federal awarding agency, Inspectors General, the Comptroller General of the United States, and the pass-through entity, or any of their authorized representatives, must have the right of access to any documents, papers, or other records of the non-Federal entity which are pertinent to the Federal award, in order to make audits, examinations, excerpts, and transcripts. The right also includes timely and reasonable access to the non-Federal entity's personnel for the purpose of interview and discussion related to such documents.” U.S Department of the Treasury Emergency Rental Assistance Grantee Award Form (8) (a-b) Compliance with Applicable Law and Regulations, states in part, a. “Recipient agrees to comply with the requirements of Section 501 and Treasury interpretive guidance regarding such requirements. Recipient also agrees to comply with all other applicable federal statutes, regulations, and executive orders, and Recipient shall provide for such compliance in any agreements it enters into with other parties relating to this award. b. Federal regulations applicable to this award include, without limitation, the following: i. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 2 C.F.R. Part 200, other than such provisions as Treasury may determine are inapplicable to this Award and subject to such exceptions as may be otherwise provided by Treasury. Subpart F -Audit Requirements of the Uniform Guidance, implementing the Single Audit Act, shall apply to this award… iii. Reporting Subaward and Executive Compensation Information, 2 C.F.R. Part 170, pursuant to which the award term set forth in Appendix A to 2 C.F.R. Part 170 is hereby incorporated by reference.” The US Department of Treasury Emergency Rental Assistance (ERA) FAQ #31 states in part “Grantees should require recipients of funds under ERA programs, including tenants and landlords, to commit in writing to use ERA assistance only for the intended purpose before issuing a payment. Grantees are not required to obtain documentation evidencing the use of ERA program funds by tenants and landlords. Grantees are expected to apply reasonable fraud-prevention procedures and to investigate and address potential instances of fraud or the misuse of funds that they become aware of.” Management Response Contact Person: Brandy Manek, OMES Director of Budget, Policy & Gaming Compliance Anticipated Completion Date: Completed Corrective Action Planned: The Oklahoma Office of Management and Enterprise Services (OMES) partially concurs with the finding. See corrective action plan located in the corrective action plan section of this report. Auditor’s Response: With regard to the assertion that the State “could not take corrective action prior to the FY2024 audit began”, we respectfully disagree per the following reasons: As a recipient of the Federal ERA award, the State of Oklahoma is responsible for understanding the terms and conditions of the award and to ensure the ERA award is administered in accordance with federal regulations, which includes subrecipient monitoring activities. In May of 2021, the State first received Coronavirus Relief Fund (CRF) Audit Finding # 2020-083 related to the State’s lack of subrecipient monitoring activities and Audit Finding # 2020-081 related to the State’s failure to obtain adequate supporting documentation for subrecipient expenditures prior to paying for goods and services. The same individual served as the State’s audit contact for both the CRF award and the ERA award and, therefore, the State could have begun implementing required subrecipient monitoring activities and ensuring adequate supporting documentation was obtained from the subrecipient in May of 2021. Although the SFY 2021 Single Audit Report was not actually released until June 2023, the SFY 2021 Single Audit Report was originally scheduled for publication near the end of September of 2022, and, on September 6, 2022, SA & I provided OMES Audit Finding # 2021-081 which included the following subrecipient monitoring issues SA & I had identified as of that date: “OMES entered into agreements with two non-profit entities to administer the ERA program for the State of Oklahoma: Communities Foundation of Oklahoma (CFO) and Restore Hope Ministries (RHM). SAI reviewed the agreements for these two entities and determined that both agreements constituted a subrecipient relationship that would be subject to Part M Subrecipient Monitoring requirements. We noted that OMES failed to perform any required subrecipient monitoring activities, specifically: • OMES did not provide the subrecipients with appropriate documentation to identify the required Federal award identification information per 2 CFR section 200.331(a)(1). • OMES did not perform a risk assessment that met the compliance requirements. The risk assessment performed did not include any assessment of the risks related to the payments made by the subrecipient for rental, utility, and administrative payments, and it was not designed to identify transactions or types of payments at higher risk and then identify additional monitoring procedures to address those risks. • OMES did not perform any during the award monitoring activities with regard to the rental and utility applications, housing stability and payments approved and paid by the subrecipients, or the administrative expenditures actually incurred by the subrecipients. OMES provided subrecipients advance payments based off expected program rental and utility expenditures for the month and then paid administrative costs on a set percentage of program funds advanced. OMES did not review any supporting documentation related to actual program expenditures for rental and utility assistance, housing stability activities, or administrative expenditures actually incurred by the subrecipients. While OMES did obtain summary information related to rental and utility payments and housing stability payments made for reporting purposes, OMES did not review any actual administrative expenditures to ensure that the administrative costs were attributable to providing financial assistance and housing stability services to eligible households. • OMES provided in excess of $750,000 in Federal funds to both CFO and RHM during SFY 2021; however, OMES did not have a process for identifying and tracking the total amount of federal funds received by subrecipients and notifying the subrecipients of the Single Audit requirements and date the audit would be due. • OMES did not obtain any financial records and supporting documents from the subrecipients that would support the actual expenditures incurred by the subrecipients.” Given the State first received similar findings for the SFY 2020 CRF award in May of 2021 (12 months before the start of SFY 2023 and 24 months before the start of SFY 2024), the State did have sufficient and timely notice to make full corrective actions prior to this SFY 2024 audit and even prior to the SFY 2023 audit. It is the position of our office that the State could have greatly reduced the amount of ERA questioned costs incurred over the past few years if the State had not waited about three and a half years (May 2021 to January 2025) from when SA & I first provided applicable findings to start implementing corrective action.

FINDING NO: 2024-020 (Partial Repeat 2023-092, 2022-028) Develop and Implement Internal Controls Over Reporting Requirements STATE AGENCY: State of Oklahoma, Office of Management and Enterprise Services (OMES) FEDERAL AGENCY: US Department of Treasury ALN: 21.023 FEDERAL PROGRAM NAME: Emergency Rental Assistance FEDERAL AWARD NUMBER: ERAE0259 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Reporting QUESTIONED COSTS: $0 Condition and Context: During the prior year audit periods we noted that the State considers amounts expended as soon as they have left the State's coffers and have been distributed to the subrecipients rather than reporting actual expenditures for program assistance. However, according to Treasury guidance, funds will not be considered obligated based solely on the fact they are subject to an agreement that provides for another entity to administer assistance on the Grantee's behalf, and actual amounts expended for rent and utility assistance, administrative costs and housing stability costs must be reported each quarter. During the SFY24 audit period, no ERA 1 Quarterly Reports were due and four ERA 2 Quarterly Reports were due and submitted. The ERA 2 Quarterly reports include cumulative expenditures and current period expenditures. In order to determine if the actual expenditures were appropriately included in the ERA 2 reports submitted during the current audit period, we compared the cumulative amounts reported on the ERA 2 Quarterly reports to the underlying expenditure data and noted the following: • Quarterly Report for period ending 6/30/2023 (due July 17, 2023) : The State reported 100% ($168,458,520) of ERA 2 funds as expended, $0 in current period expenditures showing a cash balance of $0; however, the underlying expenditure data shows $147,808,373 in cumulative expenditures, $3,643,241 in current period expenditures, and a cash balance of $20,650,147 which results in a material variance of 13.97% ([$168,458,520 - $147,808,373] /$147,808,373 = 13.97%). • Quarterly Report for period ending 9/30/2023 (due Oct 16, 2023) : The State reported 100% ($168,458,520) of ERA 2 funds as expended, $0 in current period expenditures showing a cash balance of $0, however, the underlying expenditure data shows $150,976,869 in cumulative expenditures, $3,168,496 in current period expenditures and a cash balance of $17,481,651 which results in a material variance of 11.58% ([$168,458,520 - $150,976,869]/ $150,976,869 = 11.58%). • Quarterly Report for period ending 12/31/2023 (due Jan 15, 2024): The State reported cumulative expenditures of $154,961,559, -$13,496,960 in current period expenditures and reported a cash balance of $13,496,960. The underlying expenditure data shows $153,465,932 in cumulative expenditures, $2,489,063 in current period expenditures and a cash balance of $14,992,588 which results in an immaterial variance of 0.97% ([$154,961,559 - $153,465,932]/ $153,465,932 = 0.97%). • Quarterly Report for period ending 3/31/2024 (due Apr 15, 2024): The State reported cumulative expenditures of $154,067,719, -$893,840 in current period expenditures and reported a cash balance of $14,390,800. The underlying expenditure data shows $154,151,421 in cumulative expenditures, $685,489 in current period expenditures and a cash balance of $14,307,099 which results in an immaterial variance of - 0.05% ([$154,067,719-154,151,421]/$154,151,421 = -0.05%). Based on our review, it appears that the State did not report actual cumulative and current expenditures for the first two ERA 2 Quarterly reports submitted during the audit period. The State did adjust the report for the period ending 12/31/2023 to materially reflect actual cumulative and current expenditures and the report for the period ending 3/31/2024 appears to be materially correct. During our review of the State of Oklahoma state fiscal year 2024 Schedule of Expenditures of Federal Awards (SEFA), we observed AL #21.023 (ERA) was omitted from the report. However, one subrecipient returned $126,626 which should have been reported as revenue on the SEFA. Cause: OMES did not timely take corrective action to address prior year findings from the SFY 21 - SFY 23 audits. OMES did not timely take corrective action to ensure quarterly reports were completed accurately and amounts reported agree to the underlying expenditure transactions. The required corrective action would have included transferring administration of the ERA grant to the GMO office or other personnel with the experience and expertise to administer Federal grant funds before the majority of the ERA funds were expended by the subrecipient. During the audit period, OMES fully relied on the subrecipients to administer the program and meet reporting requirements with little guidance. Effect: OMES is at risk for inaccurate and/or incomplete reporting to Treasury, which prevents OMES from demonstrating the completeness and accuracy of subaward activity, and may impair oversight and monitoring of subrecipient expenditures. The State of Oklahoma under-reported revenue by $126,626 on the SFY24 SEFA. Recommendation: SAI acknowledges that beginning in FY25, oversight of the ERA program was transferred to the Grants Management Office (GMO). The GMO has two staff members on the team with 20+ years of combined federal grant specific experience. The GMO entered into a subrecipient agreement that does not expire to monitor CFO’s duties and processes. GMO also required CFO to return the remaining ERA 2 program funds to ensure that proper oversight and review of ERA expenditures is performed. The GMO has implemented a multi-level system of internal controls for grant management and oversight that includes routine monitoring, desk review, and site visits for all projects and associated project/administrative expenditures to ensure allowability, accuracy, and assist in the detection of fraud. For the ERA Program, OMES-GMO conducts biweekly monitoring meetings with CFO and is currently reviewing documentation provided by CFO to ensure all current ERA projects are eligible under the ERA guidelines and that CFO is exercising the proper oversight over their subrecipients; therefore, we recommend that the OMES GMO continue implementing the corrective action plan established in FY 2025 to provide proper oversight and monitoring of ERA program expenditures. We recommend OMES continue to implement policies and procedures to ensure reports contain the required information and are accurate. Criteria: 2 CFR § 200.502(a) states in part, “Determining Federal awards expended. The determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs.” 2 CFR § 200.510(b) states in part, “Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements. The schedule must include the total Federal awards expended as determined in accordance with §200.502.…” 1. (3) Provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available.” 2 CFR § 200.303 – Internal Controls states in part, “The Non-Federal entity must; (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” The US Department of Treasury Emergency Rental Assistance Reallocation Guidance (as of 9/6/2022) states, “Grantees are encouraged to partner with local nonprofit organizations and governmental agencies to expedite the obligation process and delivery of assistance to eligible households. However, Grantees may not use subrecipient agreements with these entities to avoid meeting the statutory obligation deadlines, and funds will not be considered obligated based solely on the fact they are subject to an agreement that provides for another entity to administer assistance on the Grantee’s behalf.” The US Department of Treasury Emergency Rental Assistance: Reporting Guidance states in part, “Total Dollar Amount of ERA Award Funds Approved (Obligated) to or for Participating Households in the Reporting Period Definition: The total dollar amount of the ERA award the ERA Recipient (and entities to which it has issued subawards or contract, as applicable) approved (obligated) for payment to participant households in the reporting period for rent; rental arrears; utility/home energy costs arrears; and other housing expenses in the reporting period.” Management Response Contact Person: Brandy Manek, OMES Director of Budget, Policy and Gaming Compliance Anticipated Completion Date: Completed Corrective Action Planned: The Oklahoma Office of Management and Enterprise Services (OMES) concurs with the finding. See corrective action plan located in the corrective action plan section of this report.

FINDING NO: 2024-024 (Repeat 2023-088; 2022-085) Strengthen Internal Controls Over Reviewing Administrative Claims STATE AGENCY: State of Oklahoma, Office of Management and Enterprise Services FEDERAL AGENCY: US Department of Treasury ALN: 21.023 FEDERAL PROGRAM NAME: Emergency Rental Assistance (ERA 1 and ERA 2) FEDERAL AWARD NUMBER: ERA028 and ERAE0259 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed/Unallowed and Allowable Costs/Cost Principles QUESTIONED COSTS: $1,080,309 Condition and Context: Administrative costs charged to the ERA 1 and ERA 2 grants must be attributable to providing financial assistance and housing stability services to eligible households and must be necessary and reasonable for the performance of the ERA 1 and ERA 2 Federal award and be allocable to the ERA 1 and ERA 2 Federal award. Also, any direct and indirect administrative costs in ERA1 or ERA2 must be allocated by the grantee to either the provision of financial assistance or the provision of housing stability services. To the extent administrative costs are not readily allocable to the provision of financial assistance or the provision of housing stability services, the grantee may assume an allocation of the relevant costs of 90 percent to financial assistance and 10 percent to housing stability services. In order to determine if the subrecipient Communities Foundation of Oklahoma (CFO)/Communities Cares Partners (CCP), only charged administrative costs to the ERA 1 and ERA 2 grants in compliance with the grant requirements described above, we performed the following procedures: Analysis of Program Expenditures and Administrative Cost Charged over the Period of Performance: We obtained the SFY24 transaction data for the ERA 1 and ERA 2 grants from CFO/CCP and identified the transactions coded to the ERA 1 and ERA 2 grant by 1) awardee (i.e., State of Oklahoma, Cleveland County, Oklahoma County, Oklahoma City); and 2) type of expenditure (i.e., rent and utility assistance payments, rent and utility assistance administrative expenditures, housing stability payments, housing stability administrative expenditures). We noted that the subrecipient had zero expenditures during SFY24 for actual rent and utility assistance, however, $1,845,942 (ERA 2) and $137 (ERA 1) in rent and utility assistance administrative costs were charged to the State of Oklahoma ERA awards. We also noted that the subrecipient had $6,908,183 (ERA 2) in housing stability payments during SFY24 and charged $155,252 in housing stability administrative expenditures to the State of Oklahoma ERA2 award. We also reviewed a timeline provided by CFO/CCP that outlined the activities the subrecipient was engaged in related to the ERA awards over the period of performance. Of note, CFO/CCP stopped accepting rent and utility assistance applications at the end of August 2022 and, by the end of December 2022, CFO/CCP stopped paying virtually all rent and utility assistance applicants and marked all remaining qualified applications in the Neighborly system as Unpaid - Funds Exhausted with the exception of a few Office of Refugee Resettlement (ORR) applications that were processed through the end of June, 2023. In December of 2022, CFO/CCP closed social media channels and platforms and disbanded the Qualifications Team, Client Relations Team, Communications Team, and Processing Team with several contractors held over to continue to address remaining issues. In January of 2023, CFO/CCP created a Clean-up Team to identify and resolve remaining issues and organize files to ensure any staff at the Communities Foundation of Oklahoma could quickly find information they may need upon the closure of CCP. CFO/CCP also began funding 13 ERA-2 Housing Stability Partners. The following table shows the percentage of administrative expenditures (not including the 16 million in unallowable management fees) for the State of Oklahoma ERA 1 and ERA 2 programs administered by CFO/CCP from SFY 21 to SFY 24. CCP/CFO Administrative Expenditures for the State of Oklahoma ERA 1 and ERA 2 Programs Compared to Rent & Utility (RU) Assistance Payments and Housing Stability Expenditures SFY23 ERA 1 & ERA 2 SFY 21 & SFY 22 As of December 31, 2022 As of June 30, 2023 SFY 24 RU Assistance Payments $188,753,605.17 $72,779,085.51 $2,030,717.31 -$334,805.10 RU Assistance Admin Payments $9,113,762.73 $7,099,473.23 $1,524,364.43 $1,846,079.25 Admin % of Assistance Payments 4.83% 9.75% 75.07% -551.39% Housing Stability Payments $17,773,884.27 $1,906,561.94 $4,551,171.62 $6,908,182.87 Housing Stability Admin Payments $274,224.14 $935,236.26 $0.00 $155,252.45 Admin % of Assistance Payments 1.54% 49.05% 0.00% 2.25% Total RU Assistance & HS Payments $206,527,489.44 $74,685,647.45 $6,581,888.93 $6,573,377.77 Total RU Assistance & HS Admin Payments $9,387,986.87 $8,034,709.49 $1,524,364.43 $2,001,331.70 Total Admin % of Program Expenses 4.55% 10.76% 23.16% 30.45% Of note, the 10 % and 15% limit means that administrative costs must not exceed these limits, however, the costs still have to be attributable to providing financial assistance and housing stability services to eligible households and must be necessary and reasonable for the performance of the ERA 1 and ERA 2 Federal award and be allocable to the ERA 1 and ERA 2 Federal award. We identified several issues with CFO/CCP in relation to the amount of administrative expenditures charged to the federal awards in comparison to the actual activities that were performed and/or would have been reasonable and necessary to perform given the type of program expenditures the subrecipient was incurring at the time. Based on our analysis, it appears that CFO/CCP significant increase in administrative costs coincided with the increase to a 15% administrative limit for the ERA 2 grant award instead of the 10% limit under the ERA 1 grant award. We noted that, during this period, (mainly SFY 2023) CFO/CCP made large increases to contractor rates, paid out unallowable bonus payments of approximately 38% of the total contractor payroll (an over 470% increase over the prior period) and increased other administrative costs as well. Almost all rent and utility assistance applications were processed and paid as of the end of December 2022. Administrative costs relevant to processing and paying rent and utility assistance applications far exceed any costs relevant to administering the housing stability activities related to the relatively small number of HS contracts paid in SFY23 and SFY24; however, CFO/CCP’s administrative costs were rising in comparison to the assistance payments. Also, CFO/CCP had 6 months in SFY23 in which very little assistance applications were processed and paid, yet CFO/CCP charged over $500,000 more in SFY24 for admin costs than it did during the last 6 months of SFY23 when the majority of the closeout activities would have been completed. We also noted that CFO/CCP stopped funding qualified applications when they had expended the required 80% of the ERA I award and 75% of the ERA 2 award and not because the funds available to the subrecipient to pay the assistance applications were exhausted. At that time, CFO/CCP had already retained millions in unallowable management fees, earned millions in interest as a result of OMES advancing ERA funds far in advance of when the funds were being expended, and had set aside millions in ERA funds they intended to use for future administrative costs and management fees even though the amount retained was far in excess of what was actually needed to close out the program and administer the remaining housing stability contracts. While performing an analysis on FY21-FY24 payroll expenditures from the ERA program for the subrecipient Communities Foundation of Oklahoma (CFO)/Communities Cares Partners (CCP), we obtained the ERA data and noted the following related to payroll and bonus payments for each year: Bonuses Payroll Total Bonus % FY21 131,500 2,337,034 2,468,534 5.63% FY22 546,826 8,185,607 8,732,433 6.68% FY23 2,407,500 6,318,905 8,726,405 38.10% FY24 139,500 1,182,889 1,322,389 11.79% 3,225,326 18,024,434 21,249,760 17.89% The bonus payments are 17.89% of total payroll expenditures and 11.79% of the total for FY24. We were informed that CFO/CCP management arbitrarily distributed bonuses that were not based on specific criteria, did not adhere to CCP Bonus Policies and Procedures, and were approved after the payments were made. It appears that all bonus payments did not adhere to 2 CFR 200.430 and are unallowable. For FY24, this results in $113,963 (State of Oklahoma federal share) of questioned costs. (Note: $113,963 represents 81.6% of total bonuses of $139,500 for FY24, which is the percentage of State of Oklahoma admin to total admin which includes all other jurisdictions of ERA program funds). In addition, we tested a sample of 48 of 980 (4.90%) payroll administrative expenditures, and identified: • 48 of 48 (100%) claims are not supported with timesheets to reflect the distribution of the employee’s wages among specific activities or cost objectives for the Federal award and do not accurately reflect the work performed specifically for the State of Oklahoma ERA award. CFO also administers the ERA awards for Oklahoma County, The City of Oklahoma and Cleveland County. Also, CFO created four different non-profits internally (Sidexside, Shelterwell, Afghan Legal Network and Latitude Legal) with significant crossover in CCP staff and resources. In addition, CCP appears to have significant private funding attributed to the CCP division, but there is no indication of what projects this money is being used for or which staff members worked on privately funded projects. This results in $56,972.74 in questioned costs (excluding bonus payments). • Nine of 48 (18.75%) claims included unallowable bonus payments totaling $85,000; however, those questioned costs are already included in the SFY24 total amount of $139,500 above. Because CCP confirmed that no time and effort distribution records were kept for the State of Oklahoma ERA programs, and the timesheets did not include the number of hours worked by program, all payroll expenditures are unsupported; therefore, all payroll expenditures are questioned, totaling $966,346 (State of Oklahoma federal share). (Note: $966,346 represents 81.6% of total payroll of $1,182,889 for FY24, which is the percentage of State of Oklahoma admin to total admin which includes all other jurisdictions of ERA program funds) We also observed through CCP’s timeline that the application portal was closed as of August 31, 2022, and, as of December 2022, CCP disbanded the following teams Qualifications, Client Relations, Communications, and Processing; however, we noted that five employees in these divisions were still being paid. In addition, two employees from the fraud department were paid over $100,000 each; however, CCP has been unable to provide a list of applicants, landlords, or payments that were sent to this department for review. Cause: OMES did not timely take corrective action to address prior year findings from the SFY 21 to SFY 23 audits. OMES did not timely take corrective action to require OMES personnel to obtain, review, approve, or maintain adequate supporting documentation for housing stability program costs and housing stability administrative costs. The required corrective action would have included transferring administration of the ERA grant to the GMO office or other personnel with the experience and expertise to administer Federal grant funds before the majority of the ERA funds were expended by the subrecipient. OMES did not establish and maintain effective internal control over its claims process to provide reasonable assurance the Federal award was administered in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, OMES’s subrecipient monitoring process lacked the strength and consistency to ensure subrecipients established and maintained effective internal control over the Federal award to provide reasonable assurance that the non-Federal entity was managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: Inadequate review of claims and approving claims without proper supporting documentation increases the risk of unallowable expenses resulting in noncompliance. Furthermore, noncompliance increases the risk of Federal claw backs, which impacts state dollars. Payroll costs totaling $966,346 were not supported by time distribution records. Unallowable bonus payments of $113,963, were charged to the ERA program as payroll administrative expenditures, which could have been used toward Oklahoma applicants in need of ERA funding. OMES’s decision to delay proper oversight of the ERA program and to postpone needed corrective actions until after the majority of grant funds had been expended by a subrecipient, significantly increases the risk that excess funds cannot be recovered. This also greatly increases the risk that the state taxpayers will have to repay more than $23 million in unallowable costs. Recommendation: SAI acknowledges that beginning in FY25, oversight of the ERA program was transferred to the Grants Management Office (GMO). The GMO has two staff members on the team with 20+ years of combined federal grant specific experience. The GMO entered into a subrecipient agreement that does not expire to monitor CFO’s duties and processes. GMO also required CFO to return the remaining ERA 2 program funds to ensure that proper oversight and review of ERA expenditures is performed. The GMO has implemented a multi-level system of internal controls for grant management and oversight that includes routine monitoring, desk review, and site visits for all projects and associated project/administrative expenditures to ensure allowability, accuracy, and to assist in the detection of fraud. For the ERA Program, OMES-GMO conducts bi-weekly monitoring meetings with CFO and is currently reviewing documentation provided by CFO to ensure all current ERA projects are eligible under the ERA guidelines and that CFO is exercising the proper oversight over their subrecipients; therefore, we recommend that the OMES GMO continue implementing the corrective action plan established in FY 2025 to provide proper oversight and monitoring of ERA program expenditures. Criteria: U.S. Department of the Treasury Emergency Rental Assistance Grantee Award Form (8) (a-b) Compliance with Applicable Law and Regulations, states in part, “a. Recipient agrees to comply with the requirements of Section 501 and Treasury interpretive guidance regarding such requirements. Recipient also agrees to comply with all other applicable federal statutes, regulations, and executive orders, and Recipient shall provide for such compliance in any agreements it enters into with other parties relating to this award. b. Federal regulations applicable to this award include, without limitation, the following: i. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 2 C.F.R. Part 200, other than such provisions as Treasury may determine are inapplicable to this Award and subject to such exceptions as may be otherwise provided by Treasury.” 2 CFR § 200.303(a) – Internal Controls states in part, “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” For ERA 1, the Consolidated Appropriations Act § Section 501 (c)(5) Use of Funds - Administrative Costs states in part, “A. IN GENERAL.- Not more than 10 percent of the amount paid to an eligible grantee under this section may be used for administrative costs attributable to providing financial assistance and housing stability services under paragraphs (2) and (3), respectively, including for data collection and reporting requirements related to such funds. B. No OTHER ADMINISTRATIVE COSTS.- Amounts paid under this section shall not be used for any administrative costs other than to the extent allowed under subparagraph (A)” For ERA 2, the American Rescue Plan Act of 2021 § Section 3201(C) Administrative Costs states, “Not more than 15 percent of the total amount paid to an eligible grantee under this section may be used for administrative costs attributable to providing financial assistance, housing stability services, and other affordable rental housing and eviction prevention activities, including for data collection and reporting requirements related to such funds.” 2 CFR § 200.334 – Retention requirements for records state in part, “Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient.” 2 CFR § 200.337 – Access to records states in part, “(a) Records of non-Federal entities. The Federal awarding agency, Inspectors General, the Comptroller General of the United States, and the pass-through entity, or any of their authorized representatives, must have the right of access to any documents, papers, or other records of the non-Federal entity which are pertinent to the Federal award, in order to make audits, examinations, excerpts, and transcripts. The right also includes timely and reasonable access to the non-Federal entity's personnel for the purpose of interview and discussion related to such documents.” 2 CFR § 200.403 – Factors affecting allowability of costs states in part, “Except where otherwise authorized by statute, costs must meet the following criteria to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles.” 2 CFR § 200.430 – Compensation – personal services states in part, “(f) Incentive compensation. Incentive compensation to employees based on cost reduction, efficient performance, suggestion awards, or safety awards is allowable to the extent that the overall compensation is determined to be reasonable and such costs are paid or accrued according to an agreement entered into in good faith between the recipient or subrecipient and the employees before the services were rendered, or according to an established plan followed by the recipient or subrecipient so consistently as to imply, in effect, an agreement to make such payment. (g) (i and iv) Standards for Documentation of Personnel Expenses. (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (iv) Encompass federally-assisted and all other activities compensated by the recipient or subrecipient on an integrated basis but may include the use of subsidiary records as defined in the recipient's or subrecipient's written policy.” For ERA 1, the Consolidated Appropriations Act § Section 501 (c)(5) Use of Funds (c) USE OF FUNDS.— (1) IN GENERAL.—"An eligible grantee shall only use the funds provided from a payment made under this section to provide financial assistance and housing stability services to eligible households. (2) FINANCIAL ASSISTANCE.— (A) IN GENERAL.—Not less than 90 percent of the funds received by an eligible grantee from a payment made under this section shall be used to provide financial assistance to eligible households, including the payment of (i) rent; (ii) rental arrears; (iii) utilities and home energy costs; (iv) utilities and home energy costs arrears; and (v) other expenses related to housing incurred due, directly or indirectly, to the novel coronavirus disease (COVID-19) outbreak, as defined by the Secretary.” For ERA 2, the American Rescue Plan Act of 2021 § Section 3201(C) Administrative Costs states, (D) OTHER AFFORDABLE RENTAL HOUSING AND EVICTION PREVENTION ACTIVITIES.-“An eligible grantee may use any funds from payments made under this section that are unobligated on October 1, 2022, for purposes in addition to those specified in this paragraph, provided that – (i) such other purposes are affordable rental housing and eviction prevention purposes, as defined by the Secretary, serving very low-income families (as such term is defined in section 3(b) of the United States Housing Act of 1937 (42 U.S.C. 1437a(b))); and (ii) prior to obligating any funds for such purposes, the eligible grantee has obligated not less than 75 percent of the total funds allocated to such eligible grantee in accordance with this section.” Management Response Contact Person: Brandy Manek, OMES Director of Budget, Policy and Gaming Compliance Anticipated Completion Date: Completed Corrective Action Planned: The Oklahoma Office of Management and Enterprise Services (OMES) concurs with the finding. See corrective action plan located in the corrective action plan section of this report. Auditor’s Response: With regard to the assertion that the State did not have “sufficient and timely notice to make full corrective actions prior to this FY2024 audit, we respectfully disagree per the following reasons: As a recipient of the Federal ERA award, the State of Oklahoma is responsible for understanding the terms and conditions of the award and to ensure the ERA award is administered in accordance with federal regulations, which includes the cost principles per 2 CFR § 200 included in the ‘Criteria’ section of this finding. In May of 2021, the State first received Coronavirus Relief Fund (CRF) Audit Finding # 2020-083 related to the State’s lack of subrecipient monitoring activities and Audit Finding # 2020-081 related to the State’s failure to obtain adequate supporting documentation for subrecipient expenditures prior to paying for goods and services. The same individual served as the State’s audit contact for both the CRF award and the ERA award and, therefore, the State could have begun implementing required subrecipient monitoring activities and ensuring adequate supporting documentation was obtained from the subrecipient in May of 2021. Although the SFY 2021 Single Audit Report was not actually released until June 2023, the SFY 2021 Single Audit Report was originally scheduled for publication near the end of September of 2022, and, on September 6, 2022, SA & I provided OMES Audit Finding # 2021-081 and Audit Finding # 2021-080 which included the following issues applicable to this finding which SA & I had identified as of that date: From Audit Finding # 2021-081: “OMES entered into agreements with two non-profit entities to administer the ERA program for the State of Oklahoma: Communities Foundation of Oklahoma (CFO) and Restore Hope Ministries (RHM). SAI reviewed the agreements for these two entities and determined that both agreements constituted a subrecipient relationship that would be subject to Part M Subrecipient Monitoring requirements. We noted that OMES failed to perform any required subrecipient monitoring activities, specifically: • OMES did not perform any during the award monitoring activities with regard to the rental and utility applications, housing stability and payments approved and paid by the subrecipients, or the administrative expenditures actually incurred by the subrecipients. OMES provided subrecipients advance payments based off expected program rental and utility expenditures for the month and then paid administrative costs on a set percentage of program funds advanced. OMES did not review any supporting documentation related to actual program expenditures for rental and utility assistance, housing stability activities, or administrative expenditures actually incurred by the subrecipients. While OMES did obtain summary information related to rental and utility payments and housing stability payments made for reporting purposes, OMES did not review any actual administrative expenditures to ensure that the administrative costs were attributable to providing financial assistance and housing stability services to eligible households. • OMES did not obtain any financial records and supporting documents from the subrecipients that would support the actual expenditures incurred by the subrecipients.” From Audit Finding # 2021-080: “While documenting controls over subrecipient program and administrative expenditures for the ERA program, we noted that OMES did not review any supporting documentation related to actual program expenditures for rental and utility assistance or housing stability activities or, administrative expenditures actually incurred by the subrecipients and, did not require that subrecipients submit supporting documentation for actual program and administrative expenditures incurred.” “While reviewing ERA administrative expenditures, we noted the following: One subrecipient charged the ERA grant $2,000,000 in unallowable management fees that were not attributable to providing financial assistance and housing stability services under the ERA program. We questioned $1,563,028 of these costs that were allocated to the State of Oklahoma ERA1 grant.” Given the State first received similar findings for the SFY 2020 CRF award in May of 2021 (12 months before the start of SFY 2023 and 24 months before the start of SFY 2024), the State did have sufficient and timely notice to make full corrective actions prior to this SFY 2024 audit and even prior to the SFY 2023 audit. It is the position of our office that the State could have greatly reduced the amount of ERA questioned costs incurred over the past few years if the State had not waited about three and a half years (May 2021 to January 2025) from when SA & I first provided applicable findings to start implementing corrective action.

FINDING NO: 2024-038 (Repeat 2023-089) Develop and Implement Internal Controls Over Administrative Expenditures STATE AGENCY: State of Oklahoma, Office of Management and Enterprise Services (OMES) FEDERAL AGENCY: US Department of Treasury ALN: 21.023 FEDERAL PROGRAM NAME: Emergency Rental Assistance (ERA) FEDERAL AWARD NUMBER: ERAE0259 FEDERAL AWARD YEAR: 2024 CONTROL CATEGORY: Activities Allowed or Unallowed; and Allowable Costs/Cost Principles QUESTIONED COSTS: $363,787 Condition and Context: During the period of March 2021 through the end of SFY2024 (including audit periods SFY21 to SFY24), the OMES Director of Budget, Policy and Gaming Compliance (OMES/BPGC) was responsible for administering the State of Oklahoma ERA awards, entering into agreements with subrecipients to carry out performance of the awards, providing oversight for all subrecipient activities and expenditures including ensuring subrecipients expended the awards in compliance with award requirements, and ensuring subrecipients complied with required Federal Single Audit requirements and implemented appropriate corrective action timely for all Single Audit Findings. The issues documented in this finding are all issues that were included in prior year findings first sent to OMES starting September 7, 2022. In addition, during prior year audits, we were informed that transactions identified as ‘multi jurisdiction’ indicated the expense was attributable to State, County, and City ERA funds and the expense was allocated based on the percent of each jurisdiction’s expenditures to total program expenditures. We have only included questioned costs in this finding that are applicable to the State of Oklahoma’s Federal share of ERA funds. At the start of SFY2025, oversight and management of the ERA program was transferred from the office of the Director of Budget, Policy and Gaming Compliance to the OMES Grant Management Office (OMES-GMO), which has staff with several years of grant experience. At the beginning of SFY2025, OMES-GMO hired additional staff, and the two staff members dedicated to the management of the ERA program have 20+ years of combined federal grant specific experience. The GMO implemented a multi-level system of internal controls for grant management and oversight that includes routine monitoring, desk review, and site visits for all projects and associated project/administrative expenditures to ensure allowability, accuracy, and assist in the detection of fraud. SAI began working on the current audit in late fall of 2025 and the OMES GMO actively facilitated our audit requests to the extent the subrecipients would provide the requested information, worked to implement corrective action for all prior year audit findings and implemented oversight and monitoring activities over the remaining unexpended ERA grant funds and began reviewing the SFY25 grant funds already expended. Because these activities did not start until after the audit period, most of the prior year audit findings remained uncorrected during the audit period resulting in repeat findings. The following issues associated with administrative expenditures occurred prior to the current OMES GMO assuming responsibility for the oversight of the State of Oklahoma ERA program. While reviewing administrative expenditure data, we identified unallowable administrative costs (management fees) totaling $273,596 retained by the subrecipient and charged to the ERA 2 grant that were not attributable to providing financial assistance and housing stability services. The management fees the subrecipient charged to the grant appear to be an arbitrary amount retained by Communities Foundation of Oklahoma (CFO) instead of actual administrative costs. During testwork of subrecipient administrative expenditures for the ERA 2 grant, we determined OMES claims processes (applicable to the SFY24 period) did not require subrecipients to submit supporting documentation for the expenditures charged to the program. Furthermore, we determined that one of the subrecipients, CFO, lacked sufficient internal controls over administrative expenditures to ensure only allowable costs and activities were charged to the ERA 2 grant. During our review of a sample of 27 out of 143 (18.88%) non-payroll and non-credit card administrative expenditures applicable to ERA 2 services for rent and utility assistance totaling $650,722, we identified the following issues: • For one of 27 (3.7%) expenditures, the subrecipient was unable to provide an updated contract covering the time of the expenditure, totaling $47,850. The State of Oklahoma federal share of this is $40,763. • One of 27 (3.7%) expenditures had an invoice that was not itemized for specific costs or services provided. Per the contract, the services included lobbying activities for Oklahoma legislation totaling $10,000.00, which is unrelated to the administration of the ERA program and unallowable. The State of Oklahoma federal share of this is $8,519. • One of 27 (3.7%) expenditures had an invoice to purchase food, totaling $67. The State of Oklahoma federal share of this is $57. • Five of 27 (18.52%) expenditures had an invoice that included services applicable to grants other than the State of Oklahoma ERA program, totaling $5,204. The State of Oklahoma federal share of this is $4,434. • Eight of 27 (29.63%) expenditures were for housing stability services that were inappropriately labeled as “Rental Relief Admin” in the transaction data. • Two of 27 (7.41%) expenditures were unrelated to ERA. The subrecipient refunded the amount after SAI’s determination in a prior year audit; and therefore, will not result in questioned costs in FY24. • 13 of 27 (48.15%) expenditures were classified as rent relief admin; however, only 3.75% of total expenditures during SFY24 were rent relief program expenditures that mostly consisted of refunds. Therefore, it appears administrative expenditures were supporting housing stability services more than rent relief activities, and the amount charged to rent relief admin is both misleading and excessive. We also tested a sample of 37 of 43 (86.05%) non-payroll and non-credit card administrative expenditures applicable to ERA 2 housing stability services totaling $154,064.93 and identified: • For three of 37 expenditures (8.11%), the expenditure was for unallowable indirect costs charged to an internally created non-profit, totaling $390. The State of Oklahoma federal share of this is $318. • For seven of 37 expenditures (18.92%), the expenditure was for activities not related to housing stability and unallowable indirect costs, totaling $43,125. The State of Oklahoma federal share of this is $35,147. We tested all 12-credit card administrative expenditures for CFO expenditures applicable to ERA 2 services for rent and utility assistance, totaling $6,861.86, and identified six of 12 (50%) payments included at least one expenditure for unallowable costs, totaling $1,118. The State of Oklahoma federal share of this is $953. Note: Issues noted with the payroll related administrative expenditures are included in Audit Finding # 2024-024. Cause: OMES did not timely take corrective action to address unallowable management fees first identified in prior year findings from the SFY 2021 audit sent to OMES 9/7/2022, and other types of unallowable administrative expenditures first identified in findings from the SFY 2022 audit sent to OMES in January of 2024. OMES did not timely take corrective action to require OMES personnel to obtain, review, approve, or maintain adequate supporting documentation for administrative costs. The required corrective action would have included transferring administration of the ERA grant to the GMO office or other personnel with the experience and expertise to administer Federal grant funds before the majority of the ERA funds were expended by the subrecipient. OMES did not establish and maintain effective internal control over its claims process that provides reasonable assurance the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, OMES subrecipient monitoring process lacked the strength and consistency to ensure subrecipients established and maintained effective internal control over the Federal award to provide reasonable assurance that the non-Federal entity was managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: Inadequate review of claims with proper supporting documentation increases the risk of unallowable expenses resulting in noncompliance. Furthermore, noncompliance increases the risk of Federal claw backs, which impacts state dollars. Noncompliance during the audit period resulted in $363,787 questioned costs for the ERA program, and, $407,154 in projected questioned costs for non-payroll rent and utility assistance administrative expenditures which is 73.45% of the applicable population. OMES decisions to delay appropriate oversight of the ERA program and to delay implementation of adequate corrective action until after the majority of grant funds have been expended by a subrecipient increases the risk that funds may not be successfully recouped from the subrecipient and greatly increases the risk that the state taxpayers will be required to pay back accumulated questioned costs of over $23 million in unallowable costs. Recommendation: We recommend that the OMES GMO continue implementing the corrective action plan established in state fiscal year 2025 to provide proper oversight and monitoring of ERA program expenditures which includes: • Oversight and management of the ERA program by staff with adequate experience and expertise of the grant requirements. • A multi-level system of internal controls for grant management and oversight that consists of routine monitoring, desk review, and site visits for all projects and associated project/administrative expenditures to ensure allowability, accuracy, and assist in the detection of fraud. For example, OMES-GMO’s process for disbursing funds to a subrecipient requires a written request from the subrecipient with supporting documentation, then OMES-GMO assigns a staff lead and secondary grant analyst to perform a primary and secondary review for compliance and to require additional supporting documentation if needed to approve the request. Once those reviews are completed and approved by the OMES-GMO staff, the Director of the OMES-GMO reviews and approves the request before it is sent to the OMES Finance Division. The OMES Finance Division then verifies the calculated amount(s) before completing the disbursement to the subrecipient. These internal control processes and policies have been implemented for the management and oversight of the ERA Program and provide a multi-layer review to prevent fraud and risk factors applicable to the ERA program. Additionally, the OMES-GMO staff assigned to the ERA program have the training and knowledge to ensure compliance with the Federal grant requirements. • Monthly, bi-weekly or weekly meetings, depending on the level of risk, with each subrecipient to monitor the progress of projects and address any issues or changes that might impact the project. For the ERA Program, OMES-GMO conducts bi-weekly monitoring meetings with CFO and is currently reviewing documentation provided by CFO to ensure all current ERA projects are eligible under the ERA guidelines and that CFO is exercising the proper oversight over their subrecipients. • OMES-GMO required the return of the remaining ERA2 Program funds from CFO to ensure proper oversight and review of ERA expenditures is performed. We recommend continuing with current ERA monitoring steps and internal controls, and work with CFO to ensure ERA program funds are spent in accordance with ERA program guidelines and state and federal regulations. Criteria: U.S Department of the Treasury Emergency Rental Assistance Grantee Award Form (8) (a-b) Compliance with Applicable Law and Regulations, states in part, “a. Recipient agrees to comply with the requirements of Section 501 and Treasury interpretive guidance regarding such requirements. Recipient also agrees to comply with all other applicable federal statutes, regulations, and executive orders, and Recipient shall provide for such compliance in any agreements it enters into with other parties relating to this award. b. Federal regulations applicable to this award include, without limitation, the following: i. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 2 C.F.R. Part 200, other than such provisions as Treasury may determine are inapplicable to this Award and subject to such exceptions as may be otherwise provided by Treasury.” 2 CFR § 200.303(a) states in part: “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” The Consolidated Appropriations Act § Section 501 (c)(5) Use of Funds - Administrative Costs states in part: “A. IN GENERAL.- Not more than 10 percent of the amount paid to an eligible grantee under this section may be used for administrative costs attributable to providing financial assistance and housing stability services under paragraphs (2) and (3), respectively, including for data collection and reporting requirements related to such funds. B. No OTHER ADMINISTRATIVE COSTS.- Amounts paid under this section shall not be used for any administrative costs other than to the extent allowed under subparagraph (A)” 2 CFR § 200.334 – Retention requirements for records state in part: “Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient.” 2 CFR § 200.337 Access to records states in part: “(a) Records of non-Federal entities. The Federal awarding agency, Inspectors General, the Comptroller General of the United States, and the pass-through entity, or any of their authorized representatives, must have the right of access to any documents, papers, or other records of the non-Federal entity which are pertinent to the Federal award, in order to make audits, examinations, excerpts, and transcripts. The right also includes timely and reasonable access to the non-Federal entity's personnel for the purpose of interview and discussion related to such documents.” 74 O.S. § 85.7 - Competitive Bid Procedures states in part:” A. Except as otherwise provided by the Oklahoma Central Purchasing Act, or associated rules: … 6. Competitive bidding requirements of this section shall not be required for the following: … f. any acquisition of a service which the Office of Management and Enterprise Services has approved as qualifying for a fixed and uniform rate, subject to the following: (2) fixed and uniform rate contracts authorized by this subsection shall be limited to contracts for those services furnished to persons directly benefiting from such services and shall not be used by a state agency to employ consultants or to make other acquisitions.” 2 CFR § 200.450 – Lobbying states in part: “The following restrictions apply to nonprofit organizations and IHEs: (C)(1)(iii)(A-B) The introduction of Federal or State legislation; the enactment or modification of any pending Federal or State legislation through communication with any member or employee of the Congress or State legislature (including efforts to influence State or local officials to engage in similar lobbying activity); (C)(1)(iv) Legislative liaison activities, including attendance at legislative sessions or committee hearings, gathering information regarding legislation, and analyzing the effect of legislation, when such activities are carried on in support of or in knowing preparation for an effort to engage in unallowable lobbying.” Management Response Contact Person: Brandy Manek, OMES Director of Budget, Policy and Gaming Compliance Anticipated Completion Date: Completed Corrective Action Planned: The Oklahoma Office of Management and Enterprise Services (OMES) concurs with the finding. See corrective action plan located in the corrective action plan section of this report. Auditor’s Response: See the auditor response located in finding #2024-024.

FINDING NO: 2024-053 (Repeat 2023-090; 2022-046) Develop and Implement Internal Controls on Reviewing Subrecipient Transactions STATE AGENCY: State of Oklahoma, Office of Management and Enterprise Services (OMES) FEDERAL AGENCY: US Department of Treasury ALN: 21.023 FEDERAL PROGRAM NAME: Emergency Rental Assistance (ERA 1 and ERA 2) FEDERAL AWARD NUMBER: ERA0028 and ERAE0259 FEDERAL AWARD YEAR: 2022, 2023 and 2024 CONTROL CATEGORY: Activities Allowed/Unallowed and Allowable Costs/Cost Principles QUESTIONED COSTS: $2,381,483 Condition and Context: The ERA program allows up to 10% of ERA funds to be used for housing stability services. Per the ERA FAQ number 29, for purposes of ERA1 and ERA2, housing stability services include those that enable households to maintain or obtain housing. Such services may include, among other things, eviction prevention and eviction diversion programs; mediation between landlords and tenants; housing counseling; fair housing counseling; housing navigators or promotors that help households access ERA programs or find housing; case management related to housing stability; housing-related services for survivors of domestic abuse or human trafficking; legal services or attorney’s fees related to eviction proceedings and maintaining housing stability; and specialized services for individuals with disabilities or seniors that support their ability to access or maintain housing. Grantees using ERA funds for housing stability services must maintain records regarding such services and the amount of funds provided to them. SFY24 Housing Stability Partner Payments We tested a sample of 5 of 10 (50%) of housing stability partners (HSP), a subrecipient of the program, paid in state fiscal year (SFY) 2024, totaling $6,963,249 and identified: • Two of 5 (40%) included payments to HSP that were actually internal non-profit organizations created by Communities Foundation of Oklahoma (CFO). The payments made to these two internal organizations were used to fund business start-up costs and administrative costs and were not tied to any substantial number of individuals obtaining actual housing stability related services as enumerated in ERA FAQ #29. Due to the nature of these payments, we determined that $1,428, 567 represented housing stability related administrative costs, not housing stability program costs and should have been reported as housing stability administrative costs. In addition, it is inappropriate for CFO to have used ERA funds to start up their own internal non-profits. o Shelterwell was founded in 2023 and the entire leadership team consists of employees from Communities Cares Partners (CCP), a subsidiary of CFO who actually administered the ERA program. In addition, the CCP Executive Director also serves as a board member. We found that 69.27% of the expenditures paid to Shelterwell were for payroll costs and another 15.91% were for holiday/PTO, bonus payments, and management fees. We questioned the entire amount paid, totaling $541,946 (HS program payments of $541,911 and HS Admin payments of $35). o SidexSide (formerly called LastMile) was founded in 2022, and some employees were former CCP employees. In addition, the CCP Executive Director and the CFO Executive Director at the time serve as board members. We found that 52.50% of the expenditures paid to SidexSide were for payroll costs and another 7.62% were for bonus payments, management fees, and indirect costs. In addition, SidexSide included in their budget and was reimbursed for a $45,000 line item for a ‘Communities Foundation of Oklahoma fiscal sponsorship fee’ and an additional $158,657 in consulting fees. We questioned the entire amount paid, totaling $886,622 (HS program payments of $886,267 and HS Admin payments of $355). • One of 5 (20%) included payments to a housing stability partner that were not supported by any description of housing stability related services as enumerated in ERA FAQ #29, or any description of services that were to be provided. The contract dated October 1, 2022 through December 31, 2023 did not specify what services would be provided by the HS partner and CCP did not provide the recipient's Work Plan and Budget; therefore, we were unable to determine what actual services were provided as costs were mainly for payroll & fringe with additional charges for supplies, contractors and rent. In addition, the contract end date was 12/31/2023; however, payments were made for costs incurred from 1/1/2024 through 6/30/2024 and the contracted amount of $1,800,000 was exceeded by $247,122. SAI noted that the HS partner was actually operating a for-profit grocery store and also had a separate non-profit that CCP was paying. The salary amounts CCP paid were very high in relation to other housing stability partners paid and included paying the two founders of the grocery store over $150,000 and $130,000 per year. Also, many family members of one of the founders were on the payroll as was an employee of CCP. This organization and one of its founders also received ERA funds from other sources that they were found to have misused and were later required to repay the funds. Due to the lack of support to establish that the organization provided allowable housing stability services, payments made without a valid contract and other issues noted, we have questioned 100% of the funds paid in SFY24 totaling $814,443 (HS program payments of $771.318 and HS Admin payments of $43,125). The payments made in prior years under this contract totaling $1,680,678 will not be questioned costs applicable to SFY24; however, we will inform OMES/GMO of our findings. • One of 10 (10%) included payments to a housing stability partner assisting immigrants/refugees with case management, employment, and legal services. We noted CCP reimbursed the partner for bed bug treatments, totaling $4,556, which is not an allowable cost for ERA 2 funds. In addition, reimbursements for medical examinations and other medical tests which are not allowable uses of ERA 2 funds were made. This resulted in questioned costs totaling $102,253. • One of 10 (10%) included payments to a housing stability totaling $36,220 for unsupported expenditures (HS program payments of $27,229 and HS Admin payments of $8,991). Prior Year Housing Stability Partner Payments In our prior year audits for SFY22 and SFY23, we did not receive supporting documentation for the housing stability partners other than the contracts; therefore, in order to follow up on the prior year findings, we tested a sample of 6 of 32 (18.75%) of partners and identified: • One of 32 (3.13%) included payments to a housing stability partner which did not appear to have fulfilled the terms of contract and did not report any services actually performed. The Quarter 1 report stated they had significant difficulty carrying out the services that had been planned to be provided, the Quarter 2 report was not provided to SAI, the Quarter 3 report was blank but had a comment that they lost all of their counselors and were working to find another way to provide services but still encountered difficulties, and the Quarter 4 report was blank. The partner was paid for the entire amount of the contract; however, no invoices for costs incurred were provided and 82% of the amount paid was for salaries and benefits even though the HS partner reported they had lost all the employees needed to provide the services. Payments to this partner were $520,000 over SFY22 and SFY23. • One of 32 (3.13%) included payments to a housing stability partner where they provided services for outreach and client engagement, intake assistance and application support, navigation and case coordination related to ERA applications, housing stabilization services approved under Treasury ERA guidance, and follow up support as required by program requirements. However, we received a signed affidavit dated 2/24/2026 that states in part that 'no traditional invoices were required under the Agreement structure.' SAI did not receive any invoices or payroll support for amounts paid in SFY22 and SFY23. • One of 32 (3.13%) included payments to a housing stability partner that exceeded the contract amount by $40,000. • One of 32 (3.13%) included payments to a housing stability partner for which supporting documentation was not provided for payroll costs which represents 87% of budgeted items. We also noted the following issues that were prevalent in many of the HS Partner payments reviewed: • Indirect costs for many of the HS Partners were included in housing stability payments instead of being identified as housing stability administrative payments. • We noted that CFO/CCP was not consistent in determining renumeration in the contracts per type of service between the HS partners. For example, one HS partner was paid $1,625 for every ERA application submitted and qualified by CCP up to a maximum of $74,750 (i.e. 46 qualified ERA applications). A second HS partner was paid $800 per application up to a maximum of $600,000 (i.e. 750 qualified ERA applications). Both of these partners were also paid additional amounts for payroll and operating costs, but these amounts were not equitable between the two HS partners. Other HS partners were not paid a fee for every ERA application submitted and qualified by CCP even when that was part of the services they were contracted to perform. We also noted that two contracts that included referral fees specified that the applications had to be submitted during the agreement period (6/1/2022 through 8/30/2022); however, one HS partner only submitted 13 applications during this period but was paid for the contract limit of 46 resulting in a $53,625 overpayment. Considering CCP shut down their application system at the end of August, 2022, and ended up denying over 1,700 qualified applicants due to lack of funding, the payments to HS partners for application referral services during the three months before the system was shut down appear to be excessive and unnecessary and the funds could have been used to fund applicants who needed the assistance. Any issues found during our review of HS partner payments made in prior years will not be included as the costs questioned for the SFY24 audit period. However, we will provide the results of our review to OMES/GMO for possible follow-up. Cause: OMES did not timely take corrective action to address prior year findings from the SFY 21 to SFY 23 audits. OMES did not timely take corrective action to require OMES personnel to obtain, review, approve, or maintain adequate supporting documentation for housing stability program costs and housing stability administrative costs. The required corrective action would have included transferring administration of the ERA grant to the GMO office or other personnel with the experience and expertise to administer Federal grant funds before the majority of the ERA funds were expended by the subrecipient. OMES did not establish and maintain effective internal control over its claims process that provides reasonable assurance the Federal award is in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, OMES subrecipient monitoring process lacked the strength and consistency to ensure subrecipients established and maintained effective internal control over the Federal award to provide reasonable assurance that the non-Federal entity was managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effect: Inadequate review of claims with proper supporting documentation increases the risk of unallowable expenses resulting in noncompliance. Furthermore, noncompliance increases the risk of Federal claw backs, which impacts state dollars. Unallowable costs, totaling $2,381,483, were charged to the ERA program as housing stability expenditures. OMES’ decisions to delay appropriate oversight of the ERA program and to delay implementation of adequate corrective action until after the majority of grant funds have been expended by a subrecipient increases the risk that funds may not be successfully recouped from the subrecipient and greatly increases the risk that the state taxpayers will be required to pay back accumulated questioned costs of over $23 million in unallowable costs. Recommendation: We recommend that the OMES GMO continue implementing the corrective action plan established in state fiscal year 2025 to provide proper oversight and monitoring of ERA program expenditures which includes: • Oversight and management of the ERA program by staff with adequate experience and expertise of the grant requirements. • A multi-level system of internal controls for grant management and oversight that consists of routine monitoring, desk review, and site visits for all projects and associated project/administrative expenditures to ensure allowability, accuracy, and assist in the detection of fraud. For example, OMES-GMO’s process for disbursing funds to a subrecipient requires a written request from the subrecipient with supporting documentation, then OMES-GMO assigns a staff lead and secondary grant analyst to perform a primary and secondary review for compliance and to require additional supporting documentation if needed to approve the request. Once those reviews are completed and approved by the OMES-GMO staff, the Director of the OMES-GMO reviews and approves the request before it is sent to the OMES Finance Division. The OMES Finance Division then verifies the calculated amount(s) before completing the disbursement to the subrecipient. These internal control processes and policies have been implemented for the management and oversight of the ERA Program and provide a multi-layer review to prevent fraud and risk factors applicable to the ERA program. Additionally, the OMES-GMO staff assigned to the ERA program have the training and knowledge to ensure compliance with the Federal grant requirements. • Monthly, bi-weekly or weekly meetings, depending on the level of risk, with each subrecipient to monitor the progress of projects and address any issues or changes that might impact the project. For the ERA Program, OMES-GMO conducts bi-weekly monitoring meetings with CFO and is currently reviewing documentation provided by CFO to ensure all current ERA projects are eligible under the ERA guidelines and that CFO is exercising the proper oversight over their subrecipients. • OMES-GMO required the return of the remaining ERA2 Program funds from CFO to ensure proper oversight and review of ERA expenditures is performed. We recommend continuing with current ERA monitoring steps and internal controls and working with CFO to ensure ERA program funds are spent in accordance with ERA program guidelines and state and federal regulations. Criteria: 2 CFR § 200.303(a) – Internal Controls states in part, “The Non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” The US Department of Treasury Emergency Rental Assistance (ERA) FAQ #23 ERA 1 and ERA 2 both allow for up to 10 percent of the funds received by a grantee to be used for certain housing stability services. What are some examples of these services? States in part, “Under ERA 1, these funds may be used to provide eligible households with case management and other services, related to the COVID-19 outbreak.” Under ERA2, these services do not have to be related to the COVID-19 outbreak and the ERA2 statute does not restrict the provision of housing stability services to “eligible households.” For purposes of ERA1 and ERA2, housing stability services include those that enable households to maintain or obtain housing. Such services may include, among other things, eviction prevention and eviction diversion programs; mediation between landlords and tenants; housing counseling; fair housing counseling; housing navigators or promotors that help households access ERA programs or find housing; case management related to housing stability; housing-related services for survivors of domestic abuse or human trafficking; legal services or attorney’s fees related to eviction proceedings and maintaining housing stability; and specialized services for individuals with disabilities or seniors that support their ability to access or maintain housing. Grantees using ERA funds for housing stability services must maintain records regarding such services and the amount of funds provided to them.” Management Response Contact Person: Brandy Manek, OMES Director of Budget, Policy and Gaming Compliance Anticipated Completion Date: Completed Corrective Action Planned: The Oklahoma Office of Management and Enterprise Services (OMES) concurs with the finding. See corrective action plan located in the corrective action plan section of this report. Auditor’s Response: See the auditor response located in finding #2024-024.