Audit 414614

FINDING 2025-201 The Commission did not include administrative costs in required reports for the Federal Funding Accountability and Transparency Act (FFATA). Additionally, the Commission did not have any documentation to support adequate internal controls over FFATA reporting. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Special Programs for the Aging – Title III, Part B—Grants for Supportive Services and Senior Centers; Special Programs for the Aging, Title III, Part C, Nutrition Services Assistance Listing Number: 93.044; 93.045 Federal Award Number: 2401IDOASS; 2401IDOACM; 2401IDOAHD Program Year: October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that non-federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework, which provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include control activities and information and communication. Under the requirements of the FFATA, Pub. L. No. 109-282, as amended by Section 6202 of Pub. L. No. 110-252, and codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the federal government no later than the final day of the month following an actionable activity. Condition: The FFATA was developed to provide better transparency over management of federal grants and contracts. Reporting is required on allocations of $30,000 through the federal website, SAM.gov. The Commission is the primary recipient of the Aging Cluster Grant program (Assistance Listings 93.044, 93.045, 93.053) and required to comply with FFATA reporting as part of the terms and conditions related to receiving this grant. The Commission’s personnel indicated that a process is in place where the Operations Manager reviews and approves FFATA submissions; however, the review is not properly documented. Without adequate documentation, we cannot substantiate that the review consistently occurred and operated effectively. Additionally, the Commission did not include administrative costs in the FFATA reports submitted for the fiscal year, despite the Commission issuing amounts to the Area Agencies on Aging (AAAs) in excess of $30,000 dollars for those costs. Admin Allocations represents $720,218 in disbursements to sub-awardees which indicates significant underreporting. Reports Tested Not Reported Late Incorrect Missing Elements 9 0 0 0 0 Amount Tested Amount Not Reported Amount Late Amount Incorrect Amount Missing Elements $3,697,670 $720,218 $0 $0 $0 Cause: Commission personnel were not aware of the FFATA reporting requirements specifically for subawards to include administrative cost distributions and did not implement internal controls to ensure the accurate submission of the FFATA reports. Effect: The FFATA reports are required to be submitted to the federal government, which makes the information available to the public in a searchable database. Incorrect or incomplete FFATA reporting may lead to significant administrative, financial, and reputational consequences. A lack of documented controls over reporting can lead to increased likelihood of inaccurate reporting by the Commission. Recommendation: We recommend that the Commission implement documented internal control procedures for the required FFATA reporting to ensure the completeness of its submissions. We further recommend that the Commission consider improving training procedures to ensure that staff are knowledgeable about the requirements of grants accepted by the Commission. Management’s View: The Commission agrees with this finding. Corrective Action: The Commission acknowledges that the sub-award amounts reported under ALNs 93.044, 93.045, and 93.053 did not include all allocable administrative costs for the sub-recipient tested. We have taken the following corrective actions, all of which were implemented during the audit following identification of this issue: 1. Revised FFATA Sub-Award Reports -The Commission revised the affected FFATA sub-award reports in SAM.gov to include the administrative costs allocable to each of the three tested ALNs for the sub-recipient identified in the finding. The revised reports were provided to LSO for review on 06/18/2026. 2. Revised FFATA Reporting Policy Implemented: The Commission developed a documented policy governing FFATA sub-award data entry, review, and approval. The policy establishes the following: • The Financial Technician is responsible for entering all FFATA sub-award data and must confirm that reported amounts include direct program costs and administrative costs allocable to the sub-award. • The Financial Specialist Senior is required to review all FFATA entries for accuracy and completeness. The Financial Specialist will document their review. This step is the specific control that was absent during the audit period. • Documentation of each review and approval must be retained. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2025-202 The Commission did not complete required SF-425 reports for the Aging Cluster in a timely manner. Type of Finding: Material Weakness; Material Noncompliance Assistance Listing Title: Special Programs for the Aging – Title III, Part B—Grants For Supportive Services and Senior Centers; Special Programs for the Aging, Title III, Part C, Nutrition Services; Nutrition Services Incentive Program Assistance Listing Number: 93.044; 93.045; 93.053 Federal Award Number: 2101IDCMC6; 2101IDHDC6; 2101IDSSC6; 2201IDSTPH; 2301IDOACM; 2301IDOAHD; 2301IDOASS; 2301IDOANS; 2401IDOAHD; 2401IDOASS; 2401IDOACM Program Year: April 1, 2021 – September 30, 2024; April 1, 2021 – September 30, 2025; January 1, 2022 – September 30, 2025; October 1, 2022 – September 30, 2025; October 1, 2022 – September 30, 2024; October 1, 2023 – September 30, 2026; October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that non-federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) published the Internal Control Integrated Framework, which provides a basis for organizations to design internal control procedures to ensure reliable financial reporting, effective and efficient operations, and compliance with applicable laws and regulations. Components of this framework include control activities and information and communication. The grant award from the Department of Health and Human Services issued under Older Americans Act of 1965 requires recipients to submit the SF-425 report on an annual basis. Reports are due within 90 days for the periods ending March 31 or September 30. A final SF-425 report is due within 120 days after September 30. Condition: The SF-425 reports for the Aging Cluster Grant program (Assistance Listings 93.044, 93.045, 93.053) were not completed in a timely manner for state fiscal year 2025. The SF-425 report is required to be submitted annually for the Aging Cluster. The SF-425 report should have been submitted within 90 days of September 30, 2024, or March 31, 2025, reporting dates; however, the reports were filed months after the reporting deadlines. We tested 100 percent of the population, given the known nature of the issue, and it was consistent across all of the reports. There were nine annual reports and two final reports. The annual reports were all completed approximately six months late, while 1 final report was four months late and the other was about one year late. Cause: The Commission had significant turnover of key personnel during the period and did not have strong procedures in place to ensure that SF-425 reports were completed in a timely manner. Effect: The SF-425 reports the financial status of grant funds and expenditures of those funds to the federal government. Inaccurate or incomplete reporting could result in inaccurate information provided to users of the reports including the federal funding agency and could cause a disruption in federal funding due to noncompliance. Recommendation: We recommend that the Commission design and implement well-documented procedures to ensure the timely completion and submission of SF-425 reports. Management’s View: The Commission agrees with this finding. Corrective Action: At the time of the audit period, the Commission was still working to complete Aging Cluster SF-425 Federal Financial Reports. Several operational challenges contributed to delays, including fiscal staffing transitions and state software system implementation. The Commission has now fully corrected this issue. All past-due SF-425 reports were reviewed, finalized, and submitted, bringing the agency fully current on Aging Cluster federal financial reporting requirements. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. While we continue to assert that the Commission did not have strong procedures in place during the audit period, and All SF-425 reports submitted for fiscal year 2025 were late, we will review changes the Commission indicates were made during completion of the fiscal year 2026 single audit.

FINDING 2025-203 The Commission did not comply with federal Matching, Level of Effort, and Earmarking grant requirements for the Rehabilitation Services-Vocational Rehabilitation Grants to States program. Related to Prior Finding: 2024-200 Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A230016; H126A240016; H126A250016 Program Year: October 1, 2022 - September 30, 2024; October 1, 2023 - September 30, 2025; October 1, 2024 - September 30, 2025 Federal Agency: Department of Education, Rehabilitation Services Administration Compliance Requirement: Matching, Level of Effort, and Earmarking Questioned Costs: Matching: $514,227 Known; Earmarking: $68,493 Known; Level of Effort: $63,280 Known Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 34 CFR 361.60(a)(1) states that the federal share for expenditures made by the State under the vocational rehabilitation services portion of the Unified or Combined State Plan, including expenditures for the provision of vocational rehabilitation services and the administration of the vocational rehabilitation services portion of the Unified or Combined State Plan, is 78.7 percent. The State share for expenditures is 21.3 percent. Requirements in 34 CFR 361.62 state that to maintain a level of nonfederal share it provided in the previous federal fiscal year is at least equal to the total nonfederal share provided by the State two years prior. Section 110(d)(1) of the Rehabilitation Act of 1973 (Rehabilitation Act), as amended by the Workforce Innovation and Opportunity Act (WIOA), requires a state to reserve at least 15 percent of its state allotment, under the State Vocational Rehabilitation (VR) Services grant (Assistance Listing 84.126), for the provision of pre–employment transition services to students with disabilities under section 113 of the Rehabilitation Act. Condition: Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2025 grant period is October 1, 2024, through September 30, 2026. In State fiscal year 2025, there were three grants open – federal fiscal years 2023, 2024, and 2025. The federal fiscal year 2023 grant period was October 1, 2022, to September 30, 2024, and was the only grant period that concluded within State fiscal year 2025. We evaluated the Commission’s compliance with the matching, level of effort, and earmarking requirements for the fiscal year 2023 grant. Matching The Commission is required to provide at least 21.3 percent of total rehabilitation program spending from nonfederal sources as a match. We reviewed the amounts reported as federal and State expenditures on the Commission’s final Rehabilitation Services Administration (RSA) 17 report for the federal fiscal year 2023 grant. The Commission reported the federal share as $3,246,435 and the State matching expenditures as $968,661, which calculates as 23 percent of total program expenditures and meets match requirements. We compared the amounts reported on the RSA-17 report to the expenditures in the former statewide accounting system (STARS) in State fiscal year 2023 and the current statewide accounting system (Luma) in State fiscal years 2024 and 2025. We verified that the federal expenditures matched the RSA-17 report; however, the State expenditures were only $364,414, which calculates as 10.1 percent of total program expenditures and does not meet match requirements. The commission could not provide documentation to support the amounts reported on the RSA-17 reports. To calculate questioned costs, we verified that the federal share of expenditures matched the amounts reported in Luma. We calculated the matching requirement by dividing the federal expenditures by the federal participation rate and then subtracting the federal share to arrive at the State share ($3,426,435/0.787 = $4,125,076 - $3,246,435 = $878,641). We then compared the required State match amount to the State expenditures in Luma, and the result was that the Commission expended $514,227 less than the required matching amount ($878,641 - $364,414 = $514,227). Level of Effort Maintenance of effort is one part of the level of effort grant requirements. The Commission is required to spend at least the amount of State funds expended in the federal fiscal year two years prior. We compared State expenditures for the federal fiscal years 2021 and 2023 grants based on amounts reported on the RSA-17 reports. The State expenditures reported for the federal fiscal year 2021 grant on the final September 30, 2022, RSA-17 report were $975,516, and the expenditures reported for the federal fiscal year 2023 grant on the final March 31, 2024, RSA-17 report were $968,661 indicating that the maintenance of effort requirement was not met. The maintenance of effort deficit based on RSA-17 information was $6,855. We compared the amounts reported on the RSA-17 report to the expenditures in STARS for State fiscal years 2021, 2022, and 2023 and Luma for State fiscal years 2024 and 2025. The State expenditures for the federal fiscal year 2021 grant were $427,695 and for the federal fiscal year 2023 grant were $364,414, which also indicates that the Commission did not meet maintenance of effort requirements. The maintenance of effort deficit based on accounting system information was $63,280. Earmarking The Commission is required to spend at least 15 percent of the federal allotment on the Pre-Employment Transition Services (pre-ETS) program. We identified the total federal grant expenditures in Luma as $3,246,435 and the amount spent on pre-ETS as $418,472, which calculates to 12.89 percent of total federal spending, indicating that the Commission did not meet earmarking requirements. To calculate questioned costs, we multiplied the total federal grant expenditures by 15 percent and then subtracted the pre-ETS amount of expenditures in Luma and found that the Commission expended $68,493 less than the required earmarking amount ($3,246,435 x .15 = $486,965 – $418,472 = $68,493). Cause: Each month, the Commission uses a spreadsheet to calculate its cost allocations in accordance with its cost allocation plan (CAP). This spreadsheet includes calculations to track federal and State expenditures and compliance with matching, level of effort, and earmarking requirements. The CAP spreadsheet is prepared by one person and reviewed by a second person. However, this process did not identify the errors indicating that the staff completing these reviews did not have adequate knowledge to ensure this internal control was effective. Effect: Noncompliance with matching, level of effort, and earmarking requirements could result in a reduced federal award amount in future fiscal years. The Commission’s internal control procedures did not include maintaining documentation to support amounts reported for the matching, level of effort, and earmarking requirements which could lead to future errors. Recommendation: We recommend that the Commission design and implement procedures to monitor compliance with matching, level of effort, and earmarking requirements and retain documentation to support compliance. Providing appropriate training and staff recruitment is critical to ensure that internal controls are effective in preventing or detecting errors. Management’s View: The agency agrees with the finding as we were using the cost allocation plan which changes the numbers from the ones used by the audit team and found from Luma (the state accounting system). Corrective Action: Corrective Action Objectives: • Achieve and maintain full compliance with federal matching, level of effort, and earmarking requirements. • Establish durable internal controls that prevent or promptly detect errors. • Ensure all compliance activities are properly documented, retained, and independently reviewable. • Train and support staff to understand compliance responsibilities and execute them consistently. Actions To Be Taken: • Implemented monthly compliance monitoring, including: o Match reconciliation comparing required vs. actual non-federal contributions o Review of earmarked funds to ensure required percentages are met. • Standardized documentation templates: o Match tracking worksheets o Earmark compliance ledger • Introduce a transaction sampling audit each quarter to validate documentation completeness and accuracy. • Establish a centralized compliance records repository. • Mandatory training covering matching requirements, MoE, earmarking rules, and documentation expectations. We are currently receiving intensive technical assistance from the VRTAC. This will include initial training for all program and fiscal staff. • Establish an annual internal audit focused on RSA compliance. • Establishing semi-annual briefings to the leadership team summarizing compliance status and corrective measures. Conclusion: This Corrective Action Plan strengthens the Commission’s internal controls, enhances documentation, and ensures compliance with federal matching, level of effort, and earmarking requirements. Implementation of these measures will improve accountability, reduce risk, and support ongoing program integrity. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2025-204 Multiple errors were identified in the amounts reported on the Rehabilitation Services Administration (RSA) reports required for the Rehabilitation Services-Vocational Rehabilitation Grants to States. Related to Prior Finding: 2024-201 Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A230016; H126A240016; H126A250016 Program Year: October 1, 2022 - September 30, 2024; October 1, 2023 - September 30, 2025; October 1, 2024 - September 30, 2025 Federal Agency: Department of Education, Rehabilitation Services Administration Compliance Requirement: Reporting Questioned Costs: $479,178 Known Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.400 contains the policy guide for cost principles related to federal grant administration. Paragraph (a) states that the nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. Paragraph (d) states that the accounting practices of the nonfederal entity must be consistent with these cost principles and support the accumulation of costs as required by the principles and must provide for adequate documentation to support costs charged to the federal award. Section CFR 200.302 – Financial Management states that federal award recipient’s financial management system must identify all federal awards received and expended and the federal programs under which they were received. Additionally, they must maintain records that sufficiently identify the amount, source, and expenditure of federal funds for federal awards. These records must contain information necessary to identify federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: The RSA requires the Commission to submit financial reports semi-annually. The reports are cumulative and cover the entire grant period through to the end of the reporting period. The RSA also requires a final report at the end of the grant period. The Vocational Rehabilitation Basic Services Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2025 grant period is October 1, 2024, through September 30, 2026. The Commission identifies the grant periods using the initials VRBAS and the last 2 digits of the grant year. During State fiscal year 2025, there were three grants open: VRBAS23, VRBAS24, and VRBAS25. We tested four semi-annual reports that were due within State fiscal year 2025. We identified errors in all four reports. The financial reports were not prepared on an award-by-award basis, which resulted in reported amounts that did not agree to the accounting records. We also identified other errors between the reported amounts and the accounting records. The following errors were identified: VRBAS23 – Reporting Period October 1, 2022, through March 31, 2024 The report was due on July 29, 2024, and was not submitted until February 28, 2025; seven months past the due date. Line 15 Federal Expenditures Incurred for Pre-employment Transition Service Activities: The amount reported was $486,965; however, accounting records showed a total of $418,472 resulting in a $68,493 overstatement. Line 28 Total Non-Federal Share of Expenditures: The amount reported was $968,661; however, accounting records showed a total of $364,414 resulting in a $604,247 overstatement. Lines 29 and 32: The purpose of Line 29 is to report unliquidated obligations to be paid with nonfederal funds meeting the nonfederal share requirements. Nonfederal share can only be credited as match when obligated in the federal fiscal year of appropriation for an award. The purpose of Line 32 is to report the liquidations from the amount of nonfederal unliquidated obligations report on Line 29 that were liquidated during a subsequent reporting period. Line 32 reflects the amount of the reported unliquidated obligations that have been liquidated in the carryover year. Line 29 Non-Federal Share of Unliquidated Obligations: The amount reported was $26,324. We recalculated the nonfederal share using outstanding authorizations reported in Orion, the Commission’s client management system. We used the amount reported of $125,946 and calculated the nonfederal share of 21.3 percent for a total of $26,826 resulting in a $502 understatement. Line 32 Non-Federal Expenditures for Unliquidated Obligations Reported on Line 29, Liquidated After September 30, 2023: The amount reported was $26,324; however, this amount was not supported in the reporting documentation, resulting in a $26,324 overstatement. Line 37 Administrative Expenditures: The amount reported was $848,533; however, accounting records and the Cost Allocation Plan support showed a total of $1,120,301 resulting in a $271,768 understatement. Line 38 Expenditures Incurred for Pre-ETS Services by Agency Staff: The amount reported was $121,463; however, accounting records showed a total of $132,767 resulting in a $11,213 understatement. Line 39 Services to Groups: The amount reported was $668,179; however, accounting records showed a total of $320,501 resulting in a $347,678 overstatement. Line 41 Innovations & Expansion Expenditures: The amount reported was $103,353; however, accounting records showed a total of $84,850 resulting in a $18,503 overstatement. VRBAS24 – Reporting Period October 1, 2023, through September 30, 2024 The report did not have a documented review prior to submission. Line 15 Federal Expenditures Incurred for Pre-employment Transition Service Activities: The amount reported was $543,497; however, accounting records showed a total of $383,020 resulting in a $160,477 overstatement. Line 18 Federal Share of Unliquidated Obligations: The amount reported was $102,977; however, we recalculated the federal share using the unliquidated obligations from Orion of $102,977 and the State match rate of 21.3 percent and determined the federal share to be $81,043, resulting in a $21,934 overstatement. Line 19 Total Federal Share: Line 19 is the total of Line 14 and Line 18. Since Line 18 was overstated by $21,934, Line 19 was also overstated by $21,934. Line 20 Unobligated Balance of Federal Funds: Line 20 is the total of the Federal Award less Line 19. If Line 19 was overstated, that resulted in Line 20 being understated by $21,934. Line 28 Total Non-Federal Share of Expenditures: The amount reported was $1,208,310; however, accounting records showed a total of $781,653 resulting in a $426,657 overstatement. Lines 29 and 32: The purpose of Line 29 is to report unliquidated obligations to be paid with nonfederal funds meeting the nonfederal share requirements. Nonfederal share can only be credited as match when obligated in the federal fiscal year of appropriation for an award. The purpose of Line 32 is to report the liquidations from the amount of nonfederal unliquidated obligations report on Line 29 that were liquidated during a subsequent reporting period. Line 32 reflects the amount of the reported unliquidated obligations that have been liquidated in the carryover year. Line 29 Non-Federal Share of Unliquidated Obligations: The amount reported was zero. We recalculated the nonfederal share using the outstanding authorizations in Orion, the Commission’s client management system. We used the amount reported in Orion of $102,977 and calculated the nonfederal share of 21.3 percent for a total of $21,934, resulting in a $21,934 understatement. Line 37 Administrative Expenditures: The amount reported was $1,240,104; however, accounting records and Cost Allocation Plan support showed a total of $1,779,969 resulting in a $539,865 understatement. Line 39 Services to Groups: The amount reported was $622,021; however, accounting records showed a total of $460,958 resulting in a $161,063 overstatement. Line 41 Innovations & Expansion Expenditures: The amount reported was $81,692; however, accounting records showed a total of $18,568 resulting in a $63,124 overstatement. VRBAS24 – Reporting Period October 1, 2023, through March 31, 2025 The report did not have a documented review prior to submission. The report was due on April 30, 2025, but was submitted May 21, 2025, three weeks past the due date. Line 15 Federal Expenditures Incurred for Pre-employment Transition Service Activities: The amount reported was $600,423; however, accounting records showed a total of $417,880 resulting in a $182,543 overstatement. Line 18 Federal Share of Unliquidated Obligations: The amount reported was $39,690; however, we recalculated the federal share using the unliquidated obligations from Orion, the Commission’s client management system, of $39,690 and the State match rate of 21.3 percent and determined the federal share to be $31,236 resulting in a $8,454 overstatement. Line 19 Total Federal Share: Line 19 is the total of Line 14 and Line 18. Since Line 18 was overstated by $8,454, Line 19 was also overstated by $8,454. Line 20 Unobligated Balance of Federal Funds: Line 20 is the total of the Federal Award, less Line 19. If Line 19 was overstated, that resulted in Line 20 being understated by $8,454. Line 28 Total Non-Federal Share of Expenditures: The amount reported was $1,208,310; however, accounting records showed a total of $1,196,358 resulting in a $11,952 overstatement. Lines 29 and 32: The purpose of Line 29 is to report unliquidated obligations to be paid with nonfederal funds meeting the nonfederal share requirements. Nonfederal share can only be credited as match when obligated in the federal fiscal year of appropriation for an award. The purpose of Line 32 is to report the liquidations from the amount of nonfederal unliquidated obligations report on Line 29 that were liquidated during a subsequent reporting period. Line 32 reflects the amount of the reported unliquidated obligations that have been liquidated in the carryover year. Line 29 Non-Federal Share of Unliquidated Obligations: The amount reported was zero. We recalculated the nonfederal share using the outstanding authorizations in Orion, the Commission’s client management system. We used the amount reported in Orion of $39,690 and calculated the nonfederal share of 21.3 percent for a total of $8,454 resulting in a $8,454 understatement. Line 37 Administrative Expenditures: The amount reported was $2,267,253; however, accounting records and Cost Allocation Plan support showed a total of $1,972,591 resulting in a $294,662 overstatement. Line 39 Services to Groups: The amount reported was $539,549; however, accounting records showed a total of $196,320 resulting in a $343,229 overstatement. Line 41 Innovations & Expansion Expenditures: The amount reported was $61,223; however, accounting records showed a total of $33,328 resulting in a $27,895 overstatement. VRBAS25 – Reporting Period October 1, 2024, through March 31, 2025 The report was due on April 30, 2025, but was submitted May 21, 2025, three weeks past the due date. Line 14 Federal Share of Expenditures: The amount reported was $66,749; however, the accounting records show a total of $0, resulting in a $66,749 overstatement. Line 15 Federal Expenditures Incurred for Pre-employment Transition Service Activities: The amount reported was $20,904; however, accounting records showed a total of $19,988 resulting in a $916 overstatement. Line 19 Total Federal Share: Line 19 is the total of Line 14 and Line 18. Since Line 14 was overstated by $66,749, Line 19 is also overstated by $66,749. Line 20 Unobligated Balance of Federal Funds: Line 20 is the total of the Federal Award, less Line 19. If Line 19 is overstated, that results in Line 20 being understated by $66,749. Line 28 Total Non-Federal Share of Expenditures: The amount reported was $524,910; however, accounting records showed a total of $143,079 resulting in a $381,831 overstatement. Line 37 Administrative Expenditures: The amount reported was $1,027,148; however, accounting records and Cost Allocation Plan support showed a total of $814,086 resulting in a $213,062 overstatement. Line 39 Services to Groups: The amount reported was $202,321; however, accounting records showed a total of $50,331 resulting in a $151,990 overstatement. Line 41 Innovations & Expansion Expenditures: The amount reported was $42,655; however, accounting records showed a total of $27,768 resulting in a $14,887 overstatement. The total errors in all reports resulted in $2,742,933 in overstatements. Two of the four submissions did not have a documented review prior to submission. Three of the four submissions were not submitted within the due date provided. Cause: The Commission has designed a procedure to detect errors in reporting prior to issuance. The reports are compiled by one individual and reviewed by a second individual prior to issuing them to the federal agency. However, the review did not detect the errors, indicating that the staff completing these reviews did not have adequate knowledge to ensure this internal control was effective. Our testing found that two of the three quarterly reports with errors were not reviewed prior to submission. The Commission could not provide an explanation for the errors. Effect: The RSA uses the RSA-17 reports to determine compliance with federal statutes, regulations, and the terms and conditions of the federal award. Incorrect reporting can affect both the ability to cover current obligations and the amount of future federal grant awards received by the State of Idaho. The total errors in the reports were overstatements of $3,693,806 and understatements of $950,874, which resulted in overall overstatements of $2,742,933. However, not all reporting errors occurred in federal expenditures and as a result we are including only the Line 14 and Line 15 - federal share of expenditures errors as questioned costs totaling $479,178 known ($68,493 VRBAS23 March 2024 Line 15 +$160,477 VRBAS24 September 2024 Line 15 +$182,543 VRBAS24 March 2025 Line 15 + $66,749 VRBAS25 March 2025 Line 14 = $916 VRBAS25 March 2025 Line 15). Recommendation: We recommend that the Commission design and implement procedures to ensure accurate federal grant reporting and retain appropriate documentation to support the amounts reported. We also recommend that the Commission review prior submissions, identify correct reporting, and communicate with the federal grantor about resubmitting corrected reports. Providing appropriate training and staff recruitment is critical to ensure the internal controls are effective in preventing or detecting errors. Management’s View: The agency agrees with the finding as we were using the cost allocation plan which changes the numbers from the ones used by the audit team and found from Luma (the state accounting system). Corrective Action: Corrective Action Objectives: • Ensure that future RSA reports are complete, accurate, consistent, and fully supported by documentation. • Establish and implement clear, standardized reporting procedures. • Retain documentation necessary to justify all reported amounts. • Identify and correct errors in previously submitted reports and communicate corrections to RSA. • Strengthen staff competencies and ensure adequate staffing levels to support proper grant reporting. Actions To Be Taken: • Form a Reporting Review Team comprising program, fiscal, and data analysts to review reports prior to submission. • Develop standardized RSA Reporting Procedures, including: o Step-by-step instructions for preparing RSA-17 o Required supporting documentation for each line item. o Definitions of allowable expenditures and required classifications. o Review and approval workflows. • Established a double-verification process, requiring two qualified staff members to independently verify all numeric entries prior to submission. • Implement a centralized documentation repository for financial records, worksheets, cost allocation documents, and reconciliation statements. • Establish a mandatory documentation checklist that must be completed before a report can be sent for approval. • Create standardized reconciliation templates tying reported amounts directly to the general ledger or supporting program records. • Complete a retrospective review of all RSA submissions for the necessary reports. • Identify inaccuracies, variances, and documentation gaps. • Develop corrected versions of each affected report. • Prepared a formal communication package for RSA including: o Corrected reports o Explanation of errors o Documentation supporting corrected amounts Conclusion This Corrective Action Plan establishes a comprehensive strategy to resolve reporting errors, strengthen documentation practices, and prevent future inaccuracies in RSA federal grant reporting. Through strengthened controls, trained staff, and rigorous review processes, the Commission will ensure ongoing compliance and improved accountability. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2025-205 The Cost Allocation Plan (CAP) used in fiscal year 2025 was not approved by the RSA as required and contained multiple errors. Related to Prior Finding: 2024-202 Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A230016; H126A240016; H126A250016 Program Year: October 1, 2022 - September 30, 2024; October 1, 2023 - September 30, 2025; October 1, 2024 - September 30, 2025 Federal Agency: Department of Education, Rehabilitation Services Administration Compliance Requirement: Allowable Costs/Cost Principles Questioned Costs: $767,081 Known Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.400 contains the policy guide for cost principles related to federal grant administration. Paragraph (a) states that the nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. Paragraph (d) states that the accounting practices of the nonfederal entity must be consistent with these cost principles and support the accumulation of costs as required by the principles and must provide for adequate documentation to support costs charged to the federal award. The U.S. Code of Federal Regulations (CFR) Title 34 contains the regulations of the offices of the U.S. Department of Education, including the Rehabilitation Services Administration (RSA). Title 34 CFR § 76.560 (b) states: A grantee must have a current indirect cost rate agreement to charge indirect costs to a grant. Title 2, Subtitle A contains the Office of Management and Budget Guidance for Grants and Agreements. Title 2 CFR § 200 Appendix VII part 3 states: Indirect Cost Allocations Not Using Rates: In certain situations, governmental departments or agencies (components of the governmental unit), because of the nature of their Federal awards, may be required to develop a cost allocation plan that distributes indirect (and, in some cases, direct) costs to the specific funding sources. In these cases, a narrative cost allocation methodology should be developed, documented, maintained for audit, or submitted, as appropriate, to the cognizant agency for indirect costs for review, negotiation, and approval. Condition: The Commission uses a CAP to allocate indirect costs among its various programs that should be certified annually by the RSA. The CAP used by the Commission in fiscal year 2025 was not approved by the RSA. The Commission inquired about the recertification process in April 2025 after we inquired about the certification process and documentation for the CAP as part of our fiscal year 2024 Single Audit procedures. The RSA has instructed the Commission to cease using the CAP to claim indirect costs for grant reimbursement, and to use the de minimis rate until an indirect cost rate plan is approved. Cause: The Commission did not have a procedure in place to review the CAP and submit it for recertification annually as required. Effect: The CAP used by the Commission was not submitted timely for recertification and was not approved for use by the RSA. Using an unapproved CAP to claim reimbursement for indirect costs could result in those costs being questioned, and the RSA could require them to be repaid. Recommendation: We recommend that the Commission work with the federal grantor, the Rehabilitation Services Administration (RSA), to establish an approved indirect cost rate plan. We further recommend that the Commission design and implement procedures to ensure the indirect cost rate plan is implemented as designed and to ensure that future plans are submitted and approved timely and appropriate supporting documentation is retained. Management’s View: The agency agrees with the finding as we were using the cost allocation plan which was originally approved by RSA but needed to be updated when the state changed to a new accounting system (Luma). The updated plan was submitted to the Indirect Cost Division with the Department of Education in January of 2026. After conversations with both RSA and the VRTAC we withdrew our submission in September of 2026 when the Department of Education began their evaluation of the new plan. It was determined that we will negotiate an indirect cost rate rather than use the updated Cost Allocation Plan. Corrective Action: Based on conversations with the Indirect Cost Division, RSA, the state audit team, and the VR TAC team we determined it would be best for the agency to work with the Indirect Cost Division to establish an indirect cost rate. Switching from using the Cost Allocation Plan that we had been using for 16 years, abruptly, to a 15% indirect cost rate April 1, 2026 created multiple hurdles and changes that we have been trying to overcome with the help of the VR TAC team’s intensive assistance. We are in the process of creating a system that will address the errors that were found by the state auditors. The Indirect Cost Division states that we need to begin the new plan July 1, 2027. They have provided us with a template, and we will complete that and work with them to ensure this rate is ready to begin using July 1, 2027. Previously, annually, we submitted a document by email to the Indirect Cost Division indicating that we were re-certifying the same Cost Allocation Plan. We did not receive responses, and we took that to mean it was okay to continue using the same plan each year. From 2021-2025 this was done and there was one year it was submitted later than when we typically (October 1) sent it. In the meeting with the Indirect Cost Division, Andre Hylton, told us that once our indirect rate was established, it would be approved for two years and then after review, it would be on a 5 year review schedule. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2025-206 The Commission is not following Idaho Administrative Rules for Purchasing as required for compliance with the requirements applicable to the Rehabilitation Services -Vocational Rehabilitation Grants to States program. Related to Prior Finding: 2024-203 Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A230016; H126A240016; H126A250016 Program Year: October 1, 2022 - September 30, 2024; October 1, 2023 - September 30, 2025; October 1, 2024 - September 30, 2025 Federal Agency: Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement, Suspension, and Debarment Questioned Costs: $30,000 Known Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The CFR procurement standards at 2 CFR 200.317 state that, when procuring property and services under a federal award, a state must follow the same policies and procedures it uses for procurements from its nonfederal funds. The state of Idaho purchasing rules within the Idaho Administrative Procedures Act (IDAPA) contain the following provisions: IDAPA 38.05.01.32. Total Cost: The acquisition cost of property, including all components, options, and add-ons available under the contract, related services, and, in the case of ongoing services, the cost of the full term of the contract, including all authorized renewals. Unless a different total term is provided in the contract, the term used for purposes of total cost is five (5) years. IDAPA 38.05.01.041. Acquisition Procedures: • Small Purchases: Services with less than $25,000 total cost; software with less than $15,000 total cost; property with less than $15,000 total cost; a mix of property and services less than $15,000. o Small purchases do not require acquisition through competitive solicitation. Agencies must comply with the division’s small purchase policy. Property available under single agency or open contracts shall be purchased under such contracts and are not a small purchase under this rule unless otherwise authorized by the administrator. • Informal Purchases: Acquisition of property with a total cost exceeding the dollar limits established in this rule for a small purchase and less than the formal sealed procedure limit are informal purchases. o Informal Purchases may be made using:  An informal solicitation issued through e-procurement, unless exempted by the administrator; or  The formal sealed procedure, when the purchasing authority makes a written determination that using a formal solicitation is in the best interest of the state, including where selection based solely on cost is not appropriate. o Agencies procuring property under this rule shall maintain a purchasing file containing:  The solicitation document posted and quotes received. If the acquisition was not publicly posted, the agency shall include a statement describing the justification for determining that posting was impractical or impossible, along with the administrator’s authorization.  If not using e-procurement, the agency shall document the quotes received (or its attempt to obtain quotes) from at least three (3) vendors having a significant Idaho economic presence as defined in Section 67-2349, Idaho Code. • Formal Sealed Procedure: o The sealed procedure limit is one hundred fifty thousand dollars ($150,000). o Purchases of property in excess of the sealed procedure limit are made using the formal sealed procedure, unless exempted by these rules or the administrator. IDAPA 38.05.01.042.01. Exceptions Requiring Written Administrator Approval. The administrator may exempt the following purchases from the requirement for competitive solicitation by issuing a written determination to the purchasing authority. • Rehabilitation Agency Acquisitions. Acquisitions of property that is provided by non-profit corporations and public agencies operating rehabilitation facilities serving the handicapped and disadvantaged and that is offered for sale at fair market price as determined by the administrator in accordance with these rules. The buyer must submit a written request to the administrator to purchase from a rehabilitation agency and a written approval from the administrator. The purchase must comply with the division’s policy for rehabilitation agency acquisitions. Condition: We identified two vendors that the Commission paid more than $25,000 in total expenditures in fiscal year 2025 and would be subject to compliance with procurement requirements. We tested payments to those vendors for compliance with procurement policies and found that the Commission could not provide documentation to show that State procurement policies were followed for one of the two vendors. Cause: The Commission erroneously believed that the exemption for rehabilitation agencies applied to more vendors than just not-for-profit entities and public agencies. The Commission also believed that the State purchasing policies did not apply to vendors with many small purchases that are individually below, but collectively exceed, the purchasing thresholds. The Commission has control procedures in place to ensure that grant expenditures are for allowable activities and costs at the transactional level but did not have control procedures to ensure that State procurement rules were followed. Effect: The State’s purchasing policies are designed to ensure that State and federal funds are expended efficiently to meet the goals of State and federal programs. By not following these policies, the Commission could be overpaying for products and services. Recommendation: We recommend that the Commission design and implement procedures to ensure that State purchasing policies are followed. We further recommend that the Commission design and implement procedures to ensure that appropriate documentation is retained to demonstrate compliance and internal controls were operating as intended. Management’s View: The agency agrees with the finding. ICBVI understands the state thresholds and has processes in place for creating contracts when needed. ICBVI believes this finding is ready to be closed. Corrective Action: However, we have since corrected this finding, as it was found on the previous year’s audit. In December of 2025, we received training from the Department of Purchasing. Based on that training ICBVI’s management team worked with DOP to create contracts for current and future purchases. ICBVI asked Laura Cortazar to take the lead on the development of contracts for the agency. ICBVI created a procurement checklist and documentation template, which was added to internal controls to support purchases subject to state policy. In August of 2026, all staff who make any purchases were trained using the new guidelines, which ensure compliance with state procurement requirements. In addition, ICBVI worked with DOP’s process to request purchasing exemptions for working with community rehabilitation programs, universities and with a temporary staffing agency. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit. We appreciate the information about action taken after the fiscal year under audit was completed, but those actions have not been reviewed for the fiscal year 2025 Single Audit. We will review those actions as part of the fiscal year 2026 Single Audit to determine if they were effective in correcting the errors.

FINDING 2025-207 The Commission did not verify that vendors were not suspended or debarred prior to making federal grant payments. Related to Prior Finding: 2024-204 Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A230016; H126A240016; H126A250016 Program Year: October 1, 2022 - September 30, 2024; October 1, 2023 - September 30, 2025; October 1, 2024 - September 30, 2025 Federal Agency: Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement, Suspension, and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Nonfederal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Condition: We identified two vendors that the Commission paid more than $25,000 in total expenditures in fiscal year 2025. We tested compliance with procurement policies for both vendors and found that the Commission could not provide documentation to show that suspension and debarment verifications were completed as required. Cause: The Commission was not completing the suspension and debarment checks because they incorrectly believed that the checks were already being performed by the Office of the State Controller. Effect: We reviewed the vendors selected as part of our testing and verified that neither of them were on the SAM list as suspended or debarred. However, the Commission does not have adequate controls in place to ensure it is not entering into covered transactions with suspended or debarred vendors. Vendors can be suspended or debarred for many reasons including financial crimes such as fraud, embezzlement, or bribery, and other issues such as consistent poor performance on previous contracts or violations of laws. Taking steps to ensure vendors are not suspended or debarred is important to prevent fraud, waste, and abuse. Recommendation: We recommend that the Commission develop and implement procedures to ensure that it is not entering into covered transactions with suspended or debarred vendors and retain documentation to support the procedures performed. Management’s View: The Commission agrees with this finding. ICBVI recognizes the absence of vendor suspension/debarment verifications prior to payment. Corrective Action: • Verification Process: Procedures were put in place to check applicable vendors against the SAM.gov database on an annual basis. Documentation of each check will be retained and periodically reviewed. • Staff Training: Relevant staff will be trained on suspension/debarment requirements, and responsibility for checks will be clearly assigned. Laura Corazar checks that the vendor is not debarred and saves the screenshot demonstrating this. Corey Bresina will review and initial that this has been verified. Procedure as follows: Procedure: Vendor Exclusion Verification – SAM.gov Document Owner: Accounting Department Effective Date: December 1, 2025 Review Cycle: Annually, with quarterly vendor reviews Applicable Regulations: 2 CFR Part 180; 2 CFR Part 200, Subpart C, Appendix I Objective: This procedure establishes the steps for verifying that vendors, contractors, and subrecipients are not suspended, debarred, or otherwise excluded from participation in federally funded programs, in accordance with 2 CFR Part 180. It ensures federal funds are awarded only to responsible parties and provides a documented audit trail for compliance purposes. Scope: These requirements apply to all personnel involved in: • Procurement activities funded as a whole or in part with federal funds • Issuing subawards, contracts, or purchase orders under federal programs • Vendor selection, onboarding, and monitoring • Grant administration and compliance oversight All employees responsible for these functions must follow this procedure. Responsibilities: • All staff involved in procurement, grant management, or vendor selection must perform and document SAM.gov checks. This ensures we remain compliant with 2 CFR Part 180 and protect all federal funds entrusted to our organization. Procedure Steps: • Vendor Identification Gather vendor information: legal name, UEI, CAGE code, and relevant location details. • SAM.gov Exclusion Search Navigate to SAM.gov Click Search Records Select Exclusions under the Domain filter Enter vendor identifiers (Name, UEI, CAGE code, or other applicable criteria) Click Search to retrieve results. • Review Results No Results: Vendor is not excluded “Entity” (green): Vendor is active and eligible “Exclusion” (purple): Vendor is suspended or debarred Do not proceed with any transaction Escalate to Administrative Services Manager Contact the issuing federal agency if clarification is needed. • Documentation Save a PDF or screenshot of the search results Record the search and outcome in the Quarterly Vendor Review Log. • Quarterly Review All active vendors must be reviewed quarterly for exclusion status, based on federal fiscal year Maintain documentation in the designated compliance folder Accounting staff verify completion and records adherence. Recordkeeping: • Maintain PDF/screenshots of each SAM.gov search • Maintain completed Quarterly Vendor Review Logs • Retain records in accordance with federal grant record retention requirements. Non-Compliance: Failure to follow this procedure may result in: • Audit findings • Repayment of federal funds • Suspension or termination of federal awards References: • 2 CFR Part 180 – Non-Procurement Debarment and Suspension • 2 CFR Part 200, Subpart C, Appendix II – Contract Provisions for Non-Federal Entities • SAM.gov Exclusions Database. Auditor’s Concluding Remarks: We thank the Commission for its cooperation and assistance throughout the audit.

FINDING 2025-208 The Department’s Indirect Cost Rate Proposal contained multiple errors. Related to Prior Finding: 2024-212 Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Drinking Water State Revolving Fund Assistance Listing Number: 66.468 Federal Award Number: 98003020; 98003021; 98003022; 02J61801; 02J62801; 02J44701; 02J82001; 02J82401; 02J22801; 02J61701; 02J62701; 02J52301; 02J82201 Program Year: July 1, 2020 – June 30, 2025; July 1, 2021 – June 30, 2026; July 1, 2022 – June 30, 2027; March 1, 2024 – February 28, 2029; October 1, 2024 – September 30, 2029; July 1, 2023 – June 30, 2028; July 1, 2024 – June 30, 2029; July 1, 2024 – June 30, 2029; November 1, 2022 – June 30, 2027; March 1, 2024 – February 28, 2029; October 1, 2024 – September 30, 2029; July 1, 2023 – June 30, 2028; July 1, 2024 – June 30, 2029 Federal Agency: Environmental Protection Agency Compliance Requirement: Allowable Costs/Cost Principles Questioned Costs: Undetermined Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.400 contains the policy guide for cost principles related to federal grant administration. Paragraph (a) states that the nonfederal entity is responsible for the efficient and effective administration of the federal award through the application of sound management practices. Paragraph (d) states that the accounting practices of the nonfederal entity must be consistent with these cost principles and support the accumulation of costs as required by the principles and must provide for adequate documentation to support costs charged to the federal award. Condition: The Department uses an Indirect Cost Rate Proposal (ICRP) with a predetermined fixed cost rate to charge indirect costs to its programs. We reviewed the initial ICRP support documentation and calculations for the indirect cost rate in place for fiscal year 2025 and found multiple errors: • The direct cost base was reported as $28,142,926; however, the Department could not provide documentation to support that it was correct. Audit review procedures estimated the total should have been $29,294,524, a difference of ($1,151,598). • The indirect departmental cost was reported as $10,312,698; however, the Department could not provide documentation to support that it was correct. Audit review procedures estimated the total should have been $10,862,805, a difference of ($550,107). • The rate calculation included a carryforward amount of $2,153,740; however, the Department could not provide documentation to support that it was correct. Audit review procedures estimated the amount should have been $1,172,072, a difference of $981,668. • The rate calculation included an amount from the statewide cost allocation plan (SWCAP) of $13,530. The Department provided support for this amount; however, the support was from the incorrect fiscal year. Audit review procedures estimated the amount should have been $2,825, a difference of $10,705. Cause: The Department has procedures in place for the ICRP to be compiled by the fiscal staff and reviewed by separate staff to identify errors. The Department provided documentation to verify that the review occurred; however, it was not performed at a level of detail necessary to identify the errors. The Department provided historical spreadsheets of the initially proposed indirect cost rate submitted to the Environmental Protection Agency (EPA); however, using the initially proposed amounts and supporting documentation failed to recreate the calculated amounts in the ICRP agreement. The EPA reviewed and modified the Department’s initial proposed ICRP to arrive at the final negotiated ICRP. However, documentation to support the modified ICRP was not available at the time of our review. Effect: We were unable to determine if the indirect cost rate used in fiscal year 2025 was correctly calculated because documentation to support the amounts used in the calculation were unavailable. Further, Department staff could not fully explain or recreate the amounts calculated. Audit procedures calculated estimates based on methodology explained at the time of review and found the direct costs were misstated by ($1,151,98), the total cost pool was misstated by ($495,937), and the carryforward was misstated by $981,668. This results in an ICRP of 37.09 percent, compared to the Department’s calculated rate of 36.85 percent, and the EPA approved rate of 33.09 percent. Recommendation: We recommend that the Department provide training for Department staff preparing and reviewing the ICRP to ensure compliance with applicable regulations. We further recommend that the Department design and implement procedures to retain documentation of the methods used to compile the ICRP and the basis for the amounts reported in the ICRP. Management’s View: Due to staff turnover, DEQ agrees that sufficient supporting documentation could not be located to recreate the data and calculations from the initial indirect cost rate proposal (ICRP) packet. DEQ does not agree with the ‘Cause’ statement of the Management Letter that says, “documentation to support the modified ICRP was not available at the time of our review.” DEQ had the documentation supporting the negotiated rate with the Environmental Protection Agency (EPA). The Legislative Services Office (LSO) Audit Division audited the initial indirect cost rate proposal (ICRP) only, which had errors, but not the final packet that was modified and approved by EPA. The rate used by DEQ for FY25 was reviewed, modified (negotiated) and approved by EPA. Corrective Action: DEQ has had significant turnover in the fiscal office, which has resulted in gaps of knowledge of policies and practices. In summer 2025, DEQ leadership reorganized the fiscal department to improve efficiency, enhance oversight of grants and contracts, and strengthen financial controls. The fiscal office is currently in a rebuilding phase and is dedicated to training and developing staff, implementing best practices, and documenting processes and procedures, including those for federal grant compliance. The agency reached out to our federal oversight agency for assistance and direction with preparing and submitting the indirect cost rate proposal for FY27. We have and are committed to maintaining a file with all supporting documentation used to compile and prepare current and future proposals, as required by 2 CFR 200. Training and developing staff is an ongoing process, along with following updated federal rules and regulations. DEQ staff worked with the Environmental Protection Agency’s Indirect Cost Rate Negotiator to submit the indirect cost rate proposal packet for FY27 and we anticipate significantly reduced errors with the calculations and support for that submittal. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We continue to assert that the audit team was not provided with information to verify amounts used in the indirect cost rate proposal applicable to fiscal year 2025 grant awards. Further, the team was not provided with information related to schedules or calculations for the final negotiated indirect cost rate during the completion of audit fieldwork. A cursory review of the final negotiated indirect cost rate documentation that was provided after the audit fieldwork was completed included amounts that the audit team was unable to verify or agree to supporting documentation. We continue to recommend that the Department maintain appropriate documentation to support the approved indirect cost rate.

FINDING 2025-209 The Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) project and expenditure reports (P&E) contained misstatements. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: American Rescue Plan Act - Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The CSLFRF grant award from the U.S. Department of the Treasury requires recipients to provide quarterly P&E reports that contain related costs incurred during the covered period. The recipient’s quarterly P&E report submissions should be supported by the data in the recipient’s accounting system. Condition: During fiscal year 2025, the Division was required to submit four P&E reports for the CSLFRF program. Each quarter, the State agencies tasked with administering the CSLFRF projects complete templates containing required report information by individual project and send them to the Division. The Division’s State financial officer uses the templates to compile and submit reports to the U.S. Department of the Treasury, which identifies quarters based on the calendar year. Quarter 1 is January through March, Quarter 2 is April through June, Quarter 3 is July through September, and Quarter 4 is October through December. We tested the Quarter 1 (Q1) and Quarter 2 (Q2) reports for the following required data elements: current period obligations, cumulative obligations, current period expenditures, and cumulative expenditures. We compared the amounts recorded in Luma to the amounts reported on the templates and the amounts in the final reports. We identified three types of errors in the amounts reported as current period expenditures: • Reported amounts matched the template amounts but did not match the amounts recorded in Luma. Current period expenditures were overstated in the Q1 report by $2,077,728 and understated in the Q2 report by $938,788. • Template amounts matched the amounts recorded in Luma but did not match the amounts in the final report. Current period expenditures were overstated in Q1 by $26,558. • Reported amounts did not match the template amounts or the amounts recorded in Luma. In the Q1 report, the amounts in the final report were $53,300 less than the amounts recorded in Luma and $218,311 less than the amounts reported on the templates. In the Q2 report, the amounts in the final report were $186,086 more than the amounts recorded in Luma and $121,759 more than the amounts reported on the templates. The errors in the current expenditures also affect the amounts reported as cumulative expenditures. The amount reported as current obligation in the Q2 report was overstated by $410,904. This caused the cumulative obligations to be overstated by the same amount. We identified projects labeled as in-progress, but no agency templates were received for the quarterly reports. In these cases, the Division reported no changes from the prior report; however, without the agency templates, we could not verify if that was correct. We identified 25 projects with no templates in the Q1 report and 12 in the Q2 report. In the Q2 report, one project with no template was reported as a $704,904 reduction in cumulative obligations compared to the prior report, and the Division could provide no support for the reported amount. Cause: The Division has a control in place intended to identify and reduce errors in reporting. The reports are reviewed by an employee separate from the employee who compiled the reports. We reviewed documentation to verify the control was in place for the tested reports and found that one report was appropriately reviewed by a separate employee; however, the other report was reviewed by an employee who was also involved in the report compilation. On both reports, the reviews were not performed at a level of detail necessary to identify the errors. The Division also made adjustments to some information provided by agencies based on possible mathematical or other logic errors but did not verify the adjustments were accurate with the agencies. The Division cited time constraints, a high turnover rate in fiscal personnel, and inadequate training as causes for the errors. Effect: The cumulative errors in current expenditures resulted in a $1,859,235 overstatement in the Q1 report and a $630,943 understatement in the Q2 report. Current obligations were also overstated by $410,904 in the Q2 report. We were unable to accurately determine an error amount for projects with missing templates. The errors identified were less than the $8,982,324 materiality for the CSLFRF program; however, that does not consider other potential errors we could not determine, and ineffective internal controls could lead to material errors in future reports. Recommendation: We recommend that the Division design and implement internal controls to ensure CSLFRF P&E reports are accurate. We also recommend that the Division contact the U.S. Department of the Treasury to correct erroneous information in the Treasury Portal as suggested in the Project and Expenditure User Guide published by the U.S. Department of the Treasury. Management’s View: The Division agrees with the finding and recognizes that additional controls are needed to ensure CSLFRF Project and Expenditure reports are accurate, fully supported, and more thoroughly reconciled to the State’s accounting system before submission. The Division notes that the identified errors were below the program’s materiality threshold and did not result in a finding of material noncompliance or a material weakness. The Division also corrects reporting errors when they are identified. However, Treasury’s published FAQ and written correspondence (attached) confirm that submitted reports cannot be reopened after the reporting deadline. Because P&E reports are cumulative, any necessary corrections must be reflected in a subsequent reporting period. This required correction process contributed to some of the differences identified during the audit because adjustments related to prior periods were necessarily recorded in later reports. Accordingly, the timing of these adjustments was consistent with Treasury’s prescribed reporting process. Corrective Action: The Division will implement the following corrective actions for all remaining CSLFRF P&E reports: 1. Required agency support. Each administering agency will submit a completed reporting template for every active project. If no activity occurred, the agency must provide documented confirmation of no change. Missing templates will be tracked and escalated before the report is finalized. 2. Reconciliation to Luma. Current and cumulative expenditures and obligations will be reconciled by administering agency to Lumat. All differences will be documented and resolved before submission. 3. Independent detailed review. The review will cover source templates, Luma reconciliations, current and cumulative amounts, prior-period balances, adjustments, and evidence supporting projects reported with no change. 4. Procedures, training, and retention. The Division will document the reporting process, provide training and cross-training to staff involved in CSLFRF reporting, and retain the templates, reconciliations, agency confirmations, review checklist, and final submission support in a centralized reporting file. 5. Correction of prior reporting errors. The Division will correct the identified errors through Treasury's prescribed process. In written email correspondence to Justin Collins, the U.S. Department of the Treasury confirmed: 'Prior submitted reports are not eligible to be re-opened for revisions since the reporting deadline has passed. The SLFRF Project and Expenditure Reports are cumulative reports, and any adjustments needed will need to be made in the next reporting period.' Accordingly, the Division will document and include the necessary adjustments in the next available cumulative P&E report and retain Treasury's email as support for the correction method. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We would like to clarify that the Division is correct in stating that the errors we were able to identify were not material to the program, but we also were not able to verify the accuracy for those projects with missing templates and these two issues indicate significant deficiencies in the Division’s internal controls over reporting that could lead to material errors in the future if not properly addressed.

FINDING 2025-210 The Department did not provide documented support to verify the accuracy of a Low Income Energy Assistance Program (LIHEAP) performance report. Related to Prior Finding: 2024-230 Type of Finding: Significant Deficiency, Noncompliance AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLIEA; 2301IDLIEA; 2301IDLIEE; 2401IDLIEI; 2401IDLIEA Program Year: October 1, 2022 – September 30, 2024; October 1, 2023 – September 30, 2025 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.302(b)(3) states that the recipient's financial management system must maintain records that sufficiently identify the amount, source, and expenditure of federal funds for federal awards. These records must contain information necessary to identify federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: During fiscal year 2025, the Department was required to submit one LIHEAP performance report to the federal government. The Department’s LIHEAP program manager compiled and submitted the report to the Office of Community Services. The Department was unable to provide the supporting documentation to confirm the accuracy of the information included in the report. Cause: The Department did not implement an internal control to ensure that sufficient documentation was maintained to support the accuracy of the required report. This relates to Finding 2024-230 included in the fiscal year 2024 Single Audit Report. The performance report was submitted in January 2025 prior to the issuance of the fiscal year 2024 Single Audit Report. Corrective actions associated with the prior-year finding had not been implemented at the time of the submission of the report during fiscal year 2025. Effect: Without documented support for the LIHEAP performance report, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department implement internal controls and maintain sufficient documentation to support information included in LIHEAP performance reports. Management’s View: The agency agrees with the finding. Corrective Action: The Department has updated a process document that will strengthen our internal controls regarding the LIHEAP performance report. The Department will compile and retain sufficient documentation to support the information included in the LIHEAP Performance report. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2025-211 Federal Funding Accountability and Transparency Act (FFATA) reports were not reviewed prior to submission and were not submitted timely. Type of Finding: Material Weakness, Material Noncompliance AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLIEA; 2301IDLIEA; 2301IDLIEE; 2401IDLIEI; 2401IDLIEA; 2501IDLIEI; 2501IDLIEA Program Year: October 1, 2022 – September 30, 2024; October 1, 2023 – September 30, 2025; October 1, 2024 - September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Under the requirements of the FFATA (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more through the Official U.S. Government System (SAM.gov) and must report no later than the end of the month following the month in which the subaward was issued. Condition: During our discussions with the Department, we determined that the Department’s FFATA reporting process was performed by a single individual who prepared and submitted reports without an independent review prior to submission. Twenty-eight subawards were awarded by the Department in fiscal year 2025. We tested a sample of eight subawards and noted that seven (or 88 percent) were not submitted timely. The late submissions ranged from nine to nineteen months past the required reporting deadline. Cause: Internal control procedures were not designed to include an independent review of the FFATA reports prior to submission. Additionally, due to staffing constraints, the Department assigned a lower priority to FFATA reporting, resulting in a backlog of FFATA reports and delayed submission of subaward information. Effect: The FFATA reports are required to be submitted to SAM.gov, which makes the subaward information available to the public in a searchable database. Late reporting impacts the integrity of that information. Additionally, without documented internal controls, there is an increased risk that reporting errors or instances of noncompliance may occur and remain undetected and uncorrected. Recommendation: We recommend that the Department design and implement internal control procedures to ensure compliance with federal reporting requirements for the complete, accurate, and timely completion of FFATA reports. Management’s View: The agency agrees with the finding. Corrective Action: The FFATA Data Worksheet, developed by DHW, includes a list of all obligations of federal funds to subgrantees of $30,000 or more that occurred during the prior month. The due date will be added to the FFATA Data Worksheet to draw particular attention to that. The FFATA Data Worksheet is prepared by the Grant Reporting Team Lead, Financial Specialist, Senior, and the Cash and Grants Supervisor, Financial Specialist, Principal, will be responsible for reviewing it to ensure all applicable subgrants are included for the month. Once that review has occurred and any resulting edits have been made, the FFATA Data Worksheet will be returned to the Grant Reporting Team Lead to enter the data in sam.gov. As sam.gov does not offer a “save” function, there is not a presubmission review. The previously discussed review by the Cash and Grants Supervisor is aimed at preventing any noncompliance related to omission of reportable obligations. A final review aimed at detecting and timely correcting any material misstatements will take place with the Technical Records Specialist completing a data entry review to ensure the data entered into sam.gov agrees with the FFATA Data Worksheet. A FFATA Report Routing Sheet will also be developed to document the above reviews and approvals. The FFATA Report Routing Sheet will also include the due date as another point of monitoring for timely submission. Completed routing sheets and supporting documentation will be retained in the grant file as evidence that the required review, submission, and verification procedures are performed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2025-212 A Social Services Block Grant (SSBG) Post-Expenditure Report did not include a review and approval prior to submission. Type of Finding: Material Weakness AL Title: Social Services Block Grant AL Number: 93.667 Federal Award Number: 2201IDSOSR; 2301IDSOSR; 2401IDSOSR; 2501IDSOSR Program Year: October 1, 2021 – September 30, 2023; October 1, 2022 – September 30, 2024; October 1, 2023 – September 30, 2025; October 1, 2024 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. The United States Code (USC) Title 42, Section 1397(e) requires states to submit to the federal administering agency, the Office of Community Services, an annual Post-Expenditure Report no later than six months following the close of the fiscal year. Condition: During our discussions with the Department, we determined that the Department’s Post-Expenditure Report process was performed by a single individual who prepared and submitted the reports without an independent review prior to submission. Cause: The Department did not design and implement an internal control requiring review and approval prior to submission. Effect: We did not identify any errors in the Post-Expenditure Report. However, without a documented internal control, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department design and implement internal controls to ensure the report submitted to the federal agency is complete, accurate, and in compliance with federal reporting requirements. Management’s View: The agency agrees with the finding. Corrective Action: The SSBG Post-Expenditure Report has been added to the Department’s Grant Log with the applicable due date and will follow the Department’s established federal financial reporting review process. Prior to submission, the Grant Reporting Team will prepare the report and supporting workpapers, these include reconciliation of reported expenditures to the underlying financial records and documentation supporting the information reported. The report will be routed to the appropriate supervisor and/or Financial Manager for review and approval before submission. The Report Routing Cover Sheet will document the preparer, reviewer, date of review, approval, and any corrections or follow-up required. The Cash and Grants Supervisor will monitor the Grant Log to ensure the Post-Expenditure Report is routed, reviewed, approved, and submitted by the required due date. Completed Report Routing Cover Sheets and supporting documentation will be retained with the grant records as evidence that the required review and approval occurred prior to submission. This process will provide a documented review and approval control over the SSBG Post-Expenditure Report and ensure that management has evidence that the report was reviewed for accuracy and completeness before it is submitted. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2025-213 A Social Services Block Grant (SSBG) financial report was not submitted timely. Type of Finding: Material Weakness, Material Noncompliance AL Title: Social Services Block Grant AL Number: 93.667 Federal Award Number: 2301IDSOSR Program Year: October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. The grant award issued by the Administration for Children and Families (ACF), U.S. Department of Health and Human Services, requires recipients to submit Federal Financial Reports (SF-425) annually no later than 90 days after the close of the federal fiscal year. In addition, the final SF-425 should be submitted no later than 120 days after the close of the project period. Condition: During fiscal year 2025, the Department was required to submit three SF-425 reports, including a final report for grant phase 2023. We reviewed all three reports and noted that one of the three reports tested (or 33 percent), the final report for grant phase 2023, was due on December 31, 2024, but was not submitted until February 20, 2026, approximately 14 months after the required due date. Cause: Although the Department demonstrated review and approval of the report prior to submission, controls did not operate effectively to monitor reporting deadlines and ensure timely submission. Effect: Late report submissions may hinder timely oversight by the federal regulator and delay identification of potential financial or compliance issues. Additionally, ineffective controls increase the risk that future required reports may not be submitted within federally required timeframes. Recommendation: We recommend that the Department strengthen internal controls over financial reporting to monitor reporting deadlines and ensure required SF-425 reports are submitted within required timeframes. Management’s View: The agency agrees with the finding. Corrective Action: The Department will strengthen its existing grant reporting controls to provide earlier identification and escalation of issues that could prevent timely submission of required financial reports. The Grant Reporting Team will continue to use the Grant Log to monitor reporting due dates and will identify required source information and establish an internal completion date sufficiently in advance of the grantor deadline. If required information is unavailable, incomplete, or otherwise prevents the report from being finalized, the Grant Reporting Team Lead will escalate the issue to the Cash and Grants Supervisor and/or Financial Manager for resolution. When appropriate, the Department will communicate with the grantor regarding the reporting issue and request an extension before the established due date. Documentation of the request, grantor response, and any related resolution will be retained in the grant file. The Report Routing Cover Sheet will be updated to document the completion of required reporting steps, including confirmation that all necessary supporting information has been received, required management review has occurred, and any extension request or related grantor communication has been documented and retained. The Cash and Grants Supervisor will review the Grant Log and Report Routing Cover Sheets at least monthly to identify upcoming reports, unresolved information requests, and reports at risk of missing their due dates. This process will provide management with sufficient advance notice to intervene when necessary and will establish a documented record demonstrating that required financial reports were monitored through completion and submitted timely. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2025-214 The Department did not review the Child Care Development Fund (CCDF) Administration for Children and Families (ACF) Form 696 report at a sufficient level to identify an $88,822 misstatement. Related to Prior Finding: 2024-224 Type of Finding: Material Weakness, Noncompliance AL Title: Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.596 Federal Award Number: 2301IDCCDF Program Year: October 1, 2022 – September 30, 2025 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 98.65(g) states that lead agencies shall submit financial reports, in a manner specified by the ACF, quarterly for each fiscal year until funds are expended. Additionally, Form ACF-696 (Financial Reporting Form for State and Territory Child Care and Development Fund (CCDF) Lead Agencies) states that the CCDF program has a number of fiscal requirements associated with multiple funding streams that comprise the block grant. Form ACF-696 has separate columns for reporting expenditures from each of these component funding streams. Condition: The Department is required to complete a Child Care and Development Fund (CCDF) financial report (Form ACF-696) on a quarterly basis for each grant. The Department compiles the report using supporting workpapers that summarize expenditures by funding source, including mandatory, matching, and discretionary funds. During our testing, we found that one out of four Forms ACF-696 tested (or 25 percent) contained a formula error within the supporting workpaper that resulted in inaccurate amounts being reported on the quarterly financial report. Specifically, Child Care Administration expenditures and Total Expenditures of Discretionary Funds were understated by $88,822, while Federal Share of Obligations was overstated by $88,822. Cause: The Department's review of Form ACF-696 was not performed at a sufficient level of detail to identify a formula error in the workpaper used to prepare the report. This relates to Finding 2024-224 included in the fiscal year 2024 Single Audit Report. The report was submitted in April 2025 prior to the issuance of the fiscal year 2024 Single Audit Report. Corrective actions associated with the prior-year finding had not been implemented at the time of the submission of the April 2025 report. Effect: Child Care Administration expenditures were understated by $88,822 (3.7 percent) and should have been reported as $2,492,664. Total Expenditures of Discretionary Funds were understated by $88,822 (0.4 percent) and should have been reported as $24,284,017. As a result of the error, the Federal Share of Obligations was overstated by $88,822. Inaccurate reporting may affect the reliability of information used by ACF to monitor program expenditures, obligations, and compliance with federal requirements. Recommendation: We recommend that the Department strengthen review procedures regarding Form ACF-696 to ensure information reported to the federal agency is complete, accurate, and supported by underlying calculations prior to submission. Management’s View: The agency agrees with the finding. Corrective Action: The Grant Reporting Team Lead, Cash and Grants Supervisor, and/or Financial Manager will strengthen its review by performing and documenting an in-depth review of the ACF-696 workpapers each time a grant budget period or phase is rolled forward. This review will be completed within 90 days of the start of the new budget period and will include verification of applicable formulas and other high-risk calculations. To provide ongoing oversight, the Grant Log will be used as a centralized tracking mechanism to document budget period start dates, assigned reviewer, review completion date, identified discrepancies, and resolution of any issues. Reviewers will retain documentation evidencing the review and any corrections made. The Cash and Grants Supervisor or Financial Manager will periodically verify completion of the reviews and evaluate identified discrepancies to determine whether additional corrective action or process changes are necessary. These procedures are intended to provide a documented, repeatable review process with sufficient precision to identify reporting errors. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2025-215 The Department did not meet the Mental Health Block Grant (MHBG) earmarking requirement for evidence-based programs addressing early serious mental illness. Type of Finding: Significant Deficiency, Noncompliance AL Title: Community Mental Health Services Block Grant AL Number: 93.958 Federal Award Number: B09SM087355 Program Year: October 1, 2022 - September 30, 2024 Federal Agency: Department of Health and Human Services Requirements: Matching, Level of Effort, and Earmarking Questioned Costs: $97,603 Known Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Pursuant to 42 USC 300x-9c, a state shall expend not less than 10 percent of the MHBG award for evidence-based programs that address the needs of individuals with early serious mental illness, including psychotic disorders. Condition: During our testing, we noted that the Department did not meet the earmarking requirement for evidence-based programs addressing the needs of individuals with early serious mental illness. The fiscal year 2023 MHBG award, which ended during the audit period, required the Department to expend at least $547,052 of the $5,470,521 award on qualifying evidence-based programs. However, the Department expended only $449,449, resulting in a shortfall of $97,603. Cause: The Department maintained spreadsheets to budget and track expenditures related to evidence-based programs addressing early serious mental illness throughout the grant period. However, the Department's process for monitoring the required earmark amount was not designed to ensure compliance with the federal expenditure requirement. Effect: The Department did not comply with the earmarking requirement for evidence-based programs addressing early serious mental illness and under-expended the required amount by $97,603. As a result, fewer funds were directed toward services intended to address the needs of individuals with early serious mental illness than required under the program. Recommendation: We recommend that the Department strengthen internal controls to ensure expenditures for evidence-based programs addressing early serious mental illness are sufficient to meet the required earmarking amount before the end of the grant period. Management’s View: The agency agrees with the finding. Response Idaho Department of Health and Welfare (DHW) agrees with the finding. DHW consulted with the Substance Abuse and Mental Health Services Administration (SAMHSA) Grants Project Officer (GPO) regarding the Early Serious Mental Illness (ESMI) earmarking requirement, including how the requirement is calculated, the flexibility available for meeting the requirement, and the potential impact on future Mental Health Block Grant (MHBG) funding. The GPO confirmed that the standard requirement is to expend not less than 10% of the MHBG award on evidence-based programs addressing ESMI. The GPO also confirmed that a State may elect the two-year option to expend not less than 20% of the ESMI set-aside by the end of the succeeding fiscal year. For Idaho's current grant period, this provides additional time to meet the expenditure requirement through qualifying ESMI activities. SAMHSA GPO Guidance The GPO further stated that if Idaho appropriately elects and documents the 20% two-year option, SAMHSA would not expect a penalty or negative impact on future MHBG funding. If the expenditure requirement is not met, unexpended ESMI set-aside funds cannot be drawn down and would revert to the Treasury. If ESMI set-aside funds are spent on non-ESMI activities, the amount used for those expenditures would need to be returned. This repayment requirement would not apply to other MHBG funds that were properly spent on allowable activities outside of the ESMI set-aside. The GPO also clarified that there is no separate waiver or exception process for the ESMI expenditure requirement beyond the 20% two-year flexibility. SAMHSA's MHBG closeout team will provide additional guidance regarding documentation expected at closeout to support use of the two-year flexibility. The GPO also clarified that no-cost extensions are not currently an option for the MHBG grant. The 10% ESMI earmark is calculated based on the total MHBG award amount for the grant period, not the amount drawn down or spent to date. Prior Monitoring Process DHW has historically used grant budget papers, LUMA financial system expenditure information, and spreadsheets to track ESMI expenditures; however, prior processes did not provide sufficient controls to ensure the required earmark was met. LUMA expenditure reporting and data processes have since been improved and are now used as part of the monitoring process. Improvements Already Implemented DHW has already taken steps to strengthen the monitoring of MHBG and ESMI expenditures. The MHBG team is developing an MHBG expenditure tracking tool to monitor expenditures at the program level and the amount needed to meet the ESMI earmark. The MHBG team also reviews LUMA expenditure data to monitor spending, identify issues or discrepancies, and determine whether additional follow-up is needed. The Finance and Budget Unit (FABU) updates the LUMA Data tab in the Realignment Project spreadsheet, and Grant Reporting posts the MHBG workpapers for review. The MHBG team reviews the expenditure information and MHBG workpapers and compares ESMI expenditures to the required earmark. The MHBG team also meets quarterly with internal partners to review MHBG grant activities, expenditures, reporting, progress made, and any challenges or concerns. These meetings provide an opportunity to discuss how the grant is progressing, identify potential issues, and determine whether additional follow-up is needed. For MHBG funding, the MHBG Team has implemented an annual Internal Funding Request process to provide a consistent process for requesting, reviewing, approving, and tracking MHBG funding. These improvements will be incorporated into the formal monitoring process outlined below and will continue throughout the grant period. Corrective Action: Idaho Department of Health and Welfare (DHW) will implement a formal process to monitor compliance with the Mental Health Block Grant (MHBG) 10% Early Serious Mental Illness (ESMI) earmarking requirement throughout each grant period. The Adult Mental Health (AMH) Program Manager will oversee implementation of the monitoring process, with review and oversight by the System Design and Implementation Bureau– Adult Behavioral Health (SDI-ABH) Chief and System Design and Implementation Programs Bureau Chief. The MHBG team, ESMI team, Grant Reporting, and Finance and Budget Unit (FABU) will each have defined responsibilities within the monitoring process. The corrective action will include the following steps: 1. Establish an ESMI expenditure tracking process. The MHBG team will develop and maintain an MHBG expenditure tracking tool to identify and track qualifying ESMI expenditures at the program level and compare the expenditure information to the required 10% earmark for the MHBG grant. FABU will maintain the expenditure information in the Realignment Project spreadsheet, and Grant Reporting will provide the MHBG workpapers through its established process. 2. Calculate the required earmark amount. At the beginning of each grant period, the MHBG team will calculate and document the amount required to meet the 10% ESMI earmark and the timeframe for meeting the requirement before the end of the grant period. 3. Monitor ESMI expenditures quarterly. FABU will provide the ESMI personnel costs monthly and continue to update the LUMA Data tab in the Realignment Project with the expenditure information. Grant Reporting will post the MHBG workpapers. The ESMI team will manage the ESMI contracts, provide support to ESMI providers, and review and process ESMI invoices to ensure providers are submitting invoices in accordance with their contracts. The MHBG team will review the workpapers and expenditure information for accuracy, compare the program-level expenditure tracking to the information provided in the grant workpapers, and compare actual ESMI expenditures to the required 10% earmark. The MHBG team will follow the established workpaper review and approval process. 4. Review expenditure status and address potential shortfalls. The MHBG team will review the quarterly expenditure information to identify potential shortfalls and determine whether additional qualifying ESMI expenditures may be needed to meet the 10% ESMI earmark. If a potential shortfall is identified, the MHBG team will work with internal partners and look for additional qualifying ESMI activities, including opportunities with other providers or programs, to address the shortfall and meet the setaside requirement before the end of the grant period. FABU and Grant Reporting will complete their respective reviews as part of their established processes. The MHBG team will reach out to FABU or Grant Reporting as needed when questions, discrepancies, or clarification are identified. The AMH Program Manager will oversee this process and provide updates to the SDI-ABH Behavioral Health Chief and System Design and Implementation Programs Bureau Chief as needed. 5. Maintain supporting documentation. The MHBG team will maintain documentation supporting the ESMI expenditure monitoring process, including the expenditure tracking, quarterly reviews, required 10% earmark calculations, MHBG grant workpapers reviewed, the timeframe for meeting the requirement, and any identified discrepancies or corrective actions. Documentation will be maintained in the appropriate grant files in accordance with DHW record retention requirements. 6. Complete the grant closure review. FABU will initiate the established grant closure process approximately two months prior to the closure of each grant phase. During Stage 1, the grant will be reviewed to identify the areas and parties that need to be involved in the closure process. During Stage 2, Grant Reporting, Cash Management, and other identified parties will participate in the closure review. The MHBG team will participate in the closure process and review the ESMI expenditures and documentation to verify that the required 10% earmark has been met. Any questions or discrepancies identified during the closure process will be addressed with the appropriate parties. The results of the review will be documented and maintained with the grant records. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We would like to clarify that the two-year option to expend not less than 20 percent of the EMSI set-aside was not met, based on the communication and documentation provided by the Department. The Department indicated that there were not enough applicable cases to meet the 10 percent earmarking minimum in any given year. In addition, the second year of the specific grant reviewed is already complete and based on the supporting documentation spreadsheet provided by the Department the option for a two-year 20 percent earmarking was not met.

FINDING 2025-216 The Department understated federal expenditures on the Children's Health Insurance Program (CHIP) CMS-21 Base Reports by $1,088,209. Type of Finding: Significant Deficiency, Noncompliance AL Title: Children's Health Insurance Program AL Number: 93.767 Federal Award Number: 2405ID5021; 2505ID5021 Program Year: October 1, 2023 – September 30, 2025; October 1, 2024 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Centers for Medicare & Medicaid Services (CMS) requires states participating in CHIP to submit the Quarterly Children's Health Insurance Program Statement of Expenditures for Title XXI (Form CMS-21). The CMS-21 Base Report is the State's accounting statement of actual recorded CHIP expenditures and the disposition of federal funds claimed under Title XXI. Amounts reported on the CMS-21 Base Report must be based on actual recorded expenditures supported by underlying source documentation. Condition: During our testing, we noted federal expenditures reported on the CMS-21 Base Reports were understated by $1,088,209. Specifically, cost allocation expenditures were omitted from the data used to prepare the CMS-21 Base Reports. The omission affected all four quarterly reporting periods during fiscal year 2025. Cause: The Department did not maintain an effective process to ensure all eligible expenditures, including cost allocation expenditures, were included in the data used to prepare the CMS-21 Base Reports. Effect: Federal expenditures reported on the CMS-21 Base Reports were understated by $1,088,209, resulting in eligible expenditures not being claimed in the appropriate reporting periods. Inaccurate reporting may affect the reliability of information used by CMS to monitor program expenditures and determine the federal share of CHIP expenditures. Recommendation: We recommend that the Department strengthen internal controls over the CMS-21 Base Reports to ensure all eligible expenditures, including cost allocation expenditures, are included and accurately reported prior to submission. Management’s View: The agency agrees with the finding. Corrective Action: During the FFY 2026, Quarter 1 CMS-21 reporting cycle, the Medicaid Budget Team identified underreported indirect expenditures for State Fiscal Years 2024 and 2025. The discrepancies were traced to initial reporting issues following the LUMA system go-live in July 2023, which resulted in indirect expenditures not being incorporated into the CMS-21 reporting process. To address the underreporting, the Medicaid Budget Team entered prior-period adjustments on CMS 21P forms to claim the eligible expenditures for the affected eight quarters, consistent with applicable CMS reporting requirements. To strengthen internal controls and prevent recurrence, the Medicaid Budget Team developed a new report that automatically incorporates indirect expenditures into the CMS-21 workpapers. This automated process reduces the risk of indirect expenditures being omitted and provides additional control to improve the completeness and accuracy of future CMS-21 reporting. Included is the CMS 21 Summary Sheet which shows the consolidation of the prior period adjustments make to claim all identified expenditures that had been omitted (line 2). Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2025-217 The Department lacked documented evidence of monitoring over provider screening and enrollment activities performed by the Department's service organization for the Medicaid and CHIP programs. Type of Finding: Material Weakness AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program; Children's Health Insurance Program AL Number: 93.777; 93.778; 93.767 Federal Award Number: 2405ID5000; 2405ID5CAA; 2405ID5MAP; 2405ID5ADM; 2505ID5MAP; 2505ID5ADM; 2405ID5021; 2505ID5021 Program Year: July 1, 2019 – June 30, 2025; May 1, 2021 – April 30, 2026; October 1, 2023 – September 30, 2025; October 1, 2024 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The regulation further requires recipients to evaluate and monitor compliance with statutes, regulations, and the terms and conditions of federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, monitoring activities, and segregation of duties. Monitoring activities are used to assess whether internal controls are present and functioning and to evaluate deficiencies in a timely manner. To receive Medicaid or CHIP payments, providers must be licensed in accordance with applicable federal, state, and local laws and regulations; screened and enrolled in accordance with 42 CFR Part 455, Subpart E; comply with state plan and applicable disclosure requirements included in 42 CFR Part 455, Subpart B; and not be barred from participation by the Office of Inspector General's exclusion list. States must also follow guidance included in the Medicaid Provider Enrollment Compendium (MPEC) when enrolling providers. The MPEC section 1.5.3.B.1 titled State Medicaid Agency (SMA) Bears Responsibility for Screening Activities Delegated to its Contractors states that, “For the provider screening requirements under Subpart E and based on the disclosures under Subpart B, to the extent that a SMA delegates responsibility for provider screening and enrollment to a contractor, the SMA remains fully responsible for compliance with the requirements at Subpart B and Subpart E.” Condition: As a condition of accepting the grant award, the Department establishes provider eligibility requirements to ensure providers meet applicable State and federal participation requirements. One of the Department’s independent service organizations performs provider eligibility activities for the Medicaid and CHIP programs, including provider enrollment, screening, licensure verification, and revalidation. The service organization processes applications and supporting documentation submitted by providers and reviews the documentation required for each provider type before updating a provider's eligibility status within the Medicaid Management Information System (MMIS). The Department relies on the service organization to determine whether providers are eligible to participate in the Medicaid and CHIP programs. However, when we requested documentation to support the Department’s efforts to ensure the service organization was properly determining and documenting provider eligibility for the Medicaid and CHIP programs, we found that no procedures are in place. Cause: The Department does not believe that documented contract monitoring over the service organization is required therefore does not have an internal control in place to document and retain evidence of monitoring activities performed over the service organization’s provider eligibility processes. Effect: Although our testing did not identify any ineligible providers, the absence of documented monitoring increases the risk that providers who do not meet eligibility requirements could participate in the programs and receive Medicaid or CHIP payments. Recommendation: We recommend that the Department establish and implement formal internal controls over monitoring procedures of the service organization's provider eligibility processes and retain documentation demonstrating those monitoring activities were performed. Management’s View: The agency agrees with the finding. Corrective Action: The department routinely identifies, evaluates, and addresses areas of deficiency through its established oversight processes for our enrollment and credentialling contractor, Gainwell Technologies. The department reviews and documents, on a monthly basis, the contractor’s performance on 175 measures. The department and Gainwell representatives also participate in five (5) weekly, one (1) biweekly, and two (2) monthly meetings to facilitate issue identification, resolution, and monitoring of contractual performance related to enrollment and credentialling. While there were no providers found to be inappropriately enrolled or credentialled, the department understands that there are outstanding concerns regarding the state’s oversight. The department will coordinate with the Centers for Medicare and Medicaid Services (CMS) to identify gaps between current practices and CMS expectations establish a plan to address the auditors' concerns regarding compliance. The department anticipates completing this plan by January 1, 2027. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2025-218 The Department did not ensure compliance with federal requirements that Managed Care Organizations (MCO) were submitting provider roster reports annually to verify that all providers were properly licensed and in good standing. Related to Prior Finding: 2024-218 Type of Finding: Material Weakness, Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program; Children's Health Insurance Program AL Number: 93.777; 93.778; 93.767 Federal Award Number: 2405ID5000; 2405ID5CAA; 2405ID5MAP; 2405ID5ADM; 2505ID5MAP; 2505ID5ADM; 2405ID5021; 2505ID5021 Program Year: July 1, 2019 – June 30, 2025; May 1, 2021 – April 30, 2026; October 1, 2023 – September 30, 2025; October 1, 2024 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The regulation further requires recipients to evaluate and monitor compliance with statutes, regulations, and the terms and conditions of federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, monitoring activities, and segregation of duties. Monitoring activities are used to assess whether internal controls are present and functioning and to evaluate deficiencies in a timely manner. To receive Medicaid or CHIP payments, providers must be licensed in accordance with applicable federal, state, and local laws and regulations; screened and enrolled in accordance with 42 CFR Part 455, Subpart E; comply with state plan and applicable disclosure requirements included in 42 CFR Part 455, Subpart B; and not be barred from participation by the Office of Inspector General's exclusion list. States must also follow guidance included in the Medicaid Provider Enrollment Compendium (MPEC) when enrolling providers. Medicaid and CHIP managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements applicable to fee-for-service providers pursuant to 42 CFR Part 438, Subpart H. Condition: The Department has contracts with four MCOs. Two of the MCOs are required to submit annual provider roster reports for their applicable managed care plans. Receipt, review, and approval of the provider roster reports for each applicable plan are documented by the Department on a tracking spreadsheet. We verified that the Department received the required provider roster reports; however, the tracking spreadsheet did not document the receipt, review, or approval of two of the four managed care plans (or 50 percent). This relates to Finding 2024-218 included in the fiscal year 2024 Single Audit Report. Corrective actions associated with the prior-year finding had not been implemented when the provider roster reports were received. Cause: Although the Department had established internal controls to document the receipt, review, and approval of the provider roster reports, the control was not consistently performed due to an oversight by the Division of Medicaid. Effect: In the absence of documented internal controls over the provider roster reports, an MCO could be enrolling and maintaining ineligible providers. As a result, the Medicaid and CHIP programs may be at an increased risk of making payments to ineligible providers. Recommendation: We recommend that the Department consistently implement internal controls over the MCO provider roster reports and properly document the receipt, review, and approval information. Management’s View: The agency agrees with this finding. Corrective Action: In 2025, the Department contracted with four (4) MCOs across six (6) contracts. Rosters were received and reviewed by staff but not noted in the contract monitoring tracker for the two (2) contracts. Moving forward higher levels of leadership (program managers and bureau chiefs) will be required to sign off to confirm that the review was noted in contract monitoring documentation. This will ensure that the provider roster and other reports are properly documented and reviewed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2025-219 The Department could not provide sufficient documentation to demonstrate compliance with provider eligibility requirements for managed care network providers. Related to Prior Finding: 2024-217 Type of Finding: Material Weakness, Material Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program; Children's Health Insurance Program AL Number: 93.777; 93.778; 93.767 Federal Award Number: 2405ID5000; 2405ID5CAA; 2405ID5MAP; 2405ID5ADM; 2505ID5MAP; 2505ID5ADM; 2405ID5021; 2505ID5021 Program Year: July 1, 2019 – June 30, 2025; May 1, 2021 – April 30, 2026; October 1, 2023 – September 30, 2025; October 1, 2024 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: Undetermined Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. To receive Medicaid or CHIP payments, providers must be licensed in accordance with applicable federal, state, and local laws and regulations; screened and enrolled in accordance with 42 CFR Part 455, Subpart E; comply with state plan and applicable disclosure requirements included in 42 CFR Part 455, Subpart B; and not be barred from participation by the Office of Inspector General's exclusion list. States must also follow guidance included in the Medicaid Provider Enrollment Compendium (MPEC) when enrolling providers. Medicaid and CHIP managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements applicable to fee-for-service providers pursuant to 42 CFR Part 438, Subpart H. Condition: The Department contracts with four MCOs to provide managed care services. During our testing of 62 managed care providers, 41 providers were selected from a single MCO’s provider network. The Department was unable to provide sufficient documentation to demonstrate compliance with provider eligibility requirements for providers associated with the specific MCO. The Department provided limited documentation for 20 of the 41 providers selected from the MCO's provider network. The documentation supported licensure and Office of Inspector General (OIG) exclusion screening for those providers; however, it did not demonstrate all information necessary to verify compliance with applicable provider screening and enrollment requirements. The Department did not provide documentation for the remaining 21 providers. The Department did not provide provider agreements for any of the 41 providers selected from the MCO's provider network. As a result, compliance with applicable State plan requirements could not be verified for these providers. Documentation supporting compliance with disclosure requirements was provided for only 4 of the 41 providers selected from the MCO's provider network. Overall, 41 of the 62 providers tested (or 66 percent) lacked sufficient documentation to demonstrate compliance with provider screening and enrollment requirements and applicable State plan requirements related to provider agreements; 37 of the 62 providers tested (or 60 percent) lacked sufficient documentation to demonstrate compliance with disclosure requirements; and 21 of the 62 providers tested (or 34 percent) lacked sufficient documentation to demonstrate compliance with OIG exclusion screening requirements. This relates to Finding 2024-217 included in the fiscal year 2024 Single Audit Report. Corrective actions associated with the prior-year finding had not been implemented. Cause: The Department did not have adequate oversight procedures to ensure it could obtain sufficient documentation from its contracted MCO to demonstrate compliance with provider eligibility requirements. Effect: We were unable to confirm the noted providers were in compliance with provider eligibility requirements because sufficient documentation was not available. As a result, the Medicaid and CHIP programs may be at an increased risk of making payments to ineligible providers. Recommendation: We recommend that the Department strengthen oversight of its contracted MCOs and implement procedures to ensure sufficient documentation is maintained and can be timely obtained to demonstrate compliance with provider eligibility requirements. Management’s View: The agency agrees with this finding. Corrective Action: The Department will work to enhance its oversight of the Managed Care Organizations (MCOs). Current contract requirements state ‘submit documentation requested by IDHW within three (3) business days for standard requests, and within ten (10) business days for requests that require significant preparation, or a mutually agreed upon date.’ One MCO, Molina, did not fulfill the data requests in a timely manner in accordance with their contract. The Department will impose all available liquidated damage remedies in the current contract for this delay from the MCO. This will be completed by December 31, 2026 Medicaid is in process of writing contract language that will be implemented in the next amendment cycle before the end of the fiscal year. The amended contract language will state that information related to audits will need to be supplied within one (1) business day for urgent, three (3) business days for expedited, and five (5) for average. The Department will work with the Division of Purchasing to determine if it is possible to amend the liquidated damage section to ensure that we can hold the MCO vendors accountable for providing information during such audits in the future. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Finding 2025-220 Payroll adjustments lacked sufficient internal controls. Related to Prior Finding: 2024-234 Type of Finding: Significant Deficiency AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare; Medical Assistance Program; Community Mental Health Services Block Grant AL Number: 93.777; 93.778; 93.958 Federal Award Number: 2405ID5000; 2405ID5CAA 2405ID5MAP; 2405ID5ADM; 2505ID5MAP; 2505ID5ADM; B09SM087355 Program Year: July 1, 2019 – June 30, 2025; May 1, 2021 – April 30, 2026; October 1, 2022 - September 30, 2024; October 1, 2023 – September 30, 2025; October 1, 2024 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Activities Allowed or Unallowed; Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: This issue relates to Finding 2024-234 included in the fiscal year 2024 Single Audit Report. When a payroll correction involving large volumes of data is required, the adjustment is prepared using an Infor Spreadsheet Designer (ISD) template. The ISD adjustments cannot be reviewed within Luma after entry; therefore, the Department implemented corrective actions requiring approval documentation to be retained outside of Luma. However, during our review of fiscal year 2025 payroll adjustments charged to major federal programs, the Department was unable to locate approval documentation for 17 of the 62 transactions tested (or 27 percent). Of the 17 exceptions identified, 16 related to the Medicaid program. Cause: Corrective action procedures were not consistently followed. While other programs retained e-mail approval documentation, approvals for Medicaid payroll adjustments were obtained through Microsoft Teams, and logs supporting those approvals were not retained. Effect: We did not identify any substantive or compliance errors during testing over payroll adjustments. However, without documentation of a review and approval, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department consistently maintain documentation of implemented review and approval procedures over payroll adjustments. Management’s View: The agency agrees with this finding. Corrective Action: Updated ISD interface training and procedure documents. The ISD interface protocol has been revised to specifically address the required approval process for corrections. Updated training educates Financial Specialists on the proper procedures and reinforces the requirement to obtain documented approval via email before any corrections are interfaced. The Training documents also stress the importance of attaching the documents to the system to maintain proper records of such approval. Refresher training was also provided for all analysts. Expected outcome: These actions establish consistent, documented approval control for ISD corrections, and ensure that email approval evidence is retained with each transaction. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2025-221 The Division did not complete required Federal Funding Accountability and Transparency Act (FFATA) reports for the Homeland Security Grant Program. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Homeland Security Grant Program Assistance Listing Number: 97.067 Federal Award Number: EMW-2024-SS-05016 Program Year: September 1, 2024 – August 31, 2027 Federal Agency: Department of Homeland Security Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that non-federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, reporting, and compliance with applicable laws and regulations. In addition, the FFATA, as codified in 2 CFR Part 170, requires that subawards of $30,000 or more be reported to the FFATA Subaward Reporting System (FSRS). All FFATA reports are due by the end of the month following the month the subawards are obligated. Condition: The FFATA was developed to provide better transparency over management of federal grants and contracts. The Division issued 29 subawards for the Homeland Security Grant Program, Assistance Listing (AL) 97.067, in fiscal year 2025 with anticipated expenditures in excess of $30,000 each that met the FFATA reporting requirements. The Division’s Idaho Office of Emergency Management utilizes an in-house tracker for subawards above $30,000, based on annual allocations to subrecipients. This in-house tracker includes information such as when the subawards are created and when the FFATA reporting is completed. Based on our review procedures, FFATA reports were submitted 3 to 6 months late for 23 out of 29 subawards reviewed, and report submissions were not completed for 6 subawards. In addition, the Division’s internal tracking spreadsheet was incomplete and contained duplicate entries. Cause: The Division’s current procedures do not accurately reflect the specific timeframes outlined in the compliance requirement. Employee turnover and system changes within the Division also contributed to a lack of full training on FFATA compliance requirements. Effect: The FFATA reports are required to be submitted to the Federal Subaward Reporting System (FSRS) no later than the end of the month following the month in which the subaward is issued. The FFATA reporting provides the public with a searchable database. Late reporting or non-reporting impacts the integrity of the federal transparency information. Additionally, ineffective internal controls increase the risk that errors or noncompliant reporting could occur and remain undetected. Recommendation: We recommend that the Division improve the design and implementation of internal controls procedures to ensure understanding of compliance requirements applicable to submitting accurate and timely FFATA reports. Management’s View: The agency agrees with the issue identified. Subawards of $30,000 or more are to be reported to the FFATA Subaward Reporting System (FSRS). All FFATA reports are due by the end of the month following the month the subawards are obligated. While IOEM utilizes a tracker for FFATA reporting, some reports were late or missing. Federal government shutdowns, the change in FFATA reporting portal (FSRS was retired on March 8, 2025, and all FFATA reporting must be submitted in SAM.GOV), staffing turnover and delayed grant reimbursements resulted FFATA reporting delays. Corrective Action: Resolution- The IOEM Finance Section (group responsible for FFATA reporting) is now fully staffed, and a Standard Operating Procedure / Instruction Guide has been developed to assist existing and new staff in adhering to FFATA reporting requirements in the new SAM.GOV interface. This will ensure consistency and thoroughness in FFATA reporting. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2025-222 The Division did not ensure Homeland Security Grant funds were obligated to subrecipients within the required 45 days of receipt of the award. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Homeland Security Grant Program Assistance Listing Number: 97.067 Federal Award Number: EMW-2021-SS-00082-S01; EMW-2022-00109-S01; EMW-2023-SS-00078-S01; EMW-2024-SS-05016 Program Year: September 1, 2021 – August 31, 2024; September 1, 2022 – August 31, 2025; September 1, 2023 – August 31, 2026; September 1, 2024 – August 31, 2027 Federal Agency: Department of Homeland Security Compliance Requirement: Special Tests Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that non-federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, reporting and compliance with applicable laws and regulations. In addition, the Uniform Guidance requires the State to obligate at least 80 percent of the program funds to local and tribal governments within 45 calendar days of receipt of the funds. Condition: The Division completes an internal allocation worksheet to determine the amount of program funds to distribute to subrecipients. The Homeland Security Grant includes three programs: State Homeland Security Program (SHSP), Urban Area Security Initiative (UASI), and Operation Stonegarden (OPSG). Then the Division creates a grant award notice (GAN) for each subrecipient and each program that includes specific federal program information for each AL and award amount. The GAN issuance to the subrecipients signifies the award obligation. We tested a sample of 21 of the 140 subaward agreements and found 2 deviations (9 percent) where the GAN was not issued within the required 45-days from receipt of award. One SHSP award notice was dated 53 days from receipt of award (8 days late). One OPSG award notice was dated 118 days from receipt of award (73 days late). Cause: The Division was not fully knowledgeable of the compliance requirement dictated by Uniform Guidance for the Homeland Security Grant. The Division instead followed the Notice of Funding Opportunity (NOFO) for guidelines of project goals, funding limits, evaluation criteria, and deadlines to secure funding. Further, the Division assumed certain guidelines did not apply to the OPSG because NOFO did not explicitly include references for this portion of the Homeland Security Grant. Effect: Two Home Security Grant award letters were not dated within the required 45 days of receipt of the award. Failure to obligate funds in a timely manner, or within 45 calendar days of receipt of the award, results in the Division being non-compliant with federal guidelines. Additionally, not making funds available in a timely manner prevents subrecipients from receiving program awards as soon as possible. Recommendation: We recommend that the Division improve the design and implementation of internal controls procedures to ensure compliance with 45-day obligation requirements. Management’s View: The agency partially agrees with the issue identified. Of those sampled, 2 subaward agreements were not issued within the 45-day requirement. IOEM does question whether the Operation Stone Garden Grant Program (OPSG) is subject to the 45-day requirement as Customs and Border Patrol approves the participating jurisdiction’s grant projects. Based on State Administration Agencies request for clarification, Idaho’s FY 25 HSGP Award Amendment states the following: “As required by 6 U.S.C. § 605(c) for SHSP and 6 U.S.C. § 604(d) for UASI, the recipient must make available to local and tribal governments not less than 80 percent of the SHSP and UASI funds awarded under this award, within 45 days. This requirement applies to SHSP and UASI funds only and does not apply to OPSG funds” (bolded for emphasis). The 2025 OMB Compliance Supplement Special Tests for HSGP indicate: “States… must obligate at least 80 percent of funds awarded to them under SHSP and UASI to local or Tribal governments within 45 calendar days of receipt of the funds.” It is of note that OPSG is not included in this Special Test. One of the two grant agreements issued over 45 days is associated with OPSG. Corrective Action: Resolution - IOEM’s Grants Branch Chief accepts grant awards on IOEM’s behalf. The Grants Branch Chief will notify the Finance Section Chief and the Grant Analysts via email the date the award is accepted, the date 45 days from award acceptance and a deadline within the 45 days subaward obligation documents are expected to be issued. The Grants Branch Chief will review subaward obligations to assure they are issued within 45 days of award acceptance. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. The Homeland Security Grant Program (HSGP) comprises three grant programs: State Homeland Security Program (SHSP), Urban Area Security Initiative (UASI), and Operation Stonegarden (OPSG). We would like to clarify that the 2025 OMB Compliance Supplement Special Test for HGSP specifically states the audit objective is “to determine if the state complied with the requirement to obligate 80 percent of the funds awarded under SHSP and UASI and 100 percent of the OPSG allocation passed through to local and tribal governments within 45 calendar days of receipt of the funds…”. The 45-day obligation requirement is required for all three grant programs in the HSGP federal award.

FINDING 2025-223 The Division did not complete sufficient subrecipient monitoring for the Homeland Security Grant during fiscal year 2025. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Homeland Security Grant Program Assistance Listing Number: 97.067 Federal Award Number: EMW-2021-SS-00082-S01; EMW-2022-00109-S01; EMW-2023-SS-00078-S01; EMW-2024-SS-05016 Program Year: September 1, 2021 – August 31, 2024; September 1, 2022 – August 31, 2025; September 1, 2023 – August 31, 2026; September 1, 2024 – August 31, 2027 Federal Agency: Department of Homeland Security Compliance Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) Uniform Administration Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR 200.303) states that non-federal entities must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Specific requirements for pass-through entities in 2 CFR 200.332(c) states that pass-through entities must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate level of subrecipient monitoring to be completed. Further requirements at 2 CFR 200.332(e) indicate the pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and condition of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: 1. Review financial and performance reports. 2. Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. 3. Issue a management decision for audit findings pertaining to the federal award. 4. Resolve audit findings specifically related to the subaward. Condition: The Division’s subrecipient monitoring procedures include desk reviews and site visits. The Division also completes a risk assessment for each subrecipient prior to issuing a subaward and annually thereafter. The frequency of site visits and desk reviews vary depending on the assessed risk level. The Division strives to complete a desk review or site visit for every subrecipient at least once every five years. Subrecipients assessed at higher risks receive a site visit or desk review more frequently. The Division uses a worksheet to track risk assessments & monitoring activities of the 65 subrecipients. Based on our review, the tracking worksheet indicated that 34 subrecipients should have had monitoring completed in fiscal year 2025. However, there were no site visits or desk reviews completed in fiscal year 2025. Further, the Division’s tracking worksheet indicates that there are 26 subrecipients that have not been monitored in over 5 years and another 5 subrecipients that have not been monitored in over 10 years. In addition, the Division did not have support documentation for 1 of 14 (7 percent) of the pre-award risk assessment completed. Cause: There were challenges with staff turnover, budget holdbacks, and changes to the grant management system that strained the resources available to complete the subrecipient monitoring. However, the Division has not implemented appropriate procedures to ensure monitoring is completed at a sufficient level to be compliant with federal program requirements. In addition, the Division’s procedures failed to provide the guidance or emphasis to ensure pre-award risk assessment forms are completed and retained for each subrecipient as part of the monitoring requirements. Effect: Monitoring of subrecipients is a critical requirement in accepting federal funds and ensuring that those funds are spent in compliance with allowable costs and other federal guidelines provided by the grantor. Lack of monitoring increases the risk that subrecipients may not comply with federal statues, regulations, and grant terms. Completing no reviews in a fiscal year creates a significant backlog and overdue burden on future fiscal years to sufficiently monitor all subrecipients within the 5-year period of time. Recommendation: We recommend that the Division implement appropriate procedures to ensure that site visits and desk reviews are completed based on the appropriate level of risk assessed for every subrecipient within the 5-year period of time. We further recommend that the Division implement controls to ensure that subrecipient pre-award risk assessments are completed and retained for each subrecipient award. Management’s View: The agency agrees with the issue identified. Limited formal monitoring occurred in FY 25. IOEM does have evidence of extensive subrecipient communication regarding project eligibility, allocability and allowability through email correspondence, grants management system records, meetings and discussions. IOEM monitoring activity was strained in FY 25 due to FEMA reimbursement delays, federal government shutdown (during which no reimbursements were made), staffing turnover, budget holdbacks and a new grants management system. MilDiv leadership implemented a ‘pause’ on activities incurring costs during the federal government shutdown and the Division of Financial Management issued the MilDiv a line of credit to continue paying staff during the time when FEMA was not processing reimbursements for grant expenditures. This impacted IOEM as well as county and Tribal emergency management programs. Corrective Action: Resolution- IOEM has codified a monitoring protocol, meeting agenda template, and is currently scheduling monitoring for subrecipients identified on the risk assessment tool in September and October 2026. IOEM leadership determined that from Memorial Day to Labor Day no monitoring will take place due to the demands on local emergency management programs during fire season. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2025-224 The Department overstated federal grant expenditures on the Schedule of Expenditures of Federal Awards (SEFA) closing package. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: American Rescue Plan Act - Coronavirus State and Local Fiscal Recovery Fund Assistance Listing Number: 21.027 Federal Award Number: 340ARPASLFRF23; 340ARPASLFRF24 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of the Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Additionally, 2 CFR 200.510 requires the State to prepare the SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Department overstated the federal grant expenditures for the Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) on the SEFA closing package. The total fiscal year 2025 expenditures reported for the CSLFRF were $30,784,715, which incorrectly included $2,761,004 of expenditures from fiscal year 2024. Cause: In fiscal year 2024, the State implemented a new statewide accounting system, Luma. The implementation of Luma caused many procedures to change from those used in the prior system. In March 2024, the Department contacted the Office of the State Treasurer (Treasurer) to make a wire transfer for a $2.5 million land purchase. The Department believed that the Treasurer would make an entry for the transfer or contact the Office of the State Controller (Controller) to make an entry for the transfer as would have occurred in the prior statewide accounting system; however, the entry was not made. The Department recognized that the land sale entry had not been recorded in Luma. Over the course of the next several months, the Department had multiple communications with the Treasurer and the Controller to determine the correct method of recording the transaction. The land purchase occurred in fiscal year 2024; however, the expenditure was not recorded in Luma until fiscal year 2025 and was improperly reported as an expenditure in fiscal year 2025 on its closing SEFA package. The Department staff indicated that they were unaware of a mechanism to retroactively report fiscal year 2024 expenditures. The other expenditures in the overstated amount were expenditure invoices entered into Luma in June 2024 that were not approved and released until July 2025. Effect: The Department originally reported fiscal year 2025 CSLFRF expenditures of $30,784,715. The original amount was overstated by $2,761,004. The correct amount that should have been reported was $28,023,711. This error was not corrected in the statewide SEFA. The $2,761,004 was incorrectly excluded from the fiscal year 2024 SEFA causing an understatement. Recommendation: We recommend that the Department design and implement procedures to accurately record, compile, and document the amounts reported in the SEFA closing package and to retain documentation supporting the amounts reported. Management’s View: The department agrees with the finding and asserts that it was a one-of-a-kind error in the timing of recording of one expenditure transaction. The error went undetected for a few months during the very confusing and difficult Luma transition year. When staff detected the error they believed the expenditure was still required to be reported on a SEFA and the only option available was to report it in FY 2025. Corrective Action: Staff have already completely familiarized themselves with the guidance on “New Requirement for Wire Payment Requests” issued by SCO on October 6, 2025. We are confident that our understanding of these new procedures will prevent any future occurrence. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2025-225 The Division could not provide supporting documentation for amounts reported on the Rehabilitation Services Administration (RSA) reports required under the Rehabilitation Services -Vocational Rehabilitation Grants to States. Related to Prior Finding: 2024-237 Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A230016, H126A240016, H126A250016 Program Year: October 1, 2022 - September 30, 2024, October 1, 2023 - September 30, 2025, October 1, 2024 - September 30, 2025 Federal Agency: Department of Education, Rehabilitation Services Administration Compliance Requirement: Reporting Questioned Costs: $9,342,357 Known Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR), 2 CFR 200.303, states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Section CFR 200.302 – Financial Management states that federal award recipient’s financial management system must identify all federal awards received and expended and the federal programs under which they were received. Additionally, they must maintain records that sufficiently identify the amount, source, and expenditure of federal funds for federal awards. These records must contain information necessary to identify federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: The RSA requires the Division to submit financial reports (RSA-17) every six months. The reports are cumulative and cover the entire grant period through the end of the reporting period. Reporting periods end on March 31 and September 30. If the reporting period is the final report for the grant, the report is due 120 days after the close of the period. All other reports are due 30 days after the close of the period. Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2025 grant period is October 1, 2024, through September 30, 2026. In State fiscal year 2025, there were 3 grants open – federal fiscal years 2023, 2024, and 2025. The Division was required to submit 4 reports for these grants. We compared the federal expenditure amounts reported for the grant in total and for the Pre-Employment Transition Services (Pre-ETS) to the amounts in Luma and found errors in all 4 as follows: Total Expenditures Grant Year Report Period End RSA-17Amount Luma Amount Difference Federal Fiscal Year 2023 9/30/24 $14,635,410 $7,465,827 $7,169,583 Federal Fiscal Year 2024 9/30/24 $9,570,662 $9,102,244 $468,418 Federal Fiscal Year 2024 3/31/25 $18,816,172 $17,716,799 $1,099,373 Federal Fiscal Year 2025 3/31/25 $16,803 $0 $16,803 TOTAL $8,754,177 Pre-ETS Grant Year Report Period End RSA-17 Amount Luma Amount Difference Federal Fiscal Year 2023 9/30/24 $3,738,844 $3,488,337 $250,507 Federal Fiscal Year 2024 9/30/24 $3,665,907 $3,617,414 $48,493 Federal Fiscal Year 2024 3/31/25 $4,131,587 $3,842,407 $289,180 Federal Fiscal Year 2025 3/31/25 $0 $0 $0 TOTAL $588,180 Cause: Reports were prepared by former employees, and the current personnel could not determine why the reported amounts did not match Luma. Further, supporting documentation was not retained by the Division, which might have provided insight into the differences. The Division stated that the amounts reported on the federal fiscal year 2023 grant for the period ended 9/30/24 were restated based on a forensic audit completed by a contractor and resubmitted to the RSA. The restated amounts are shown in the table above, but the Division could not provide documentation to support the restated amounts. Effect: The RSA uses the RSA-17 reports to determine compliance with federal statutes, regulations, and the terms and conditions of the federal award. Incorrect reporting can affect both the ability to cover current obligations and the amount of future federal grant awards received by the State of Idaho. Recommendation: We recommend that the Division design and implement procedures to ensure accurate federal grant reporting and retain appropriate documentation to support the amounts reported. We also recommend that the Division review prior submissions, identify correct reporting, and communicate with the federal grantor about resubmitting corrected reports. Management’s View: IDVR agrees that retention of supporting documentation aligned with the RSA-17 report submitted to RSA is necessary to ensure adequate documentation of the completed reports is created and maintained to support the submission. Corrective Action: IDVR has completed significant work to complete restatements of the RSA-17 for FFY2019-2024. These restatements have been accepted by the RSA Fiscal Unit and the reports were updated in RSAMIS by RSA after this process was completed in Spring 2026. With the restatement, RSA and IDVR have accepted the data based on an extensive third-party forensic review of IDVR’s financial records for these timeframes. IDVR is currently in the process of submitting the policy, procedures, and internal controls to RSA regarding the federal reporting of the RSA-17 required data elements. The fiscal staff have also worked extensively to ensure all future RSA-17 reports include supporting documentation that have been extracted from Luma and this process has been implemented as of February 2026. Once RSA approves the IDVR RSA-17 policy, procedures, and internal controls IDVR will adopt, train, and implement these documents as standard practice and will complete all future reports in accordance with the outlined controls and maintain the supporting documentation as outlined in the policy. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We will review those improvements that were in place during fiscal year 2026 during the completion of the 2026 Single Audit.

FINDING 2025-226 The Division did not comply with Matching, Level of Effort, and Earmarking requirements for the fiscal year 2023 grant of the Rehabilitation Services -Vocational Rehabilitation Grants to States. Related to Prior Finding: 2024-238 Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A230016; H126A240016; H126A250016 Program Year: October 1, 2022 - September 30, 2024; October 1, 2023 - September 30, 2025; October 1, 2024 - September 30, 2025 Federal Agency: Department of Education, Rehabilitation Services Administration Compliance Requirement: Matching, Level of Effort, Earmarking Questioned Costs: Matching $1,092,219 Known; Level of Effort $798,944 Known Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 34 CFR 361.60(a)(1) states that the federal share for expenditures made by the State under the vocational rehabilitation services portion of the Unified or Combined State Plan, including expenditures for the provision of vocational rehabilitation services and the administration of the vocational rehabilitation services portion of the Unified or Combined State Plan, is 78.7 percent. The State share for expenditures is 21.3 percent. Section 2 CFR 361.62, Maintenance of Effort requirements, states (a) General requirements. The Secretary (of Education) reduces the amount otherwise payable to a State for any fiscal year by the amount by which the total expenditures from non-Federal sources under the vocational rehabilitation services portion of the Unified or Combined State Plan for any previous fiscal year were less than the total of those expenditures for the fiscal year two years prior to that previous fiscal year. Condition: Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2025 grant period is October 1, 2024, through September 30, 2026. In State fiscal year 2025, there were 3 grants open – federal fiscal years 2023, 2024, and 2025. The federal fiscal year 2023 grant period was October 1, 2022, to September 30, 2024, and was the only grant period that concluded within State fiscal year 2025. We evaluated the Division’s compliance with the matching, level of effort, and earmarking requirements for the fiscal year 2023 grant. Matching The Division is required to provide at least 21.3 percent of total rehabilitation program spending from nonfederal sources as a match. We reviewed the amounts reported as federal and State expenditures on the Division’s final RSA-17 report for the federal fiscal year 2023 grant. The Division reported the federal share as $14,635,410 and the State matching expenditures as $4,066,054, which calculated as 21.7 percent of total program expenditures and met match requirements. We compared the amounts reported on the RSA-17 report to the expenditures in the former statewide accounting system (STARS) in State fiscal year 2023 and the current statewide accounting system (Luma) in State fiscal years 2024 and 2025. Federal expenditures were $16,174,862; and State expenditures were $3,285,476, which calculated as 16.9 percent of total program expenditures and did not meet match requirements. The Division could not provide documentation to support the amounts reported in the RSA-17 report. The expenditures we were able to verify were the amounts in STARS. To calculate questioned costs we divided the federal expenditures by the federal participation rate of 78.7 percent ($16,174,862 / 0.787 = $20,552,557) and then subtracted the federal expenditures to arrive at the required state participation amount to meet the 21.3% matching requirement ($20,552,557 - $16,174,862 = $4,377,695). We then subtracted the actual state expenditures to arrive at the questioned costs ($4,377,695 - $3,285,476 - $1,092,219). Level of Effort Maintenance of effort is one part of the level of effort grant requirements. The federal fiscal year 2023 grant period ended on September 30, 2024. It is the only grant that we could evaluate for level of effort compliance because it is the only one that ended within State fiscal year 2025, which is the period of our audit. The Division is required to spend at least the amount of State funds expended in the fiscal year two years prior. We compared State expenditures for the federal fiscal years 2021 and 2023 grants based on amounts reported on the RSA-17 reports. RSA-17 Report RSA-17 Report Federal Fiscal Year 2021 Grant Expenditures Federal Fiscal Year 2023 Grant Expenditures Difference $3,373,052 $4,066,054 $693,002 This analysis found that the Division met level of effort requirements because State spending for the federal fiscal year 2023 grant was $693,002 more than State spending for the federal fiscal year 2021 grant. We performed additional analysis on the amounts reported and compared them to the underlying information in Luma and STARS due to errors we identified in the RSA-17 reports, also described in Finding 2025-225. We found that the amounts reported for the federal fiscal years 2021 and 2023 grants did not match the amounts recorded in Luma or STARS, and the Division could not provide documentation to support the differences. We compared the State expenditures for federal fiscal years 2021 and 2023 grants based on the amounts recorded in Luma and STARS. Accounting System Accounting System Federal Fiscal Year 2021 Grant Expenditures (STARS) Federal Fiscal Year 2023 Grant Expenditures (Luma and STARS) Difference $4,084,420 $3,285,476 ($798,944) In our additional analyses, the Division failed to meet level of effort requirements. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. The staff in place during our single audit procedures were not the same as the staff who compiled the RSA-17 reports for the federal fiscal years 2021 or 2023 grants and could not locate any documentation to support the amounts reported or verify that the Division had internal controls in place to monitor the matching, level of effort, or earmarking requirements for compliance. Effect: We did not identify any errors with earmarking requirements; however, reporting errors, especially when corrected, could result in noncompliance in future fiscal years. The noncompliance with the matching and level of effort requirements could result in the RSA reducing the federal grant award to the Division for the federal fiscal year 2026 grant. Recommendation: We recommend that the Division design and implement procedures to ensure compliance with matching, level of effort, and earmarking requirements. Management’s View: The agency agrees with this finding.. It is closely related to the historical reporting issues identified through the forensic review and restatement process described above. Corrective Action: IDVR has completed significant work to increase internal controls through the development of policies, procedures, and internal controls included in IDVR’s Grants Management Manual. RSA has approved several of the policies, procedures, and internal controls as they relate to these processes to ensure adequate SLT level planning and decision making is occurring and documentation is available to support the grants Matching, Maintenance of Efforts, and obligation requirements. Further GMM chapters related to this finding will be re-submitted to RSA for approval with IDVR’s next CAP submission due 10/30/2026. Once policies are approved by RSA for implementation they will be finalized, trained, and implemented by IDVR. To strengthen compliance moving forward as these areas are assessed at the State level, IDVR and ICBVI have also increased the frequency of collaborative financial planning meetings from bi-monthly to monthly, with notes taken, as of September 2026 as these three elements are reported and assessed at the statewide level. In addition, the IDVR Strategic Leadership Team conducts at least monthly reviews of matching, MOE, and Pre-ETS spending to assess progress, identify potential risks, and implement timely corrective measures when necessary and maintains agendas of these meetings to assure record retention for these reviews and decision points as of August 2026. These monitoring activities will continue as implemented and are intended to ensure more proactive management of federal fiscal requirements and reduce the likelihood of future compliance concerns in these areas. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We will review those improvements that were in place during fiscal year 2026 during the completion of the 2026 Single Audit.

FINDING 2025-227 The Division does not have documented control procedures in place to ensure compliance with period of performance requirements for the Rehabilitation Services -Vocational Rehabilitation Grants to States. Related to Prior Finding: 2024-239 Type of Finding: Material Weakness Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A230016; H126A240016; H126A250016 Program Year: October 1, 2022 - September 30, 2024; October 1, 2023 - September 30, 2025; October 1, 2024 - September 30, 2025 Federal Agency: Department of Education, Rehabilitation Services Administration Compliance Requirement: Period of Performance Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2025 grant period is October 1, 2024, through September 30, 2026. In State fiscal year 2025, there were 3 grants open – federal fiscal years 2023, 2024, and 2025. The Division uses Aware, a case management system which documents clients’ Individual Plans for Employment (IPE). The IPEs have employment goals, planned services, estimated costs, client responsibilities, and criteria for evaluating progress. Expenditures are initially entered into Aware and uploaded into Luma for payment. The Division uses project codes in Aware to designate expenditures to specific grant periods. The project codes correlate to grant codes in Luma when transactions are uploaded from Aware. Grant codes are used to track expenditures and period of performance for each grant award. Client expenditures are entered into Aware, and regional managers review the entries for accuracy, including the correct project code for the period of performance. As grant periods begin and end, the project codes in Aware need to be changed to correlate to new grant codes in Luma. The Division stated that in past years, the changes to the project codes would be discussed among the fiscal staff and communicated to the regional managers, and the final changes were reviewed for accuracy and inclusion in the proper period. The Division made changes to the project codes but could not provide documentation to confirm these changes were reviewed and approved in fiscal year 2025. Further, the Division could not provide documentation of any additional procedures to evaluate period of performance at an overall program level that would detect errors in the coding of project codes or federal grant codes. Cause: The Division has experienced a large amount of turnover in fiscal staff positions, likely contributing to internal controls not being properly executed. Current staff was unable to locate documentation to verify controls were in place and operating. Effect: Regional managers review transaction entries to ensure they are for allowable costs and coded to the correct project codes to comply with period of performance requirements. This control procedure is ineffective if the project codes are not linked to the correct grant codes in Luma. Although we did not identify specific period of performance errors, the Division does not have any other control procedures in place to evaluate period of performance at an overall program level, which increases the risk of noncompliance. Recommendation: We recommend that the Division design and implement control procedures to ensure compliance with period of performance requirements and maintain documentation to demonstrate both that controls were operating as intended and compliance was achieved. Management’s View: The agency agrees with this finding. IDVR acknowledges that the controls during the audit period were insufficient to ensure expenditures were consistently allocated to the correct federal award period. Corrective Action: Since November 2025, IDVR has implemented a comprehensive period-of-performance review process designed to ensure compliance with federal grant requirements. As part of this process, the Strategic Leadership Team reviews and determines when obligations should transition between federal fiscal year awards. Based on this direction, IDVR Data Manager updates system configurations and budget parameters within the AWARE case management system to ensure expenditures are assigned to the correct federal award. In addition, IDVR implemented a testing process in which the Data Manager and Program Analyst verify that expenditures are coding appropriately following budget updates. IDVR has also incorporated period-of-performance reviews into its quality assurance and compliance review process for case service expenditures. Invoice batches are reviewed before liquidation, or reimbursement requests are submitted to ensure expenditures are allocated to the proper grant award. These reviews are conducted by Quality Assurance and Compliance Analysts, Financial Specialists, the Financial Officer, and, when appropriate, Agency leadership, including the Deputy Administrator and Administrator. Through these layered review processes, IDVR has established documented internal controls designed to ensure compliance with period-of-performance requirements and has successfully utilized these controls since implementation as evidenced by approved RSA reimbursements of expenditures based upon both period of performance and allowability reviews completed by RSA on all expenditures reimbursed as required under route payment that IDVR has been engaged in with RSA since October 2024. IDVR is in the process of obtaining approval from RSA within drafted Grant’s Management Chapters for the policies, procedures and internal controls related to assurances of proper grant assignment based upon period of performance. Once approval is provided, IDVR will finalize, implement, and train on the approved policies, procedures, and internal controls that align with processes already in practice as of November 2025. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We will review those improvements that were in place during fiscal year 2026 during the completion of the 2026 Single Audit.

FINDING 2025-228 The Division is not following Idaho Administrative Rules for Purchasing as required. Related to Prior Finding: 2024-240 Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A230016; H126A240016; H126A250016 Program Year: October 1, 2022 - September 30, 2024; October 1, 2023 - September 30, 2025; October 1, 2024 - September 30, 2025 Federal Agency: Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement, Suspension, and Debarment Questioned Costs: $51,400 Known; $442,200 Projected Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The CFR procurement standards at 2 CFR 200.317 states that, when procuring property and services under a federal award, a state must follow the same policies and procedures it uses for procurements from its nonfederal funds. The state of Idaho purchasing rules within the Idaho Administrative Procedures Act (IDAPA) contain the following provisions: IDAPA 38.05.01.32. Total Cost: The acquisition cost of property, including all components, options, and add-ons available under the contract, related services, and, in the case of ongoing services, the cost of the full term of the contract, including all authorized renewals. Unless a different total term is provided in the contract, the term used for purposes of total cost is five (5) years. IDAPA 38.05.01.041. Acquisition Procedures: • Small Purchases: Services with less than $25,000 total cost; software with less than $15,000 total cost; property with less than $15,000 total cost; a mix of property and services less than $15,000. o Small purchases do not require acquisition through competitive solicitation. Agencies must comply with the division’s small purchase policy. Property available under single agency or open contracts shall be purchased under such contracts and are not a small purchase under this rule unless otherwise authorized by the administrator. • Informal Purchases: Acquisition of property with a total cost exceeding the dollar limits established in this rule for a small purchase and less than the formal sealed procedure limit are informal purchases. o Informal Purchases may be made using:  An informal solicitation issued through e-procurement, unless exempted by the administrator; or  The formal sealed procedure, when the purchasing authority makes a written determination that using a formal solicitation is in the best interest of the state, including where selection based solely on cost is not appropriate. o Agencies procuring property under this rule shall maintain a purchasing file containing:  The solicitation document posted and quotes received. If the acquisition was not publicly posted, the agency shall include a statement describing the justification for determining that posting was impractical or impossible, along with the administrator’s authorization.  If not using e-procurement, the agency shall document the quotes received (or its attempt to obtain quotes) from at least three (3) vendors having a significant Idaho economic presence as defined in Section 67-2349, Idaho Code. • Formal Sealed Procedure: o The sealed procedure limit is one hundred fifty thousand dollars ($150,000). o Purchases of property in excess of the sealed procedure limit are made using the formal sealed procedure, unless exempted by these rules or the administrator. IDAPA 38.05.01.042.01. Exceptions Requiring Written Administrator approval. The administrator may exempt the following purchases from the requirement for competitive solicitation by issuing a written determination to the purchasing authority. • Rehabilitation Agency Acquisitions. Acquisitions of property that is provided by non-profit corporations and public agencies operating rehabilitation facilities serving the handicapped and disadvantaged and that is offered for sale at fair market price as determined by the administrator in accordance with these rules. The buyer must submit a written request to the administrator to purchase from a rehabilitation agency and a written approval from the administrator. The purchase must comply with the division’s policy for rehabilitation agency acquisitions. Condition: We identified a population of 50 vendors that were paid more than $25,000 in fiscal year 2025 by the Division. The total value of that population was $6,512,395. We identified one vendor that received total payments large enough to be considered individually significant based on materiality. We reviewed that vendor and selected a random sample of 5 vendors from the remaining 49 vendors in our population to arrive at a total testing group of 6 vendors. We evaluated internal controls to determine if they were in place and effective and also assessed if the Division was in compliance with procurement policies. The main internal control that the Division relies on to ensure compliance is that appropriate personnel review the procurement documents and approve the contract or purchase made prior to payment. Our testing found that the Division could not provide evidence that the review and approval occurred for 1 of the 5 (or 20 percent) of the randomly sampled vendors and could not provide documentation to show that State procurement policies were followed for that vendor. Cause: The Division misunderstood several critical purchasing requirements. It believed that an exemption for rehabilitation agencies applied to more vendors than just not-for-profit entities and public agencies. The Division also believed that the State purchasing policies did not apply to vendors with many small purchases that are individually below, but collectively exceed, the purchasing thresholds. This misunderstanding led to noncompliance with purchasing requirements. Effect: The State’s purchasing policies are designed to ensure that State and federal funds are expended efficiently to meet the goals of State and federal programs. By not following these policies, the Division could be overpaying for products and services and is not in compliance with federal grant requirements. Projected questioned costs were determined using the calculation: (Dollar Value of the Sampling Population/ Total Dollar Value of the Items Sampled) X Dollar Value of Questioned Costs Identified in Sample = ($4,936,396/ $573,792) X $51,400 = $442,200. Recommendation: We recommend that the Division design and implement procedures to ensure that State purchasing policies are followed. This should include training to ensure that staff understand what purchases require additional procedures. We further recommend that the Division design and implement procedures to ensure that appropriate documentation is retained to demonstrate compliance and internal controls were operating as intended. Management’s View: The agency agrees with this finding. IDVR acknowledges that procurement practices during the audit period did not fully align with state procurement requirements. Corrective Action: IDVR has worked directly with the Division of Purchasing to revise IDVR procurement-related Policy Directive and is currently finalizing updates to align Agency procedures with state procurement requirements. Additionally, IDVR has developed draft procurement policies, procedures, and internal controls designed to strengthen compliance with both state and federal requirements. These materials have been reviewed with the Vocational Rehabilitation Technical Assistance Center and are currently undergoing RSA review. While awaiting final approval, IDVR has already begun strengthening procurement oversight and monitoring practices. Upon completion of the review process, IDVR will conduct agency-wide training and formally implement the updated policies and procedures. Additionally, IDVR will be developing monitoring dashboards that will provide leadership with enhanced visibility into purchasing activity and spending thresholds to support ongoing compliance with procurement requirements. These efforts reflect IDVR's commitment to establishing sustainable procurement controls that not only address the finding but also enhance transparency and accountability in purchasing activities. IDVR has also developed contracts for CRP services for both the General and Pre-ETS programs that have been approved by RSA for implementation. The Division is currently working on rolling out new CRP contracts with anticipated start date of 02/01/2027 to assure compliance with contracts for procurements for these services that are anticipated to exceed the $150,000 each state fiscal year and would not be covered under the updated policy directive due to this anticipated annual spend based on historical spending analysis for these services. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We will review those improvements that were in place during fiscal year 2026 during the completion of the 2026 Single Audit.

FINDING 2025-229 The Division did not verify that vendors were not suspended or debarred prior to making federal grant payments. Related to Prior Finding: 2024-241 Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services - Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A230016; H126A240016; H126A250016 Program Year: October 1, 2022 - September 30, 2024; October 1, 2023 - September 30, 2025; October 1, 2024 - September 30, 2025 Federal Agency: Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement, Suspension, and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Nonfederal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Condition: We identified 50 vendors that the Division paid more than $25,000 in total expenditures in fiscal year 2025. The total value of that population was $6,512,395. We identified one vendor that received total payments large enough to be considered individually significant, based on materiality. We reviewed that vendor and selected a random sample of 5 vendors from the remaining 49 vendors in our population to arrive at a total testing group of 6 vendors. The Division relies on appropriate personnel reviewing the documents that support verification that the vendor is not suspended or disbarred and indicates approval by e-mail as its primary internal control to ensure compliance with federal regulations. Our testing found that the Division could not provide the documentation to show that the review and approval occurred for any of the 6 (100 percent) vendors tested. Cause: The Division did not have procedures in place to retain documentation showing the suspension and debarment reviews were completed, reviewed, and approved for new vendors. Further, the Division does not perform any subsequent checks to ensure that vendors did not become suspended or debarred after they were initially added to the current statewide accounting system (Luma) or prior statewide accounting system (STARS), which increases the risk that payments could be made to a suspended or disbarred vendor. Effect: We reviewed all vendors selected as part of our testing and verified that none of them were on the SAM list as suspended or debarred. However, the Division does not have adequate controls in place to ensure that they are not entering into covered transactions with suspended or debarred vendors. Vendors can be suspended or debarred for many reasons including financial crimes such as fraud, embezzlement, or bribery, and other issues such as consistent poor performance on previous contracts or violations of laws. Taking steps to ensure vendors are not suspended or debarred is important to prevent fraud, waste, and abuse. Recommendation: We recommend that the Division develop and implement procedures to ensure that they are regularly reviewing vendors with whom it is contracted to ensure compliance with suspension and debarment requirements. Management’s View: The agency agrees with this finding. IDVR acknowledges that it did not maintain documented processes to verify suspension and debarment status before certain federally funded transactions during the audit period. Corrective Action: IDVR implemented additional agency-level procedures in Spring 2026 to strengthen compliance with federal suspension and debarment requirements. Under the enhanced process, the Financial Team conducts and documents quarterly reviews of vendors whose cumulative payments may meet or exceed applicable federal thresholds during that quarter to ensure at least annual review of vendors paid with federal funds for potential suspension or debarment since the last review. Additionally, IDVR’s Contract Specialist performs suspension and debarment verification reviews prior to execution of contracts expected to exceed federal threshold requirements. IDVR has also developed procurement and suspension/debarment policies that are currently under RSA review. Once approved, those policies will be finalized, adopted, and incorporated into Agency training. Importantly, the core review processes outlined in those policies have already been implemented, and the forthcoming policy adoption will formalize and document practices that are presently being utilized. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We will review those improvements that were in place during fiscal year 2026 during the completion of the 2026 Single Audit.