Audit 411772

Federal Agency: United States Department of Agriculture (USDA) Federal Program: 10.558 Child and Adult Care Food Program (CACFP) 2024 and 2025 CACFP 2024 and 2025 CACFP-CIL 2024 and 2025 CACFP-SPON State Agency: Department of Health and Senior Services (DHSS) - Bureau of Community Food and Nutrition Assistance (BCFNA) Type of Finding: Internal Control (Material Weakness) and Material Noncompliance Questioned Costs: $0 Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Subrecipient Monitoring As noted in our two previous audits, during the year ended June 30, 2025, the BCFNA did not have sufficient controls and procedures to ensure CACFP reimbursements to subrecipients were allowable and supported with sufficient documentation, as required by federal regulations. As a result, significant unallowable and unsupported reimbursements were made without being prevented or detected timely. Audit sampling results show the subrecipient payment error rate continued to increase; however, the BCFNA has implemented only a few changes to address our prior-year audit findings and strengthen monitoring procedures. The BCFNA administers the CACFP through contracts with child and adult care centers/sponsors of centers (subrecipients) that provide meals to eligible children and adults under their care. The facilities/sponsors determine eligibility of each participant for free or reduced price meals, and are reimbursed at fixed rates for the number and type of meals served. During the year ended June 30, 2025, the BCFNA paid over 730 facilities/sponsors approximately $69.9 million for meal services. Disbursements to facilities/sponsors represented approximately 98% of the program's expenditures. To receive reimbursement for meals provided to eligible participants, CACFP facilities/sponsors submit monthly claims through the CNPWeb (CNP) claim system. The CNP system has edit checks to prevent and detect certain claim errors, such as meal claims that exceed facility/sponsor total enrollment and/or license capacity, or claims for types of meals the facility/sponsor was not approved to serve. Claims that pass the edit checks are reviewed by a BCFNA Public Health Program Associate, while claims that do not pass the edit checks are returned to the facility/sponsor for revision. Facilities/sponsors are not required to provide supporting documentation with their claim but are required to maintain and retain detailed records, including meal count, attendance, enrollment, eligibility determination records, receipt slips, menus, and other documentation to support meals claimed. Facility/sponsor records are maintained on a monthly basis, therefore reviews or verifications of those records generally cover the entire month as opposed to a shorter time period. BCFNA nutritionists perform periodic monitoring reviews of the facilities/sponsors and disallow costs associated with claim errors identified. These reviews have identified significant issues and claim errors, including some potentially fraudulent activity, and led to over 15 contract terminations in recent years. Since meal reimbursements are made without any supporting documentation, the BCFNA relies on system edit checks and subrecipient monitoring procedures to prevent and detect meal reimbursement claim errors. However, these edit checks and procedures alone were not sufficient to prevent and detect unallowable and unsupported meal reimbursement claims on a timely basis. The BCFNA has not implemented procedures to review supporting documentation, on a test basis, except for testing performed during routine monitoring reviews generally conducted once every 1 to 3 years for each facility/sponsor, and technical assistance reviews performed for all new facilities/sponsors or at the request of the facility/sponsor. Additionally, as noted in finding number 2025-011, continued weaknesses in the BCFNA monitoring procedures and noncompliance with subrecipient monitoring requirements were identified. Our review of documentation supporting a randomly-selected sample of 60 BCFNA monitoring reviews conducted for 60 CACFP facilities/sponsors during the year ended June 30, 2025, noted BCFNA disallowances (overclaims/underclaims) in 50 of 58 (86%) reviews for which meal reimbursement claims were tested and errors quantified. Overclaims totaled $72,561 (43 reviews) and underclaims totaled $4,275 (7 reviews), with a net overclaim of $68,286 or at least 12% of claims tested by the BCFNA. Disallowances resulted from various errors including incorrect or unsupported eligibility determinations, meal counts and attendance records, or noncompliance associated with menus and food purchases. The BCFNA adjusted subsequent claims to recoup or reimburse for the identified overclaims/underclaims. Erroneous and unsupported reimbursements represent at least 12% of meal reimbursements tested. If similar errors were made on the remaining population of CACFP meal reimbursements totaling approximately $69.9 million, unallowable costs could be significant. The table below summarizes audit sample results from the prior fiscal year 2023 and 2024 audits and current fiscal year 2025 audit. For each year, we performed a randomly-selected sample of BCFNA monitoring reviews conducted for CACFP facilities/sponsors during the applicable year. Without sufficient controls to ensure the accuracy of facility/sponsor meal reimbursement claims, the BCFNA cannot demonstrate adequate internal controls to ensure CACFP costs are allowable and supported, and the risk of paying unsupported and unallowable claims will continue. Regulation 7 CFR Section 226.7(k) requires the BCFNA to establish procedures for institutions to properly submit claims for reimbursement. Such procedures must include edit checks, including but not limited to, ensuring payments are made only for approved meal types and that the number of meals for which reimbursement is provided does not exceed the product of the total enrollment times operating days times approved meal types. Regulation 2 CFR Section 200.403 (within 2 CFR Part 200, known as Uniform Guidance), provides that costs charged to federal programs should be necessary and reasonable for the performance of the federal award and adequately documented. Further, 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." In response to the USDA - Food and Nutrition Service (FNS) resolution of the fiscal year 2023 finding, the BCFNA made some changes such as improving application and corrective action plan processes. To prevent continued unallowable and unsupported reimbursements to subrecipients, the BCFNA needs to continue to strengthen internal controls over meal reimbursements. An April 2025 email from an FNS official to the DHSS, provided to auditors by DHSS officials, states the fiscal year 2023 finding was not sustained by the FNS because (1) the FNS does not require or expect the BCFNA to validate claims at the time of claim submission, and (2) the BCFNA was in compliance with edit check requirements. However, the prior audit finding neither recommended the BCFNA validate claims at the time of submission nor noted noncompliance with edit check requirements. As of August 2026, the DHSS had received no communication from the FNS regarding the fiscal year 2024 finding. Finding Classification This finding is classified as a material weakness in internal control and material noncompliance with the federal activities allowed, allowable costs, and subrecipient monitoring requirements. The noncompliance identified in the finding is material based on the results of our audit sample, which identified at least 12% of subrecipient meal reimbursements tested by the BCFNA were not in compliance with federal requirements. The 12% error rate exceeds our audit materiality threshold of 4%. While the errors identified in the finding were corrected, similar material noncompliance in the remainder of the payments not tested is likely. Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits, and the AICPA Audit Guide: Government Auditing Standards and Single Audits (Audit Guide). The Audit Guide provides the following definitions regarding internal control deficiencies: "A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis." "A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis." "[A] reasonable possibility exists when the likelihood of the event is either reasonably possible or probable …" Reasonably possible is "[t]he chance of the future event or events occurring is more than remote but less than likely." Probable means "[t]he future event or events are likely to occur." The failure to design and implement adequate controls and procedures to ensure CACFP reimbursements to subrecipients are allowable and supported led to material noncompliance with the applicable requirements. The BCFNA's controls failed to prevent the material noncompliance identified. While the BCFNA's controls detected and corrected the payment errors identified, the detection and correction was not timely, occurring up to 3 years after the payments were made. Also, the detection and correction was limited to only 1 test month per subrecipient without any attempt to identify and correct noncompliance that occurred beyond the test month because, as noted at finding number 2025-011, the BCFNA's controls do not provide for expanded testing when significant errors are identified. Therefore, similar, material noncompliance in the remainder of the payments not tested is likely. Further, because the internal control deficiencies have not been corrected, similar, material noncompliance in future payments is likely. For these reasons, the deficiencies are considered a material weakness. Recommendation The DHSS through the BCFNA continue to strengthen internal controls over meal reimbursements to CACFP facilities/sponsors to ensure costs are allowable and supported. Auditee's Response We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement. Auditor's Comment The DHSS Corrective Action Plan (CAP) states the DHSS, for the third year in a row, disagrees with the finding and believes no corrective action is required because (1) they believe controls over meal reimbursements are in compliance with USDA requirements and guidance, and (2) the nearly identical FY23 finding (finding number 2023-012) was not sustained by the USDA. However, in making these statements, the DHSS ignored the noncompliance with specific USDA and Uniform Guidance requirements identified in the finding, and failed to recognize and acknowledge that existing subrecipient reimbursement and monitoring procedures have allowed serious and material subrecipient noncompliance year after year. The statement that the FY23 finding was not sustained by the USDA misrepresents the outcome of the finding resolution, as the USDA required the DHSS to implement changes as part of that resolution (see further explanation in the finding). As of August 2026, the DHSS had received no communication from the USDA regarding the fiscal year 2024 finding. The DHSS further argues their recoupment of the overclaims identified in the finding reduces the severity of the finding. However, existing recoupment practices are not sufficient to deter and prevent similar improper payments in the future. Regulation 7 CFR Section 226.7(k) requires the BCFNA to establish procedures for subrecipients to properly submit claims for reimbursement. Given the extent of material subrecipient noncompliance that continues to occur, BCFNA procedures are clearly not sufficient to prevent future noncompliance. The BCFNA has focused on individual components of its systems, but has not holistically evaluated whether the procedures, collectively and in their entirety, comply with the federal requirements intended to ensure subrecipient reimbursements are allowable and supported. The BCFNA continues to strictly follow existing procedures without making adequate adjustments to address and mitigate the serious subrecipient reimbursement problems. Recognizing problems and responding to them are critical components of an effective internal control system designed to ensure compliance with the federal requirements. The DHSS CAP includes additional misrepresentations of the contents of the finding. These statements, which attempt to negate or reduce the significance of the noncompliance noted in the finding, are listed below: • The CAP states the sentence stating meal reimbursements are made without any supporting documentation is "factually incorrect" because the subrecipients are required to maintain documentation. However, that sentence, which correctly summarizes procedures outlined in the previous paragraph, is referring to documentation maintained by the subrecipients but not submitted to or reviewed by the DHSS at the time of reimbursement. • The CAP claims the SAO projected the sample errors to the full population of reimbursements for the year. This statement is not true, as the SAO did not perform a statistical sample, nor did we project sample results to the population. While the SAO did not project sample results, it is worth noting that the sample was pulled from a population of 389 monitoring reviews performed during the year that consisted of approximately one-half of all CACFP subrecipients. Subrecipient data clearly shows significant subrecipient noncompliance continues to occur within the CACFP. These problems cannot be denied and should not be ignored. Until the DHSS recognizes these problems, acknowledges there are weaknesses in its existing procedures, and takes action to strengthen them, significant improper payments to subrecipients will likely continue.

Federal Agency: United States Department of Agriculture (USDA) Federal Program: 10.558 Child and Adult Care Food Program (CACFP) 2024 and 2025 CACFP 2024 and 2025 CACFP-CIL 2024 and 2025 CACFP-SPON State Agency: Department of Health and Senior Services (DHSS) - Bureau of Community Food and Nutrition Assistance (BCFNA) Type of Finding: Internal Control (Material Weakness) and Material Noncompliance Questioned Costs: Unknown Compliance Requirement: Subrecipient Monitoring As noted in our two previous audits, during the year ended June 30, 2025, BCFNA subrecipient monitoring procedures were not in compliance with subrecipient monitoring requirements and were not sufficient to ensure CACFP subrecipient compliance with program requirements. As noted at finding 2025-010, audit sample results show the subrecipient payment error rate continued to increase. The BCFNA has implemented only a few changes to address our prior-year audit findings and strengthen monitoring procedures. During the year ended June 30, 2025, the BCFNA disbursed approximately $69.9 million to over 730 CACFP subrecipients, which consist of child and adult care centers and sponsors of centers. Disbursements to subrecipients represented approximately 98% of the program's expenditures. As part of its pass-through responsibilities, 7 CFR Section 226.6(a)(5), the BCFNA is required to ensure subrecipients effectively operate the program. Regulation 2 CFR Section 200.332(c) requires pass-through entities to evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Regulation 2 CFR Section 200.332(e) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward, and achieves goals and objectives. The BCFNA's subrecipient monitoring process, outlined in the Internal Nutritionist Manual, provides the requirements for monitoring the CACFP facilities/sponsors. The manual provides the planned frequency and type of monitoring activities, monitoring methods, and corrective action requirements. The manual requires the preparation of a risk assessment at the end of each monitoring review that assigns points to the facility/sponsor based on the number and severity of deficiencies and findings, with more deficiencies leading to a higher score. The score determines the required timing of future monitoring reviews of the facility/sponsor. Facilities/sponsors with a score of 0 to 10 points will be next monitored in 3 years, a score of 11 to 25 points within 2 years, a score of 26 to 35 points in 1 year; and facilities/sponsors with a score of 36 or more points are considered "seriously deficient" and are required to submit a Corrective Action Plan (CAP). If the CAP is deemed sufficient, seriously deficient facilities/sponsors will have a CAP verification review in 6 months. A score is not assigned for 6-month CAP verification reviews. During FY25, the BCFNA began performing technical assistance reviews for all new facilities/sponsors. In May 2024, when the BCFNA changed the risk assessment and scoring system, the BCFNA ceased assigning a grade of A, B, B-, or C to each review and widened the score ranges and associated review requirements. DHSS officials indicated the scores assessed by the new system are frequently higher than those assessed under the previous manual system. The impact of these changes on the frequency and effectiveness of the monitoring reviews is unclear. During each monitoring review, BCFNA personnel review documentation supporting a sample of claims during a test month. Any identified errors and associated overclaims/underclaims exceeding established thresholds are recouped/reimbursed in the facility's/sponsor's future claims. When reviews identify noncompliance, facilities/sponsors are required to prepare and submit a CAP to the BCFNA. In addition, as noted at finding number 2025-010, the BCFNA relies on these subrecipient monitoring procedures to prevent and detect meal reimbursement claim errors. Monitoring reviews have identified significant issues and claim errors, including some potentially fraudulent activity, and led to over 15 contract terminations in recent years. To test compliance with subrecipient monitoring requirements, and to evaluate the effectiveness of BCFNA monitoring procedures, we reviewed and analyzed a randomly-selected sample of 60 BCFNA monitoring reviews conducted for 60 CACFP facilities/sponsors during the year ended June 30, 2025. While our review found the sample monitoring reviews were performed in accordance with the policies and procedures outlined in the Internal Nutritionist Manual, we identified areas where these policies and procedures could be strengthened and improved to ensure facilities/sponsors comply with program requirements and submit proper claims. Our review and analysis of the 60 sampled monitoring reviews noted the monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims. Our comparison of the sampled reviews to prior reviews noted deficient facilities/sponsors generally had continued deficiencies and little improvement from prior reviews, as follows: • Of the 58 sampled monitoring reviews assigned a score, 26 (45%) facilities/sponsors had a score of 10 or less, while 32 (55%) had a score of 11 or more. • Of the 29 facilities/sponsors that had a score of 11 or more and had a prior review, 27 (93%) had the same or higher score than the prior review indicating a lack of significant improvement or decline in compliance since the prior review. • Of the 2 facilities/sponsors that had a score of 36 or more and had a prior review, both had higher scores than the prior review. • For 50 of 58 monitoring reviews (86%) for which the BCFNA tested claims and quantified errors (with claims totaling $568,271 during the test months), the BCFNA identified overclaims totaling $72,561 and underclaims totaling $4,275, netting to $68,286, or at least 12% of the reimbursements tested. As noted at finding 2025-010, audit sample results show the subrecipient payment error rate increased from prior years. Our review of BCFNA subrecipient monitoring procedures during the year ended June 30, 2025, noted areas that should be strengthened and improved. Claims testing The Internal Nutritionist Manual and monitoring practices provide for testing of a sample of claims within only 1 test month during each monitoring review, and do not provide for expanded testing when significant errors are identified. For example, 2 facilities had 100% overpayment rates and were assigned scores of 34 and 13; however, additional testing was not performed for either facility. Neither facility was deemed "seriously deficient;" and the facilities were scheduled to be next reviewed in 1 year and 2 years, respectively. BCFNA personnel indicated monitoring reviews are limited to only 1 test month since the USDA Monitoring Handbook does not require expanded testing of records beyond 1 month. However, the USDA Monitoring Handbook suggests testing activities during 1 test month, and also suggests the state agency may determine additional review is warranted and review records beyond the test month to determine the extent of the noncompliance. When significant errors are identified, additional testing would help BCFNA nutritionists determine the extent that instances of noncompliance are isolated versus pervasive. Such information would be valuable to the overall conclusions and points assigned to the review, and in decisions regarding subsequent monitoring. Overclaim recoupment BCFNA subrecipient monitoring procedures do not provide for identification and pursuit of recoupment of all overpayments associated with errors identified during monitoring reviews. When overclaims due to noncompliance with eligibility requirements are identified during monitoring reviews, the BCFNA only identifies and seeks recoupment for the overclaims made during the test month. Overclaims associated with eligibility errors begin at the time the eligibility determination was made and continue until the error is discovered. Although the BCFNA is aware noncompliance occurred during the month(s) before the test month, the BCFNA does not attempt to identify those overclaims. In addition, when a facility/sponsor is terminated, the BCFNA does not always identify or seek recoupment of overclaim amounts. In our sample of 60 monitoring reviews, the contract for 1 sponsor was terminated as a result of a 6-month CAP verification review. For this sponsor, in the review prior to the 6-month CAP verification review, the BCFNA identified and recouped overclaims of $2,879, or 100% of total claims tested. In the subsequent 6-month CAP verification review, significant claim errors were identified in the test month claims paid, which totaled $4,091, and the sponsor was terminated. However, the test month claims were not fully tested, and overclaims were not identified or recouped. Any overclaims not identified and recouped from this sponsor would be considered questioned costs; however, those questioned costs are unknown. BCFNA officials indicated they do not pursue recoupment of overclaims beyond the test month because this practice is allowed by the USDA. They indicated they pursue recoupment of overclaims for facilities/sponsors with terminated contracts on a case-by-case basis, considering various factors. However, 7 CFR Section 226.14 provides that state agencies shall disallow and recover any portion of a claim for reimbursement not properly payable, including claims not made in accordance with recordkeeping requirements. Pursuing full recoupment would hold facilities/sponsors accountable for all overclaims and would serve as a deterrent to future errors, noncompliance, and overclaims. Further, without procedures to identify and recoup all overclaims, there is a risk that significant overclaims will go undetected and unrecouped, and questioned costs could be significant. Conclusions In addition to complying with federal requirements, strong subrecipient monitoring procedures are necessary to ensure facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. Subrecipient monitoring procedures should be designed to prevent future deficiencies and noncompliance. Without strong internal controls, there is increased risk of noncompliance, errors, fraud, waste, and abuse of federal funds. Strong monitoring procedures would ensure facilities/sponsors are held accountable for and correct errors and noncompliance identified. Regulation 2 CFR Section 200.332(h) requires pass-through entities to consider whether the results of a subrecipient's audit, site visits, or other monitoring necessitate adjustments to the pass-through entity's records. Further, 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Finding classification This finding is classified as a material weakness in internal control and material noncompliance with the federal subrecipient monitoring requirements. Our audit of the BCFNA's compliance with federal subrecipient monitoring requirements concluded the BCFNA did not materially comply with federal requirements to ensure subrecipients effectively operate the CACFP and to monitor the activities of the subrecipient as necessary to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward, and achieves goals and objectives. This conclusion is based on the facts, deficiencies, and noncompliance stated in the finding, including the following: 1) Disbursements to subrecipients represented approximately 98% of the CACFP expenditures. 2) BCFNA subrecipient monitoring reviews identified significant errors, noncompliance, disallowances, and overclaims; and deficiencies identified often continued for years with little improvement from review to review. The 12% subrecipient payment error rate identified by the BCFNA, which exceeds our audit materiality threshold of 4%, along with the high rate of continued noncompliance, serve as indicators of the ineffectiveness of the BCFNA monitoring process. 3) The BCFNA did not comply with federal subrecipient monitoring requirements regarding disallowing and recovering improper payments. 4) Multiple deficiencies in monitoring procedures were identified. In conducting a Single Audit in accordance with 2 CFR Part 200 (Uniform Guidance), auditors are required by 2 CFR Section 200.514(d)(1)(2), to determine whether the auditee has complied with federal statutes, regulations, and the terms and conditions of federal awards that may have a direct and material effect on each of its major programs, as outlined in the OMB Compliance Supplement. While compliance with the USDA CACFP handbooks was considered in our audit, our conclusion on compliance is based on the BCFNA's compliance with the federal statutes and regulations, as required. Our decisions regarding the classification of the internal control deficiencies were made in accordance with AU-C Section 935, Compliance Audits, and the AICPA Audit Guide: Government Auditing Standards and Single Audits (Audit Guide). The Audit Guide provides the following definitions regarding internal control deficiencies: A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis. "[A] reasonable possibility exists when the likelihood of the event is either reasonably possible or probable…" Reasonably possible is when "[t]he chance of the future event or events occurring is more than remote but less than likely." Probable means "[t]he future event or events are likely to occur." The failure to design and implement adequate controls and procedures over subrecipient monitoring led to material noncompliance with the subrecipient monitoring requirements. The BCFNA's controls failed to develop an effective subrecipient monitoring process that ensures subrecipients comply with federal statutes, regulations, and the terms and conditions of subawards, and achieve goals and objectives. Because the internal control deficiencies have not been corrected, it is probable that the material noncompliance will continue. For these reasons, the deficiencies are considered a material weakness. Recommendation The DHSS through the BCFNA continue to review, strengthen, and enforce subrecipient monitoring procedures to ensure CACFP facilities/sponsors comply with program requirements, submit proper claims, and address deficiencies identified. The BCFNA should enhance procedures to provide for identification and recoupment of overclaims associated with all errors identified during monitoring reviews, as required by federal regulations; and expand testing when significant errors are identified. The DHSS should identify and recoup the overclaims for the terminated sponsor noted in this finding. Auditee's Response We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement. Auditor's Comment The DHSS Corrective Action Plan (CAP) states the DHSS, for the third year in a row, disagrees with the finding and believes no corrective action is required because (1) they believe subrecipient monitoring, claim recoupment, and risk assessment procedures comply with USDA requirements; and (2) the similar FY23 finding (finding number 2023-013) was closed by the USDA after reviewing the DHSS corrective action plan. The DHSS CAP further states they believe the SAO is holding the DHSS to higher standards than required by federal guidance and regulations and that implementing the SAO's recommendations would cause undue burden on the participants and providers of the program which the USDA warns against. However, in making these statements, the DHSS ignored the noncompliance with specific USDA and Uniform Guidance requirements identified in the finding, and failed to recognize and acknowledge that existing subrecipient reimbursement and monitoring procedures have allowed serious and material subrecipient noncompliance year after year. Furthermore, federal agency closure of a prior year finding does not protect the DHSS from future findings. As of August 2026, the DHSS had received no communication from the USDA regarding the fiscal year 2024 finding. Regarding the finding statement that policies and procedures should be strengthened and improved, the DHSS CAP states the SAO has applied performance audit standards instead of single audit standards. This statement is incorrect. While not required, we have included a finding classification section that outlines the auditor's responsibilities under the single audit, as well as audit guidance followed in making decisions regarding the BCFNA's internal controls and compliance with the federal statutes and regulations. Regarding the finding section pertaining to recoupment of overclaims, the DHSS CAP claims the "BCFNA pursues recoupment of overclaims of only the test month per USDA requirements, although when warranted, additional reviews are conducted beyond the test month. In addition, BCFNA officials pursue recoupment of overclaims for facilities/sponsors with terminated contracts on a case-by-case basis, taking into consideration various factors." While the DHSS makes this claim, in our sample of 60 monitoring reviews, the DHSS did not expand testing beyond the test month for any reviews, and did not seek recoupment of overclaims for the facility/sponsor terminated as a result of the monitoring reviews. As part of its pass-through responsibilities outlined in the federal regulations, the BCFNA is required to ensure subrecipients comply with federal regulations and terms and conditions of the subaward, and effectively operate the program. Given the extent of material subrecipient noncompliance that continues to occur, BCFNA procedures are clearly not sufficient to deter and prevent future noncompliance. The BCFNA has focused on individual components of its systems, but has not holistically evaluated whether the procedures, collectively and in their entirety, comply with the federal requirements intended to ensure subrecipient reimbursements are allowable and supported. The BCFNA continues to strictly follow existing procedures without making adequate adjustments to address and mitigate the serious subrecipient reimbursement problems. Recognizing problems and responding to them are critical components of an effective internal control system designed to ensure compliance with the federal requirements. For three years, the SAO has recommended the BCFNA enhance procedures related to identification and recoupment of overclaims, as required by federal regulations; and expand testing when significant errors are identified. The BCFNA has ignored these recommendations; and as a result, lacks a sufficient method for deterring future noncompliance. While the DHSS argues these recommendations would cause undue burden on the participants of the program and the subrecipients, not implementing these recommendations could cause an undue burden on the DHSS and the subrecipients, since weak consequences or deterrents to noncompliance leads to continued noncompliance, which requires increased monitoring and follow-up efforts. Subrecipient data clearly shows significant subrecipient noncompliance is occurring within the CACFP. These problems cannot be denied and should not be ignored. Until the DHSS recognizes these problems, acknowledges there are weaknesses in its existing procedures, and takes action to strengthen them, significant improper payments to subrecipients will likely continue.

Federal Agency: Department of Housing and Urban Development (HUD) Federal Program: 14.228 COVID-19 - Community Development Block Grants/State's Program and Non-Entitlement Grants in Hawaii 2020 - B-20-DW-29-0001 14.228 Community Development Block Grants/State's Program and Non-Entitlement Grants in Hawaii 2017 - B-17-DC-29-0001 2018 - B-18-DC-29-0001, B-18-DP-29-0001, and B-18-DP-29-0002 2019 - B-19-DC-29-0001 and B-19-DP-29-0001 2020 - B-20-DC-29-0001 2021 - B-21-DC-29-0001 2022 - B-22-DC-29-0001 State Agency: Department of Economic Development (DED) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirement: Reporting DED controls and procedures are not sufficient to fully comply with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the Community Development Block Grant (CDBG) program. During state fiscal year 2025, the DED did not fully comply with FFATA reporting requirements for 18 of 27 subawards reviewed. During state fiscal year 2025, the DED disbursed approximately $56.2 million in first-tier subawards to 178 subrecipients of the CDBG program. First-tier subaward payments accounted for approximately 97% of the program's expenditures. The FFATA requires comprehensive reporting for certain federal awards to promote transparency and accountability over the use of the federal funds. Regulation 2 CFR Part 170, Appendix A, requires the DED to report first-tier subawards of $30,000 or more no later than the end of the month following the month in which the subaward was made. The regulation provides "[t]he recipient must also report a subaward if a modification increases the Federal funding to an amount that equals or exceeds $30,000. All reported subawards should reflect the total amount of the subaward." Information is reported to System for Award Management (SAM.gov) (the FFATA Subaward Reporting System [FSRS.gov] prior to March 2025) and is publicly available at USAspending.gov. The DED issues CDBG program subawards to local governments, such as counties and cities, for multiple-year periods. Due to the nature of the subawards and because the DED can spend federal awards over a several-year period (typically 8 federal fiscal years), the DED continuously modifies and updates subaward amounts and sources as subaward terms and conditions change, and as federal awards are reallocated to the subawards. Modifications to subawards impact FFATA reporting, and uncorrected reporting errors can carry forward for many years. To test compliance with FFATA reporting requirements, we reviewed a random sample of 27 CDBG subawards, totaling $18,598,846, that were active during the year ended June 30, 2025. For each subaward tested, we reviewed the original issuance and any applicable modifications, including issuances/modifications that occurred before the year ended June 30, 2025 (our review for timeliness of reporting was limited to the year ended June 30, 2025). Of the 27 subawards, 18 (67%) had instances of noncompliance (11 of which had at least 1 instance during the year ended June 30, 2025), as shown in the following table: In addition to the errors noted in the table, FFATA reports for 11 of 27 (41%) subawards did not report the correct federal award identification number (FAIN), or correct combination of FAINs. As a result, some or all of the subaward amounts were reported under incorrect federal award year(s). The following example explains 1 subaward that had multiple types of errors as of auditors' testing through February 2026: When the subaward totaling $957,409 was issued in April 2021, the DED timely and correctly completed FFATA reporting for $957,409, but reported the incorrect FAIN (federal award year 2019 instead of 2018). When the subaward was modified in August 2024, increasing the amount by $121,179, to $1,078,588, the DED correctly reported the increase amount and the FAIN, but completed FFATA reporting 1 month late. When the subaward was again modified in April 2025, decreasing the amount by $15,000, to $1,063,588, the DED did not complete any FFATA reporting. As a result, the subaward was overstated by $15,000 on USAspending.gov, and approximately 90% of the total amount was reported under an incorrect federal award year. Many FFATA reporting errors noted were associated with subaward modifications. Each of the 27 sampled subawards remained above $30,000 following each modification. DED personnel disagreed with some of the errors associated with modifications because they believe FFATA reporting is only required for subaward increases of $30,000 or more, regardless of the resulting subaward amount. They further stated they believe FFATA reporting is not required for any decreases of subaward amounts. However, the FFATA clearly states reporting is required if the modification results in a subaward amount that equals or exceeds $30,000 and that the total subaward amount should be reflected. Without adequate internal control over FFATA reporting, there is less assurance the information included in the FFATA reporting is complete, accurate, and submitted timely. In addition to noncompliance with federal requirements, FFATA inaccuracies increase the risk that those using the reports could rely on incomplete information. Regulation 2 CFR Section 200.303(a) requires recipients to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DED strengthen internal controls to ensure information is timely and accurately reported for the CDBG program and complete FFATA reporting in accordance with the applicable requirements. Auditee's Response We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding. Auditor's Comment The DED Corrective Action Plan (CAP) states the DED partially agrees with the recommendation, and provides the following 4 arguments: (1) The DED disagrees with the inclusion of errors in the audit report that were related to subawards executed prior to the audit period (year ended June 30, 2025), and believes the correct audit population should only include new subawards and amendments executed during the audit period, rather than all active subawards. However, as noted in the finding, due to the nature of the subawards (including DED's continuous modifications over a several year period), and the risk that uncorrected reporting errors can carry forward for many years, we reviewed a sample of subawards that were active during the year ended June 30, 2025. It was necessary to review the subaward, including original issuance and any applicable modifications, in entirety to determine the accuracy of FFATA reporting. Ignoring some activity could have led to inaccurate conclusions. (2) The DED believes the finding is inconsistent with the regulatory intent regarding systemic noncompliance because the DED corrected certain FFATA reporting discrepancies prior to and during the audit period. However, as reported in the finding, these corrections did not fully address all FFATA discrepancies. In addition, this argument disregards the auditor's responsibility to follow criteria outlined in 2 CFR 200.516 (Uniform Guidance) for reporting audit findings. The DED's insufficient internal controls and noncompliance with FFATA reporting requirements are systemic in nature; and therefore, the finding is classified as a significant deficiency in internal control, which is required to be reported. (3) Under the DED's literal interpretation of 2 CFR Part 170, Appendix A, DED personnel believe the DED does not have to report any deobligations (decreases of subaward amounts) and it only has to report subaward increases of $30,000 or more, regardless of the resulting subaward amount. (4) The DED disagrees subawards were reported in the incorrect federal award year (FAIN) because DED personnel do not believe they have to report modifications to FAIN information that occur after the initial award. Arguments (3) and (4) directly conflict with the FFATA's stated goal, which is "[t]o require full disclosure of all entities and organizations receiving federal funds." Further, the OMB Compliance Supplement defines "amount of subaward" as "[t]he net dollar amount of federal funds awarded to the subawardee including modifications." In addition to noncompliance, not reporting (a) deobligations, (b) all modifications that result in a subaward amount that equals or exceeds $30,000, and (c) FAIN modifications, prevents users from accessing complete and accurate information. The following example further illustrates the impact of inaccurate FFATA reporting by the DED. In our review of some subawards associated with FAIN B-19-DC-29-0001 (one of the DED's federal awards during the 2019 federal award year), we observed the USASpending.gov website showed the DED received $22.6 million in federal award funding, but awarded $95.9 million in subawards of these federal funds, over 4 times the federal award amount. Incomplete and inaccurate FFATA reporting leads to limited accuracy and transparency to the public. Until the errors are corrected, the DED's FFATA reporting will remain erroneous in future years.

Federal Agency: Department of the Treasury Federal Program: 21.027 COVID-19 - Coronavirus State and Local Fiscal Recovery Funds SLFRP4542 State Agency: Office of Administration (OA) Type of Finding: A - Internal Control (Material Weakness) and Material Noncompliance B - Internal Control (Material Weakness) and Material Noncompliance Compliance Requirement: Subrecipient Monitoring As noted in our previous 2 audits, during the year ended June 30, 2025, the OA had not established policies and procedures regarding monitoring subrecipients of the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program. As a result, the OA and 2 other state agencies did not comply with the Uniform Guidance (UG) requirements regarding identifying and monitoring subrecipients of the SLFRF program. The OA is the lead agency responsible for administering the SLFRF program. The purpose of the SLFRF program is to provide funding to respond to the COVID-19 public health emergency (PHE) or its negative impacts; respond to workers performing essential work during the PHE; provide government services, to the extent of the reduction in revenue due to the PHE (revenue replacement); make necessary investments in water, sewer, or broadband infrastructure; provide emergency relief from natural disasters or the negative economic impacts of natural disasters; and finance certain surface transportation and housing projects. The OA and various state agencies designed projects within the various allowable SLFRF program categories, and are responsible for administering the projects. The OA developed the American Rescue Plan Act Grant Management Portal (portal) to serve as the official repository of information and documentation supporting each SLFRF program project. The state agencies upload supporting documentation to the portal, including contracts, payment requests, and other supporting documentation. Most payments are made on a reimbursement basis. The OA reviews each payment request and processes the payments. Some SLFRF program projects are administered through subawards. The OA and various state agencies establish contracts with each subrecipient that outline various SLFRF program requirements, terms, and conditions. In the Schedule of Expenditures of Federal Awards (SEFA), the OA reported that approximately $302 million was passed through to subrecipients of the SLFRF program during the year ended June 30, 2025. This amount represents approximately 41% of the SLFRF program expenditures. These awards were administered through the OA and 8 other state agencies. In response to our prior audit findings, the OA held a training for state agency personnel in August 2024; sent a letter to state agencies in January 2025 covering agency responsibilities related to certain SLFRF program subrecipient monitoring requirements, such as subrecipient determinations, risk assessments, and single audits; and executed interagency agreements with the various state agencies in October and November 2025 (after the current audit period). Of the 8 state agencies that administered subawards reported in the SEFA during the year ended June 30, 2025, 4 administered the majority of the subawards, with payments totaling approximately $272 million, or 90% of the total subrecipient payments reported in the SEFA. These 4 state agencies were the Department of Mental Health (DMH), the Department of Higher Education and Workforce Development (DHEWD), the Department of Natural Resources (DNR), and the Department of Economic Development (DED). Our review and testing of subrecipient monitoring procedures focused on the OA and these 4 state agencies. For the 4 state agencies, a total of 287 recipients were identified as subrecipients in the SEFA. To understand the OA and state agency procedures, and to test compliance with subrecipient monitoring requirements, we randomly selected a sample of payments for 30 subrecipient projects from the 4 state agencies. The 30 subrecipients were awarded a total of approximately $191 million in SLFRF program funding and were paid a total of approximately $53 million during the year ended June 30, 2025. We reviewed records in the portal and requested information from the state agencies to support the subawards. A. Subrecipient Determination During the year ended June 30, 2025, the OA had not established policies and procedures to determine whether recipients of the SLFRF program funds were subrecipients or contractors. As a result, 1 of the 4 state agencies, the DHEWD, had not conducted determinations for any of their subrecipients. Subrecipient monitoring requirements are outlined in the UG. Regulation 2 CFR Section 200.331 states the pass-through entity is responsible for making case-by-case determinations to determine whether the entity receiving federal funds is a subrecipient or a contractor. The classification of a subrecipient is dependent upon whether the entity is responsible for making eligibility determinations for assistance, has its performance measured in relation to whether the objectives of the federal program were met, has responsibility for programmatic decision-making, is responsible for adherence to federal program requirements, and implements a program for a public purpose. The OA did not evaluate each SLFRF program recipient for the UG criteria, and did not make a determination of whether the entity was a subrecipient or contractor. OA officials assigned responsibility for making these determinations and identifying subrecipients to the applicable state agencies, but did not provide clear guidance to the state agencies or ensure the state agencies properly performed and documented the determinations. The DHEWD had not conducted determinations for either of its 2 sampled subrecipients. DHEWD personnel indicated they did not believe they were responsible for performing subrecipient determinations for the SLFRF program. Without adequate procedures over subrecipient or contractor determinations, the OA lacks assurance that its subrecipients have been identified for subrecipient monitoring purposes. B. Subrecipient Monitoring During the year ended June 30, 2025, the OA did not implement an effective subrecipient monitoring program to monitor the SLFRF program subrecipients. As a result, 2 of the 4 agencies reviewed, the DHEWD and the DMH, did not perform sufficient subrecipient monitoring procedures. Regulation 2 CFR Section 200.332(c) states that pass-through entities must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Risk assessments may consider factors such as the subrecipient's prior experience with the same or similar subawards, the results of previous audits, whether the subrecipient has new personnel or new or substantially-changed systems, and the extent and results of any federal agency monitoring. Regulation 2 CFR Section 200.332(e) requires pass-through entities to monitor the activities of a subrecipient as necessary to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must (1) review financial and performance reports; (2) ensure the subrecipient takes corrective action on all significant developments that negatively affect the subaward; (3) issue a management decision for audit findings pertaining only to the federal award provided to the subrecipient from the pass-through entity; and (4) resolve audit findings specifically related to the subaward. To monitor subrecipients of the SLFRF program, the OA relies on its pre-payment monitoring process. During the year ended June 30, 2025, the OA did not perform any post-payment monitoring procedures, and relied on the state agencies to perform these procedures without sufficiently communicating with the state agencies regarding their subrecipient monitoring responsibilities or ensuring the state agencies performed monitoring reviews. Risk assessments The OA did not ensure required risk assessments for subrecipients of the SLFRF program were performed to determine the nature, timing, and extent of monitoring procedures necessary. Two of the 4 state agencies, the DHEWD and the DMH, did not perform any risk assessments for any of the sampled subrecipients. OA officials indicated risk assessment procedures are the responsibility of the state agencies; however, during the year ended June 30, 2025, the OA did not provide clear guidance to the state agencies or ensure the state agencies performed and used risk assessments as required. DHEWD officials indicated they did not perform subrecipient risk assessments because the subrecipients are institutions of higher education, to which the DHEWD distributes annual state funding. However, the UG does not provide for exemptions to the risk assessment requirements for such entities. DMH officials indicated assessments were informally completed; however, the DMH could not provide any documentation of such informal risk assessments or how those risk assessments were considered in monitoring decisions. DMH officials stated they are in the process of developing formal risk assessment tools. In addition to complying with federal requirements, risk assessments are necessary to ensure monitoring reviews are conducted with adequate frequency to help ensure subrecipient compliance with program requirements. The interagency agreements the OA executed with the various state agencies in October and November 2025 (after the current audit period) describe agency responsibilities for monitoring subrecipient compliance with SLFRF program requirements, including risk assessments. OA pre-payment monitoring process The OA has not developed policies and procedures outlining its pre-payment monitoring process and did not always clearly document monitoring performed prior to making payments. In their review and approval of each SLFRF program subrecipient payment request, OA officials stated they thoroughly review supporting documentation uploaded to the portal by the state agencies, including contracts, bid documentation, invoices, and other supporting documentation. OA officials further stated they review for compliance with certain types of SLFRF program compliance requirements, including allowable activities and allowable costs, procurement, and period of performance. However, the OA does not clearly document review procedures performed. For each of the 30 subrecipient projects sampled, the portal included documentation pertaining to some, but not all of the applicable compliance requirements. Without documented policies and procedures and documentation of prepayment monitoring procedures performed, the OA cannot demonstrate subrecipient monitoring procedures were performed. Additional monitoring procedures The OA did not monitor subrecipients beyond the pre-payment monitoring process previously described. OA officials stated post-payment monitoring procedures are the responsibility of the state agencies; however, during the year ended June 30, 2025, the OA did not sufficiently communicate with the agencies regarding subrecipient monitoring responsibilities or ensure the agencies performed monitoring reviews. Our review of subrecipient monitoring procedures at the 4 state agencies noted 2 agencies, the DHEWD and the DMH, had not developed written policies or procedures regarding subrecipient monitoring and did not perform sufficiently documented monitoring procedures. For 4 of 30 subrecipient projects sampled for the 4 agencies (13%), the DHEWD (2 subrecipients) and the DMH (2 subrecipients) could not provide documentation of subrecipient monitoring performed. While DHEWD officials indicated they perform pre-payment monitoring procedures, they could not provide documentation of such reviews for either of the 2 sampled projects. Furthermore, the DHEWD does not perform any additional subrecipient monitoring, such as monitoring subrecipients' compliance with procurement requirements. As a result, the DHEWD was unable to provide documentation to support the bidding of applicable aspects for 1 of 9 DHEWD projects sampled for a review of compliance with procurement requirements. While DMH officials indicated they perform annual billing service reviews to monitor subrecipients, the DMH did not perform such reviews for the 2 DMH projects sampled. In addition to noncompliance with subrecipient monitoring requirements, the failure to ensure sufficient monitoring procedures were performed and documented increases the risk that subrecipient noncompliance will not be prevented or detected timely. The interagency agreements the OA executed with the various state agencies in October and November 2025 (after the current audit period) describe agency responsibilities for monitoring subrecipient compliance with SLFRF program requirements. Conclusions The OA is the lead agency responsible for administering the SLFRF program. OA officials indicated the state agencies were responsible for some of the subrecipient monitoring requirements. However, without clear communication and monitoring of these responsibilities, the OA lacks assurance of compliance with all subrecipient monitoring requirements. Without an established subrecipient monitoring program, the OA cannot provide assurance subrecipients are complying with SLFRF program requirements and there is increased risk that noncompliance with program requirements or subaward terms and conditions will go undetected, or that subaward performance goals will not be achieved. In addition, a subrecipient monitoring program is necessary to demonstrate adequate internal controls over compliance with subrecipient monitoring requirements. Documented policies and procedures are necessary to clearly communicate responsibilities to the state agencies, prevent misunderstandings, and demonstrate adequate internal controls over compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." Paragraph 3.10 of the Standards for Internal Control in the Federal Government, also known as the Green Book, states, "[e]ffective documentation assists in management's design of internal control by establishing and communicating the who, what, when, where, and why of internal control execution to personnel. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, as well as a means to communicate that knowledge as needed to external parties, such as external auditors." Paragraph 12.01 states, "[m]anagement should implement control activities through policies." Recommendations The OA: A. Continue to work with the state agencies to ensure documented determinations are prepared to determine whether all recipients of SLFRF program funds are subrecipients or contractors. B. Develop policies and procedures outlining pre-payment monitoring procedures and document monitoring performed prior to making payments. The OA should also continue to ensure subrecipient monitoring tasks delegated to state agencies are adequately communicated. Procedures should be established to ensure subrecipient monitoring procedures are appropriately completed in accordance with the Uniform Guidance, including performing risk assessments for each subrecipient, monitoring for compliance with federal requirements and subaward terms and conditions, and ensuring subaward goals and objectives are achieved. Auditee's Response A. We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding. B. We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 93.667 Social Services Block Grant 2023 - 2301MOSOSR 2024 - 2401MOSOSR State Agencies: Department of Social Services (DSS) - Division of Finance and Administrative Services (DFAS) and Department of Health and Senior Services (DHSS) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirement: Reporting The DFAS does not have adequate internal controls and procedures to ensure Social Services Block Grant (SSBG) program Post-Expenditure Report activities are accurately reported. In addition, the DHSS does not have adequate internal controls and procedures to ensure DHSS activities are accurately reported. As a result, the Post-Expenditure Report filed during the audit period as originally submitted did not accurately report expenditures for the year ended June 30, 2024. The SSBG program allows states the flexibility to determine what services will be provided, consistent with statutory goals and objectives; who is eligible for the services; and how funds will be distributed among services and entities within the state, including whether to provide services directly or contract with other public or private agencies and individuals for the services. The DSS is the SSBG program's lead agency and is responsible for submitting to the federal DHHS, the annual Post-Expenditure Report of services provided during the period. The DSS, through a memorandum of understanding (MOU), contracts with the DHSS for some SSBG program services. The DSS and the DHSS separately administer program services, and separately track data supporting those services, such as expenditures and individuals served. The MOU requires the DHSS to provide the DSS with data to be included in the annual report. Both agencies complete portions of a shared spreadsheet with data respective to the agencies' services. The DFAS uses the shared spreadsheet to prepare the annual report. Our review of the SSBG Post-Expenditure Report for the year ended June 30, 2024, submitted by the DFAS in December 2024, noted errors in reported amounts for expenditures and recipient counts for various services. These errors occurred because personnel of both agencies entered inaccurate data in their respective portions of the shared spreadsheet. These inaccuracies, as well as other factors, led to errors in multiple lines and columns in the annual report. For example, the DFAS originally reported some adjustments to Case Management expenditures (line 2), instead of Protective Services - Children and Residential Treatment expenditures (lines 22 and 24), causing understatements and overstatements in these amounts, respectively. In addition, the DHSS originally reported expenditures for the federal fiscal year ended September 30, 2024, instead of the state fiscal year ended June 30, 2024 (lines 2, 3, 14, 28, and 29), causing both understatements and overstatements in the DHSS amounts. The effect of these errors on expenditures reported in the SSBG Post-Expenditure Report for the year ended June 30, 2024, is summarized in the table below. These errors were not detected during DFAS or DHSS supervisory review procedures. After we notified the DFAS of the DSS errors, the DFAS submitted a first revision to correct the errors. In response to our inquiries regarding the accuracy of the DHSS data, the DHSS corrected the shared spreadsheet and the DFAS submitted a second and final revision to correct the DHSS errors. Regulation 45 CFR Section 96.74 requires each state to submit an annual SSBG Post-Expenditure Report. Effective internal controls and procedures are needed to ensure these reports are accurately prepared. Such controls should include detailed supervisory reviews of data entered into shared spreadsheets and annual reports. Regulation 2 CFR Section 200.303(a) requires recipients to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendations The DSS through the DFAS strengthen internal controls and procedures to ensure annual SSBG Post-Expenditure Reports are accurately prepared and submitted. The DHSS strengthen internal controls and procedures to ensure expenditure data is accurately entered into the shared spreadsheet for inclusion in the annual SSBG Post-Expenditure Report. Auditees' Responses DSS: We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding. DHSS: We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 93.667 Social Services Block Grant 2025 - 2501MOSOSR State Agency: Department of Social Services (DSS) - Division of Finance and Administrative Services (DFAS) Type of Finding: Internal Control (Significant Deficiency) Compliance Requirement: Reporting DFAS controls and procedures are not sufficient to timely submit Federal Funding Accountability and Transparency Act (FFATA) reports for the Social Services Block Grant (SSBG) program. During state fiscal year 2025, the DFAS did not timely submit FFATA reports in accordance with its policy for 3 of 20 subrecipients reviewed. During state fiscal year 2025, the DSS disbursed approximately $7.5 million in first-tier subawards to 20 subrecipients of the SSBG program. First-tier subaward payments accounted for approximately 17% of the program's expenditures. The FFATA requires comprehensive reporting for certain federal awards to promote transparency and accountability over the use of the federal funds. Regulation 2 CFR Part 170, Appendix A, requires the DFAS to report first-tier subawards of $30,000 or more no later than the end of the month following the month in which the subaward was made. Information is reported to System for Award Management (SAM.gov) (the FFATA Subaward Reporting System [FSRS.gov] prior to March 2025), and is publicly available at USASpending.gov. The DSS issues SSBG program subawards for a 3-year period, covering 3 state fiscal years (from federal funding, for 4 federal fiscal years). For subawards requiring FFATA reporting, because the DSS receives federal funding for 1-year periods, FFATA reporting is required at the time the subaward is made under the first year of federal funding. FFATA reporting is again required for the same subaward when the second and subsequent years of federal funding are received (several months later, then annually). The requirements related to the timing of FFATA reporting are clearly stated in 2 CFR Part 170, Appendix A for initial subawards (first year of federal funding), but are not addressed for second and subsequent years. The DFAS addresses subsequent years in its FFATA reporting policy, which states "[i]f a contract period is over multiple grant years, the second tier [year] of funding will need to be tracked to ensure DSS uploads the second tier [year] by the end of the month following the date of the award." For example, for federal awards issued in November, the policy provides for reporting for second and subsequent years by the end of December. To test compliance with FFATA reporting requirements and DFAS policy, we randomly selected and reviewed subawards requiring FFATA reporting for 3 of the 20 SSBG program subrecipients, totaling $2,227,306 in state fiscal year 2025. The related agreements covered the 3-year period from July 1, 2022, to June 30, 2025. Because the federal fiscal year 2025 funding (fourth year of federal funding) was awarded in November 2024, the DFAS policy required FFATA reporting by December 2024. However, DFAS personnel did not submit these 3 reports until March 2025, resulting in a 3 month delay. DFAS personnel indicated the delays occurred due to a vacancy in the position responsible for FFATA reporting. They stated they do not believe the delays and noncompliance with their policy during the vacancy period were problematic because the federal regulations do not specifically address second and subsequent year reports, and they consider the policy to be an internal procedure rather than a requirement. Without adequate internal control over FFATA reporting, including adherence to policies and procedures, there is less assurance the information included in the FFATA reporting is submitted timely. Regulation 2 CFR Section 200.303(a) requires recipients to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DSS through the DFAS review, strengthen, and enforce internal controls to ensure information is timely reported for the SSBG program and complete FFATA reporting in accordance with its policy. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 93.777 State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare 2024 and 2025 - TITLEXVIII 2024 and 2025 - TITLEXIXSS 2024 and 2025 - CLIA 2024 and 2025 - XVIIIIMPAC State Agency: Department of Health and Senior Services (DHSS) - Section for Long-Term Care Regulation (SLCR) Type of Finding: Nonmaterial Noncompliance Compliance Requirement: Special Tests and Provisions As similarly noted in our 4 prior audit reports, the SLCR did not perform facility survey procedures within required timeframes. In our test of compliance with facility survey requirements for 60 surveys performed during the year ended June 30, 2025, we noted 14 Statements of Deficiencies and Plan of Corrections were sent 11 to 22 days after the survey exit instead of within 10 days, and 3 facility revisits were completed in 69-89 days instead of within 60 days of the initial survey date. The DHSS is the state survey agency charged with inspecting providers of the Medicaid program, including hospitals, nursing facilities, and other long-term care (LTC) facilities. Under 42 CFR Section 431.108, as a basis for participation in Medicaid, providers are subject to survey and certification by the DHHS - Centers for Medicare and Medicaid Services (DHHS-CMS) or the DHSS to ensure providers and suppliers are in compliance with regulatory health and safety standards and conditions of participation. During the year ended June 30, 2025, the DHSS through the SLCR surveyed 518 providers, including 482 LTC nursing facilities, 6 intermediate care facilities for individuals with intellectual disabilities, and 30 non-deemed hospitals. The DHHS-CMS provides the State Operations Manual (SOM) to state agencies as guidelines for the survey and certification of providers. SOM Chapter 2, Section 2728, requires the state agency to mail to the provider a copy of Form CMS-2567 (Statement of Deficiencies and Plan of Correction) within 10 working days after the survey exit. In addition, SOM Chapter 7, Section 7317.2, requires onsite revisits for LTC nursing facilities to occur any time between the last correction date on the plan of correction and the 60th day from the survey date to confirm the facility is in substantial compliance, and in certain cases, has the ability to remain in substantial compliance. To test compliance with survey and certification requirements, we randomly selected surveys performed during the year ended June 30, 2025, or the most recent survey if a survey had not been performed during this period, for 60 facilities including 45 LTC nursing facilities, 5 intermediate care facilities for individuals with intellectual disabilities, and 10 non-deemed hospitals. Due to survey delays and backlogs, 4 of the surveys sampled were performed in state fiscal year 2026, 44 in state fiscal year 2025, and 12 in state fiscal year 2024. Of the 58 facility surveys that required a Statement of Deficiencies and Plan of Correction, 14 statements (24%)were sent to facilities between 11 and 22 working days after the survey exit instead of within 10 working days as required. In addition, of the 26 LTC nursing facilities that required a revisit, the revisit to 3 facilities (12%) was completed 69 to 89 days after the initial survey date instead of within 60 days as required. DHSS officials indicated there were multiple contributing factors for these delays including DHSS staffing shortages, industry labor shortages, insufficient state and federal funding, increased workloads due to increased volume and severity of complaints received and violations identified, transitions to a new federal monitoring software system, and the backlog of surveys due. DHSS officials stated they hired part-time retired surveyors and contracted with outside survey companies to help with the increased workload and backlog. DHSS officials further indicated they are working with the DHHS-CMS to minimize the delays. Conducting survey procedures within required timeframes helps to ensure providers are timely notified of deficiencies requiring correction so that timely follow up on those deficiencies can occur to provide assurance facilities are providing services to their clients that are in compliance with health and safety standards and conditions of participation. Recommendation The DHSS through the SLCR ensure survey procedures are conducted within required timeframes. Auditee's Response We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding. Auditor's Comment The DHSS Corrective Action Plan states the DHSS disagrees a finding and corrective action is needed because (1) the State Auditor's Office (SAO) has determined the errors to be nonmaterial noncompliance, (2) the DHHS-CMS evaluation of DHSS compliance with revisit requirements has deemed the requirements to be "met" (compliance at a level at or exceeding a DHHS-CMS-determined threshold of 70%), and (3) the 3 revisit errors were not truly noncompliance because 1 revisit was not required and 2 revisits could not occur until additional actions were taken to address complaints. In conducting a single audit in accordance with 2 CFR Part 200 (Uniform Guidance), auditors are required by 2 CFR Section 200.514(d)(1)(2), to determine whether the auditee has complied with federal statutes, regulations, and the terms and conditions of federal awards that may have a direct and material effect on each of its major programs, as outlined in the OMB Compliance Supplement. The OMB Compliance Supplement, Part 4, for the Special Tests and Provisions Compliance Requirement directs auditors to "[d]etermine whether the state ensures that hospitals, nursing facilities, and [intermediate care facilities for individuals with intellectual disabilities] that serve Medicaid patients meet the prescribed health and safety standards." As stated in the finding, in making this determination, we review DHSS compliance with the DHHS-CMS SOM requirements. DHSS arguments that the revisit and SOD errors noted in the finding are not noncompliance and/or significant are not valid arguments, as explained below. (1) The SAO has not determined the 24% SOD or 12% revisit error rates to be insignificant. The finding was classified as nonmaterial noncompliance in our evaluation of the state's compliance with all 10 requirements within the Special Tests and Provisions Compliance Requirement for the Medicaid Cluster as a whole. All instances of noncompliance identified in the audit were cumulatively reviewed for purposes of forming our opinion on compliance with the direct and material compliance requirements. (2) The SAO has not misunderstood or disregarded the DHHS-CMS State Performance Standards System. While the DHHS-CMS also evaluates DHSS compliance through this system, the performance system is intended to measure the DHSS's level of compliance and identify when corrective action is needed to address deficiencies, but does not remove or waive the DHSS's responsibility to comply with the timeframes required by the SOM. (3) The audit exception listing provided to, and discussed with, the DHSS correctly lists the 3 revisit errors identified in the finding. Although the DHSS claims a revisit was not required for 1 of the errors, a revisit was clearly required per the SOM. The applicable survey letter documents the facility received a grid placement of "F". The SOM Matrix for Scope and Severity (Section 7400.3.1) classified a grid placement of "F" as "substandard quality of care," and SOM Section 7317.2 required revisits when surveys find "deficiencies that constitute substandard quality of care, harm, or immediate jeopardy." The DHSS provided no documentation or CMS policy that waived the revisit requirement for this facility. Regarding the other 2 errors, for which the DHSS argued the revisits could not occur until complaints regarding the facilities were resolved, the DHSS provided no CMS policy or directive indicating the DHSS could pause and delay revisits for facilities when complaints are received; and such revisit delays may allow deficiencies to continue and/or worsen over the course of the delay. In addition, the DHHS-CMS requirement to prioritize required actions does not remove or waive the DHSS's responsibility to perform revisits within required timeframes.

Federal Agency: Department of Health and Human Services Federal Program: 93.767 Children's Health Insurance Program (CHIP) 2024 - 2405MO3002 and 2405MO5021 2025 - 2505MO3002 and 2505MO5021 93.778 COVID-19 - Grants to States for Medicaid (Medicaid) 93.778 Grants to States for Medicaid 2024 - 2405MO5MAP and 2405MO5ADM 2025 - 2505MO5MAP and 2505MO5ADM State Agency: Department of Social Services (DSS) - MO HealthNet Division (MHD) and Family Support Division (FSD) Type of Finding: Internal Control (Material Weakness) Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility The DSS does not have sufficient controls to ensure participants of the Medicaid program and the CHIP are not improperly enrolled in more than one eligibility system. As of May 2025, there were 9,834 participants dually enrolled in both eligibility systems. There were approximately 1.27 million Medicaid program and CHIP participants as of June 30, 2025. The DSS maintains two eligibility systems for Medicaid program and CHIP participants. Eligibility for low-income adults, pregnant women, and children, based on their Modified Adjusted Gross Income (MAGI), is maintained in the Missouri Eligibility and Enrollment System (MEDES). Eligibility for participants who are aged 65 and over, blind, or disabled is maintained in the Family Assistance Management Information System (FAMIS). State match rates differ for each program within the MEDES and the FAMIS. For example, for the quarter ended June 30, 2025, the federal/state share was 90%/10% for the MEDES-based Adult Expansion Group (AEG) program and approximately 65%/35% for the FAMIS-based Aged, Blind and Disabled program. As of June 30, 2025, there were approximately 982,000 Medicaid program and CHIP participants in the MEDES, and approximately 288,000 Medicaid program and CHIP participants in the FAMIS. Prior to October 2021, most participants met Medicaid program/CHIP eligibility requirements within only one of the eligibility systems. With the expansion of the Medicaid program, and addition of AEG program eligibility to the MEDES, some AEG program participants meet program eligibility requirements in both systems and participants must choose which program they want to participate in. For example, some disabled and blind participants who were enrolled in the FAMIS prior to the expansion also met the eligibility requirements for the AEG program, and had the option to move from the FAMIS-based program to the MEDES-based AEG program. Also, with the expansion, AEG program-eligible participants applying for certain FAMIS-based programs are temporarily placed in the MEDES-based AEG program until the applicable determination is made. For most situations, if participants meet eligibility requirements of a program in both systems, adjustments to eligibility information in one or both systems are necessary to ensure the participant is enrolled in only one system. There are a few, rare situations in which participants can be properly enrolled in both systems. According to the MHD Eligibility for Multiple MO HealthNet Programs policy, when processing new enrollments or eligibility redeterminations for participants who meet program eligibility requirements in both systems, FSD benefit program technicians should obtain the participant's program choice and update eligibility information in the applicable system to reflect enrollment in the chosen program, and disenrollment in the program not chosen, if necessary. The policy further provides that once disability determinations are made for AEG program-eligible participants temporarily placed in the AEG program, updates to the applicable systems should be made to ensure the participant is enrolled in only one system. MEDES and FAMIS operate independently, have not been integrated, and do not interface. For participants who meet the eligibility requirements of programs in both systems, FSD staff must manually ensure each participant is enrolled in only one system, removing improper duplicate enrollment when necessary. There are no additional controls, such as reports, reconciliations, or match processes, to prevent, detect, or correct instances of participants improperly enrolled in both systems. To test compliance with eligibility requirements, we reviewed eligibility documentation for a randomly-selected sample of 60 Medicaid program and CHIP participants enrolled in the MEDES and 60 enrolled in the FAMIS during the year ended June 30, 2025. Of the 120 participants, 1 (1%) was improperly enrolled in both the MEDES and the FAMIS. In November 2024, this participant applied for a FAMIS-based program. Because he was eligible for the AEG program, he was temporarily placed in the AEG program in the MEDES, effective November 2024, while his eligibility for the FAMIS-based program was being determined. In January 2025, when he was determined eligible for the FAMIS-based program, the FSD entered his eligibility for that program in the FAMIS, effective January 2025. However, the FSD did not manually identify the improper dual enrollment and disenroll him in the MEDES until June 2025, when his guardian made an inquiry regarding his benefits. During the period January through June 2025, the DSS made monthly managed care payments on behalf of the participant under the AEG program. Because payments were made for only one of the enrolled programs during that period, there are no questioned costs. Upon our request, the MHD prepared and provided to auditors a listing showing 9,834 participants, or 1% of the total population, enrolled in both the MEDES and the FAMIS as of May 2025. Improper payments would not have occurred on behalf of all 9,834 participants since not all dual enrollments are improper. However, because the MHD had not identified, reviewed, and corrected eligibility for these participants, related improper payments and claims could be significant. DSS officials agreed manual processes allowed the improper dual enrollment for the participant identified above. They indicated controls in the Medicaid Management Information System (payment system) could prevent some improper payments for dually-enrolled participants; however, these controls are limited and would not prevent all improper payments and claims. The failure to implement and enforce adequate internal controls to ensure participants are not improperly dually enrolled in the MEDES and the FAMIS increases the risk that improper Medicaid program and CHIP payments may be made or claimed at the incorrect federal/state share. Furthermore, 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DSS through the MHD and the FSD strengthen internal controls to timely prevent, detect, and correct improper dual enrollments in the MEDES and the FAMIS for participants of the Medicaid program and the CHIP. The DSS should review the dual enrollments for the participants identified in this finding, correct any improper enrollments in the applicable eligibility system(s), and recoup any related improper payments and claims. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 93.767 Children's Health Insurance Program (CHIP) 2024 - 2405MO3002 and 2405MO5021 2025 - 2505MO3002 and 2505MO5021 93.778 COVID-19 - Grants to States for Medicaid (Medicaid) 93.778 Grants to States for Medicaid 2024 - 2405MO5MAP and 2405MO5ADM 2025 - 2505MO5MAP and 2505MO5ADM State Agency: Department of Social Services (DSS) - MO HealthNet Division (MHD) and Family Support Division (FSD) Type of Finding: Internal Control (Material Weakness) Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility As noted in our two previous audits, the vital records death match was not operating in the Medicaid Eligibility Determination and Enrollment System (MEDES) during the year ended June 30, 2025. As a result, there is no assurance that all participants in the Medicaid program and the CHIP are eligible for benefits and there is an opportunity for improper benefit payments to be made. To ensure participants continue to be eligible for benefits, 42 CFR Sections 435.916(d) and 435.952(a) require the agency to redetermine eligibility whenever it receives information about a change in a participant's circumstances that may affect eligibility. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. Monthly death matches against Department of Health and Senior Services (DHSS) vital records information serve as a key internal control to identify and terminate ineligible participants. When operating, vital records death match results automatically update participant eligibility, terminating eligibility upon death, in the applicable eligibility systems. As of June 30, 2025, there were approximately 982,000 participants in the MEDES, whose eligibility is based on their Modified Adjusted Gross Income (MAGI); and approximately 288,000 Aged, Blind and Disabled program participants in the Family Assistance Management Information System (FAMIS). The monthly MEDES vital records death match was not operating during the year ended June 30, 2025. DSS officials indicated the death match was eliminated from the MEDES due to system problems sometime before July 2022. DSS officials indicated they plan to resume use of the DHSS vital records death match in the MEDES in the future, but the anticipated resumption date is unknown. The DSS Corrective Action Plan (CAP) and Summary Schedule of Prior Audit Findings (SSPAF) for prior audit finding number 2024-002 state although the MEDES death match is not functional, MEDES participants that receive other benefits in the FAMIS (Supplemental Nutrition Assistance Program, Temporary Assistance for Needy Families, and/or Medicaid Aged, Blind and Disabled program) are subject to the FAMIS death match. However, not all MEDES participants receive other benefits in the FAMIS and are subject to that death match. The CAP and SSPAF further state the MEDES annual review process includes a death match with federal records; however, as noted at finding number 2025-003, the annual redetermination process was not fully functional during the year ended June 30, 2025 and will not terminate deceased participants in a timely manner, allowing the opportunity for improper benefit payments to be made until the redetermination is completed. The failure to implement and enforce adequate internal controls to ensure participant cases are closed upon death as required can result in Medicaid program and CHIP payments being made on behalf of ineligible individuals, which would be unallowable costs of the federal programs and result in payments from state funds that should not have occurred. Regulation 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DSS through the MHD and the FSD resume the DHSS vital records death match in the MEDES. Auditee's Response We partially agree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement and any planned actions to address the finding. Auditor's Comment Similar to prior audits, the DSS CAP states the DSS partially agrees with the finding because the "DSS has controls in place to identify deceased individuals in the MAGI eligibility system (MEDES)." As stated in the finding, the DSS has some controls that operate in place of the eliminated MEDES death match for some participants. However, since not all participants are subject to those controls, the remaining participants are not subject to a death match and the DSS does not have an anticipated completion date to reinstate this death match.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 93.767 Children's Health Insurance Program (CHIP) 2024 - 2405MO3002 and 2405MO5021 2025 - 2505MO3002 and 2505MO5021 93.778 COVID-19 - Grants to States for Medicaid (Medicaid) 93.778 Grants to States for Medicaid 2024 - 2405MO5MAP and 2405MO5ADM 2025 - 2505MO5MAP and 2505MO5ADM State Agency: Department of Social Services (DSS) - MO HealthNet Division (MHD) and Family Support Division (FSD) Type of Finding: Internal Control (Material Weakness) Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility The DSS does not have sufficient controls to ensure redeterminations are completed as required for certain Medicaid program and CHIP participants whose eligibility is based on the Modified Adjusted Gross Income (MAGI). Controls in place during the year ended June 30, 2025, were not sufficient to ensure compliance with the December 31, 2025, extended unwinding period deadline for reassessments. As of December 31, 2025, the DSS had a backlog of approximately 85,000 participants, for which redeterminations had not been completed. As of June 30, 2025, there were approximately 982,000 MAGI-based participants. To ensure MAGI-based participants continue to be eligible for benefits, 42 CFR Section 435.916 requires a redetermination of eligibility once every 12 months, or when circumstances affecting a participant's eligibility change. The regulation requires termination of benefits when a participant no longer meets eligibility requirements. During the period March 19, 2020, to March 31, 2023, the eligibility redetermination and most termination requirements were temporarily suspended in response to the COVID-19 Public Health Emergency (PHE). During that period all validly enrolled participants on March 19, 2020, were to remain continuously enrolled, except for participants who requested removal, moved out of state, or died. Effective April 1, 2023, under the COVID-19/Annual Renewals Unwinding User Acceptance Test Plan, submitted to the DHHS - Centers for Medicare and Medicaid Services (DHHS-CMS), the DSS was to resume and complete redeterminations for all participants over a 14-month period, which ended June 30, 2024. In August 2024, the DSS received an extension of this deadline from the DHHS-CMS. Under the extension, the DSS was required to complete redeterminations for all participants, and terminate benefits for participants who no longer meet eligibility requirements, by December 31, 2025. The Medicaid Eligibility Determination and Enrollment System (MEDES) tracks eligibility information from MAGI-based participants, including redetermination due dates; and in some cases, performs redeterminations. Non-automatic redeterminations for MAGI-based participants are performed manually by FSD benefit program technicians. To ensure continuous enrollment during the PHE and the extended unwinding period, the DSS programmed the MEDES to continue coverage effective March 18, 2020, except in the case of a participant's death, out-of-state move, or voluntary closure. DSS officials previously estimated the backlog of redeterminations would be resolved by July 2025; however, they stated at the December 31, 2025, deadline, there were approximately 85,000 participants for which redeterminations had not been completed. DSS officials indicated the FSD was not able to process redeterminations in a timely manner due to a number of continued workload and staffing challenges, including increased enrollment created by the expansion of Medicaid program, staffing shortages, and temporary reassignment of staff to work on other tasks. Due to the magnitude of participants needing redeterminations, implementation of effective internal controls well in advance of deadlines, and closely monitoring the effectiveness of those controls, is necessary to achieve compliance by the deadlines. The failure to implement adequate internal controls to ensure redeterminations are performed as required and ineligible participant cases are closed can result in Medicaid program and CHIP payments being made on behalf of ineligible individuals (including the state matching portion of the payment), which would result in unallowable costs of the federal programs and additional state dollars spent for unqualified participants. Regulation 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DSS through the MHD and the FSD strengthen internal controls to ensure redeterminations are completed as required. Auditee's Response We disagree with the auditor's finding. Our Corrective Action Plan includes an explanation and specific reasons for our disagreement. Auditor's Comment The DSS Corrective Action Plan (CAP) states the DSS disagrees with the finding because (1) the DSS was ". . . actively monitoring and strategizing to work towards completing all renewals by the deadline of December 31, 2025," and (2) the DSS ". . . does not consider this within the scope of the SFY [state fiscal year] 2025 audit because federal requirements did not require all renewals to be complete until December 31, 2025, which falls in SFY 2026." As stated in the finding, the DSS had a backlog of approximately 85,000 participants requiring redetermination at the extended deadline of December 31, 2025. Recent information provided by DSS officials shows a backlog of approximately 47,000 (45% reduction) as of July 28, 2026, 7 months after the extended deadline. The CAP states the DSS increased its efforts to work the backlog in April 2025, 9 months prior to the extended deadline. These efforts were clearly too late and not sufficient to resolve the backlog by the extended deadline. Due to the magnitude and annual nature of redeterminations, it is clear processes needed to be established and strengthened years, not months, in advance of the extended deadline. Because the DSS lacked effective controls during the audit period (a period of 6 to 18 months prior to the extended deadline), a finding is warranted. The longer the DSS continues to fail to timely perform redeterminations further escalates the risk of improper state and federal payments on behalf of ineligible individuals.

Federal Agency: Department of Health and Human Services Federal Program: 93.767 Children's Health Insurance Program (CHIP) 2024 - 2405MO3002 and 2405MO5021 2025 - 2505MO3002 and 2505MO5021 93.778 COVID-19 - Grants to States for Medicaid (Medicaid) 93.778 Grants to States for Medicaid 2024 - 2405MO5MAP and 2405MO5ADM 2025 - 2505MO5MAP and 2505MO5ADM State Agency: Department of Social Services (DSS) - MO HealthNet Division (MHD) and Family Support Division (FSD) Type of Finding: Internal Control (Material Weakness) and Nonmaterial Noncompliance Compliance Requirement: Eligibility The DSS does not have sufficient controls to ensure eligibility determinations are performed within required timeframes for participants of the Medicaid program and the CHIP. Significant application processing delays noted in our three previous audits continued during the year ended June 30, 2025. In our test of compliance with eligibility requirements for the year ended June 30, 2025, we noted 19 of 120 eligibility determinations were made 7 to 115 days after the required timeframes and averaged approximately 40 days late. The FSD is responsible for determining the eligibility of Medicaid program and CHIP participants. FSD benefit program technicians perform the majority of eligibility determinations using participants' Modified Adjusted Gross Income (MAGI). For the remaining non-MAGI participants, including participants in the MO HealthNet Aged, Blind, and Disabled programs, eligibility is not based on their MAGI. As of June 30, 2025, there were approximately 982,000 MAGI-based participants and approximately 288,000 non-MAGI-based participants. To ensure applicants can receive necessary medical care timely, 42 CFR Section 435.912(c)(3) requires new Medicaid program eligibility determinations be made within 45 days of application and within 90 days of application for applicants who apply for benefits on the basis of disability. Regulation 42 CFR Section 435.912(e) allows exceptions to these timeframes in certain unusual circumstances, such as a doctor's delay. Regulation 42 CFR Section 457.340(d) requires the same timeliness standards for CHIP participants. To test compliance with eligibility requirements, we reviewed randomly- selected samples of 60 MAGI-based participants, and 60 non-MAGI-based participants, all of which were new enrollments, subject to the timeliness requirements. The DSS did not meet timeliness requirements for 4 of the 60 MAGI-based eligibility determinations (7%), and 15 of the 60 non-MAGI-based determinations (25%). The 19 late determinations were made 7 to 115 days after the required 45-day or 90-day requirement, and averaged 40 days late. Similar to the three previous audits, DSS officials indicated the FSD continues to be challenged with processing applications in a timely manner due to a number of workload and staffing challenges, including unwinding of eligibility redetermination COVID-19 waivers compounded by increased enrollment due to expansion of the Medicaid program, staffing shortages, and temporary reassignment of staff to work on other tasks. DSS officials indicated they are developing and implementing technologies to assist participants and the DSS with various eligibility actions such as submitting applications, verifying income and resources, and providing required information. DSS officials stated as of December 2025, they have resolved the delays for MAGI-based participants, and they are working to resolve the delays for non-MAGI-based participants. In addition to noncompliance with federal requirements, the failure to ensure eligibility determinations are performed timely can result in potentially eligible participants not receiving necessary medical care. To ensure compliance with federal requirements, the DSS should implement and enforce adequate internal controls to ensure eligibility determinations are performed within required timeframes. Regulation 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DSS through the MHD and the FSD continue to review, strengthen, and enforce internal controls to ensure participant eligibility is determined within the required timeframes. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Health and Human Services Federal Program: 93.767 Children's Health Insurance Program 2024 - 2405MO3002 and 2405MO5021 2025 - 2505MO3002 and 2505MO5021 93.778 COVID-19 - Grants to States for Medicaid 93.778 Grants to States for Medicaid 2024 2405MO5MAP and 2405MO5ADM 2025 2505MO5MAP and 2505MO5ADM State Agency: Department of Social Services (DSS) - MO HealthNet Division (MHD) Type of Finding: Internal Control (Material Weakness) Compliance Requirement: Other As noted in our 2 previous audits, the MHD does not have adequate controls to ensure proper management of receipts. The MHD does not adequately restrict user access within the Medicaid Management Information System and does not account for all cash control numbers to ensure all checks and money orders are properly deposited or returned to senders if the payment cannot be accepted. During the year ended June 30, 2025, the MHD Financial Operations and Reporting Unit processed Grants to States for Medicaid (Medicaid) and Children's Health Insurance Program (CHIP) receipts totaling approximately $1.4 billion. These receipts included checks and money orders received from participants, providers, and insurance companies for items such as premiums, reimbursements, and taxes. See Financial Statement Finding number FS2025- 002 in the Annual Comprehensive Financial Report - Report on Internal Control, Compliance, and Other Matters (Report No. 2026-36), issued in April 2026.

Federal Agency: Department of Health and Human Services (DHHS) Federal Program: 93.778 Grants to States for Medicaid (Medicaid) 2025 - 2505MO5ADM State Agency: Department of Social Services (DSS) - Division of Finance and Administrative Services (DFAS) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirement: Reporting DFAS controls and procedures are not sufficient to timely submit Federal Funding Accountability and Transparency Act (FFATA) reports as required for the Medicaid program. During state fiscal year 2025, the DFAS did not timely submit a FFATA report for its one subrecipient of the Medicaid program. During state fiscal year 2025, the DSS disbursed approximately $4.9 million in first-tier subawards to its one Medicaid subrecipient, which accounted for less than 1% of the program's expenditures. The FFATA requires comprehensive reporting for certain federal awards to promote transparency and accountability over the use of the federal funds. Regulation 2 CFR Part 170, Appendix A, requires the DFAS to report first-tier subawards of $30,000 or more no later than the end of the month following the month in which the subaward was made. Information is reported to the System for Award Management (SAM.gov) (the FFATA Subaward Reporting System [FSRS.gov] prior to March 2025), and is publicly available at USASpending.gov. To test compliance with FFATA reporting requirements, we reviewed the one subaward requiring FFATA reporting, totaling approximately $4.9 million, awarded during state fiscal year 2025. The subaward was made in September 2024; however, DFAS personnel did not submit the FFATA report until February 2025, resulting in a 4 month delay. DFAS personnel indicated the delay occurred due to employee turnover in the position responsible for FFATA reporting. Without adequate internal control over FFATA reporting, there is less assurance the information included in the FFATA reporting is submitted timely. Regulation 2 CFR Section 200.303(a) requires recipients to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DSS through the DFAS strengthen internal controls to ensure information is timely reported for the Medicaid program and complete FFATA reporting in accordance with the applicable requirements. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Health and Human Services Federal Program: 93.778 Grants to States for Medicaid (Medicaid) 2024 - 2405MO5MAP and 2405MO5ADM 2025 - 2505MO5MAP and 2505MO5ADM State Agency: Department of Health and Senior Services (DHSS) - Division of Senior and Disability Services (DSDS) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirements: Activities Allowed or Unallowed and Allowable Costs/Cost Principles As similarly noted in our 2 prior audit reports, the DSDS does not have effective controls to ensure Participant Choice Agreements are completed and retained for participants of the State Plan Personal Care (SPPC) program. Required documentation was not on file for 14 of 60 participants reviewed. The DSDS is responsible for the direct administration of various Medicaid funded Home and Community Based Services (HCBS) programs for seniors and adults with disabilities, including the SPPC. During the year ended June 30, 2025, the DHSS made payments totaling approximately $1.2 billion on behalf of approximately 76,700 participants of the SPPC. As part of the initial assessment and annual reassessment process, DSDS personnel are required to ensure a Participant Choice Agreement (DA-3 form) was signed by the participant and the assessor. The DSDS uses Participant Choice Agreements to comply with 42 CFR Section 441.725 that requires participants be provided information and given choices regarding their care and that written consent be obtained from the individual. Signed agreements were uploaded to the CyberAccess web tool prior to May 2025, when the CyberAccess web tool was replaced by the Fusion web tool. Agreements previously uploaded to the CyberAccess web tool were transferred to the Fusion web tool. Assessments and reassessments are completed by either DSDS personnel or provider personnel. DSDS personnel perform quality assurance reviews of assessments and reassessments completed by provider personnel, and are required to ensure a signed Participant Choice Agreement was uploaded. Once the Participant Choice Agreement is uploaded to the CyberAccess or Fusion web tool by the assessor, the original agreement is not retained to prevent Health Insurance Portability and Accountability Act (HIPAA) breaches. The DSDS identified a weakness in the CyberAccess web tool upload process that prevented successful upload of some Participant Choice Agreements; and because the original agreements are not retained, there is no record of those agreements. To address this weakness, the DHSS used a special projects team to identify and resolve missing agreements on a sample basis. To test compliance with federal requirements, we reviewed Fusion web tool records for 60 randomly-selected participants enrolled in the SPPC program during the year ended June 30, 2025. A Participant Choice Agreement was not retained in the Fusion web tool records for 14 participants (23%). Of the 14 participants, 10 assessments/reassessments were completed by DSDS personnel and 4 were completed by providers. Neither the DSDS quality assurance reviews nor the special projects team identified the missing agreements. Assessments/reassessments for 13 participants originated in the CyberAccess web tool and 1 originated in the Fusion web tool. DHSS officials were unable to determine whether Participant Choice Agreements were completed but not uploaded to the CyberAccess web tool and/or migrated to the Fusion web tool, or never completed for these participants. DHSS officials indicated in addition to the CyberAccess web tool upload problem, the missing forms can be attributed to turnover and a large number of new staff, as well as issues with the migration of information from the CyberAccess web tool to the Fusion web tool. Without ensuring Participant Choice Agreements are completed and retained, the DSDS cannot demonstrate the participants were provided the proper choices in care services as required. Regulation 2 CFR Section 200.303(a) requires recipients to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The DHSS through the DSDS continue to implement procedures to ensure a signed Participant Choice Agreement is completed and retained for all participants of the State Plan Personal Care program. The DSDS should identify and replace all missing Participant Choice Agreements with newly completed agreements. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Homeland Security - Federal Emergency Management Agency (FEMA) Federal Program: 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) 2017 - FEMA - 4317 DR-MO 2019 - FEMA - 4435 DR-MO and FEMA - 4451 DR-MO 2020 - FEMA - 4490 DR-MO and FEMA - 4552 DR-MO 2021 - FEMA - 4612 DR-MO and FEMA - 4636 DR-MO 2022 - FEMA - 4665 DR-MO 2023 - FEMA - 4741 DR-MO 2024 - FEMA - 4803 DR-MO 2025 - FEMA - 4855 DR-MO State Agency: Department of Public Safety - State Emergency Management Agency (SEMA) Type of Finding: Internal Control (Material Weakness) and Material Noncompliance Compliance Requirement: Subrecipient Monitoring As similarly noted in our previous audit, during state fiscal year 2025, the SEMA did not fully comply with subrecipient monitoring requirements for the Disaster Grants - Public Assistance (Presidentially Declared Disasters) (DGPA) program. The SEMA did not communicate all required federal award information to subrecipients, completed only 25% of the required number of subrecipient monitoring reviews, and did not perform supervisory reviews of some monitoring reviews. The SEMA disbursed approximately $197 million to 312 DGPA program subrecipients during the year ended June 30, 2025. Regulation 2 CFR Section 200.332(b) requires pass-through entities to ensure every subaward is clearly identified to the subrecipient as a subaward and lists specific information to be communicated to the subrecipient. Regulation 2 CFR Section 200.332(c) requires pass-through entities to evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Regulation 2 CFR Section 200.332(e) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward, and achieves performance goals and objectives. Pass-through entities are required to ensure the subrecipient takes corrective action on all significant developments that negatively affect the subaward, including findings from single audits, site visits, and other means. The SEMA enters into a subaward agreement and provides a grant award form to each DGPA program subrecipient with various information about the grant. The SEMA's tiered monitoring process, outlined in the SEMA's Risk Assessment Form and Recovery Division Monitoring Policy (monitoring policy), requires risk assessments be performed 24 months after the disaster declaration for each subrecipient. Risk assessments are performed to evaluate various risk indicators and categorize each subrecipient as high, medium, or low risk. The risk category determines the type and nature of monitoring required for the subrecipient. The policy requires on-site monitoring reviews for all high-risk subrecipients and desk reviews of 20% of medium-risk subrecipients. No additional action is required for low-risk subrecipients. The monitoring policy requires the SEMA to generate reports listing any deficiencies noted during on-site and desk monitoring reviews. The monitoring report will, if applicable, reflect any notice given to the subrecipient about delinquent reports, failure to submit proper documentation, and issues noted during the review. The monitoring report also identifies the SEMA's and subrecipient's actions and plans to resolve the issue(s) by documenting a brief written plan and timeline for the resolution of the issues identified. When all issues have been resolved, the policy requires a follow-up letter and updated monitoring report to be provided to the subrecipient. The policy requires that the appropriate section specialist and the fiscal manager approve the monitoring reports. Subaward information As similarly noted in a FEMA report summarizing an August 2025 FEMA review, during state fiscal year 2025, the SEMA did not include all required federal award identification information in the grant award forms. The grant award forms lacked the following required information: federal award date; subaward budget period start and end date; amount of federal funds obligated in the subaward; total amount of federal funds obligated to the subrecipient, including the current financial obligation; and total amount of the federal award committed to the subrecipient. When required federal grant award information is excluded from grant award forms, subrecipients can be uninformed about specific requirements pertaining to the subaward and there is increased risk of noncompliance with program requirements. In response to the FEMA review, the SEMA updated the grant award forms to include the missing information effective for grants issued in January 2026. Monitoring reviews During state fiscal year 2025, the SEMA performed risk assessments for all 1,049 subrecipients requiring risk assessments; however, the SEMA performed only 64 of the 259 (25%) monitoring reviews required by the monitoring policy. The following table shows the results of the risk assessments performed for fiscal year 2025, the monitoring reviews required by federal regulation and SEMA policy, the monitoring reviews completed, and the monitoring reviews outstanding at year end. In addition, our randomly-selected sample of 2 of the 17 on-site reviews and 5 of the 47 desk reviews completed during state fiscal year 2025, noted the 2 on-site monitoring reports were not approved by the Section Specialist or the Fiscal Manager, as required by the monitoring policy. SEMA personnel indicated they began performing monitoring reviews in January 2025, in response to the prior audit finding; however, they did not have enough time to complete all required monitoring reviews by the end of the fiscal year. SEMA personnel also explained they did not realize supervisory approval of the on-site monitoring reports was required by SEMA's monitoring policy. When subrecipient monitoring reviews are not performed as required by federal regulation and SEMA policy, there is increased risk that noncompliance with program requirements will go undetected. Without adequate supervisory review of monitoring reports, the SEMA has less assurance the reviews were performed adequately and in accordance with the monitoring policy. Conclusions Without adequate internal controls over subrecipient monitoring requirements, there is increased risk of noncompliance, errors, fraud, waste, and abuse of federal funds. Adherence to policies and procedures is necessary to ensure compliance with subrecipient monitoring requirements. Regulation 2 CFR Section 200.303(a) requires the recipient to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The SEMA continue to strengthen controls and procedures to communicate federal award information to DGPA program subrecipients and monitor subrecipients in accordance with the monitoring policy. In addition, the SEMA should ensure supervisory reviews of monitoring reports are performed, as required. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.

Federal Agency: Department of Homeland Security - Federal Emergency Management Agency (FEMA) Federal Program: 97.036 Disaster Grants - Public Assistance (Presidentially Declared Disasters) 2017 - FEMA - 4317 DR-MO 2019 - FEMA - 4435 DR-MO and FEMA - 4451 DR-MO 2020 - FEMA - 4490 DR-MO 2021 - FEMA - 4612 DR-MO and FEMA - 4636 DR-MO 2022 - FEMA - 4665 DR-MO 2023 - FEMA - 4741 DR-MO 2024 - FEMA - 4803 DR-MO 2025 - FEMA - 4855 DR-MO State Agency: Department of Public Safety - State Emergency Management Agency (SEMA) Type of Finding: Internal Control (Significant Deficiency) and Nonmaterial Noncompliance Compliance Requirement: Reporting SEMA controls and procedures are not sufficient to fully comply with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the Disaster Grants - Public Assistance (Presidentially Declared Disasters) (DGPA) program. During state fiscal year 2025, the SEMA did not fully comply with FFATA reporting requirements for 6 of 17 subawards reviewed. During state fiscal year 2025, the SEMA disbursed approximately $197 million in first-tier subawards to 312 subrecipients of the DGPA program. First-tier subaward payments accounted for nearly 100% of total program expenditures. The FFATA requires comprehensive reporting for certain federal awards to promote transparency and accountability over the use of the federal funds. Regulation 2 CFR Part 170, Appendix A, requires the SEMA to report first-tier subawards of $30,000 or more no later than the end of the month following the month in which the subaward was made. Information is reported to the System for Award Management (SAM.gov) (to the FFATA Subaward Reporting System [FSRS.gov] prior to March 2025) and is publicly available at USASpending.gov. On a monthly basis, SEMA procedures provide that SEMA personnel enter subawards made during the previous month into an Excel spreadsheet. SEMA personnel filter the spreadsheet information to identify subawards that require FFATA reporting, transfer the data to the federal reporting template, and upload the data to SAM.gov (previously FSRS.gov). Various subaward data is uploaded, including the entity name, award amount, and the date issued. To test compliance with FFATA reporting requirements, we reviewed 17 randomly-selected DGPA program subawards, totaling approximately $23.8 million, awarded during state fiscal year 2025. Of the 17 subawards, 6 (35%) had instances of noncompliance, as shown in the following table. SEMA personnel indicated the FFATA reporting delays occurred due to technical issues encountered during the transition from FSRS.gov to SAM.gov, and difficulties identifying the Unique Entity Identifier (UEI) for some subrecipients. However, the SEMA did not timely upload the reports once these issues were resolved. SEMA personnel indicated reports for two subawards lacked the project numbers due to manual entry errors. Without adequate internal control over FFATA reporting, there is less assurance the information included in the FFATA reporting is complete, accurate, and submitted timely. In addition to noncompliance with federal requirements, not reporting subawards to the FSRS accurately and timely increases the risk that users of the reports could rely on incomplete and inaccurate information. Regulation 2 CFR Section 200.303(a) requires recipients to "[e]stablish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award." Recommendation The SEMA strengthen internal controls to ensure information is timely and accurately reported for the DGPA program and complete FFATA reporting in accordance with the applicable requirements. Auditee's Response We agree with the auditor's finding. Our Corrective Action Plan includes our planned actions to address the finding.