Audit 415211

State Agency: Illinois Governor’s Office of Management and Budget (GOMB) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Labor (DOL), U.S. Department of Transportation (DOT), U.S. Department of Education (USDE), U.S. Department of Health and Human Services (USDHHS), U.S. Department of Homeland Security (USDHS), Program Name: Special Supplemental Nutrition Program for Women, Infants and Children, Child and Adult Care Food Program, WIOA Cluster, Highway Planning and Construction (Federal-Aid Highway Program), Title I Grants to Local Educational Agencies, Special Education Cluster, Twenty-First Century Community Learning Centers, Supporting Effective Instruction State Grants, COVID-19 – Education Stabilization Fund, Aging Cluster, COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases, Temporary Assistance for Needy Families, Child Support Services, Low-Income Home Energy Assistance Program, Child Care and Development Fund Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse, Disaster Grants – Public Assistance (Presidentially Declared Disasters), Homeland Security Grant Program ALN and Program Expenditures: 10.557 ($211,116,030), 10.558 ($173,768,929), 17.258/17.259/17.278 ($146,186,461), 20.205 ($2,484,312,831), 84.010A ($841,918,401), 84.027/84.173 ($635,413,724), 84.287C ($44,018,938), 84.367A ($83,612,375), 84.425C/D/U/V/W ($968,653,091), 93.044/93.045/93.053 ($67,630,897), 93.323 ($73,439,961), 93.558 ($593,881,225), 93.563 ($146,728,300)93.568 ($215,662,419), 93.575/93.596 ($424,695,722), 93.667 ($53,464,167), 93.959 ($102,558,387), 97.036 ($317,860,132), 97.067 ($80,821,527) Finding 2025-003: Inadequate Monitoring of Subrecipient Single Audit Reviews Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Condition Found: The State of Illinois did not establish adequate controls to monitor the completion and documentation of the review of single audit reports for its subrecipients of the Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Child and Adult Care Food Program (CACFP), WIOA Cluster, Highway Planning and Construction (Federal-Aid Highway Program) (Highway Planning), Title I Grants to Local Education Agencies (Title I), Special Education Cluster, Twenty-First Century Community Learning Centers (21st Century), Supporting Effective Instruction State Grants (SEISG), COVID-19 Education Stabilization Funds (ESF), Aging Cluster (Aging), COVID-19 Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), Temporary Assistance for Needy Families (TANF), Child Support Services (CSS), Low-Income Home Energy AssistanceProgram (LIHEAP), Child Care and Development Fund Cluster (CCDF Cluster), Social Services Block Grant (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Public Assistance) and Homeland Security Grant Program (Homeland Security) programs in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS). The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of GATA on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in Federal awards during the fiscal year and, if required, submit their single audit reporting packages to the Federal Audit Clearinghouse (FAC). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, assigning, any findings attributable to amounts passed through to the subrecipient(s) by the State to the applicable state agency, and working with program personnel to issue management decisions on findings. The State utilizes a contractor to perform the centralized functions of obtaining the single audit report, verifying the report meets the requirements, and assigning findings to the applicable State agency. During our testing of subrecipient single audit desk review files for our 2025 major programs, we noted instances where single audit desk reviews were still in process and had not been finalized within GATA ARRMS as of the date of our testing (April 30, 2026). Upon further review of data contained within GATA ARRMS, we identified 750 single audit reviews were identified as incomplete in GATA ARRMS for grantees who: (1) reported expenditures under fiscal year 2025 major programs, (2) had an audit report with a FAC acceptance date between January 2, 2024 and January 2, 2025 (requiring the report to be reviewed during fiscal year 2025) and (3) were not sanctioned (placed on the Illinois Stop Payment List) by the State for noncompliance with reporting requirements. These 750 reviews were in varying stages of completion with the majority (651 audits) pending documentation supporting the issuance of a final completion letter by the cognizant agency. The remaining 99 audits (13.2%) were pending receipt of documentation, pending a review, or had another error requiring follow-up. These 750 audits included 337 audits (44.9%) with one or more findings potentially requiring a management decision to be issued. We noted the cognizant agencies for the 750 incomplete single audit reviews in GATA ARRMS were as follows: "See full report for chart/table." The 750 incomplete single audit reviews in GATA ARRMS pertained to subrecipients of the following major programs: "See full report for chart/table." While in many instances there was evidence the State agencies had completed the necessary procedures outside of GATA ARRMS, the primary purpose of GATA ARRMS is to reduce the duplication of effort across State agencies and to provide a single submission point for the State’s subrecipients. The lack of monitoring controls around this centralized process may result in noncompliance with subrecipient single audit desk review requirements. The State’s subrecipient expenditures under the federal programs for the year ended June 30, 2025 were as follows: "See full report for chart/table." Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure the Federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. Further, 2 CFR 200.332(e)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on audit findings within six months of acceptance of the audit report by the FAC and ensure that the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include implementing procedures to monitor whether single audit reports are reviewed, management decision letters are issued, and single audit desk review files are closed out in GATA ARRMS in a timely manner. Cause: In discussing these conditions with GOMB officials, they stated that while GATU established the ARRMS platform, individual State agencies did not consistently prioritize documenting and finalizing their subrecipient audit reviews within the centralized system. GOMB officials further indicated that prior year corrective action plans have not fully resolved this issue due to resource constraints allowing backlogs from previous audit periods to carry forward. Possible Asserted Effect: Failure to complete and document reviews of subrecipient single audit reports in GATA ARRMS in a timely manner may result in noncompliance with the State’s obligation as a pass-through entity to appropriately monitor its subrecipients. This lack of centralized tracking prevents the State from ensuring that corrective action plans are implemented timely, which could lead to undetected subrecipient noncompliance and unallowable Federal expenditures. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-002. (Finding Code 2025-003, 2024-002, 2023-002). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend GOMB establish and enforce rigorous monitoring procedures to ensure that all State agencies timely complete and document subrecipient single audit reviews within GATA ARRMS. Specifically, GOMB should: • Establish mandatory, time-bound milestones for cognizant agencies to finalize desk reviews and issue management decisions within the six-month federal window. • Implement a monthly reconciliation and exception-reporting process to identify and escalate delinquent reviews to agency leadership. • Provide targeted training and administrative support to cognizant agencies to eliminate the historical backlog of unfinalized files. Views of GOMB Officials: GOMB agrees with the finding. GOMB implemented a monthly summary of outstanding reviews as of June 2025, met with agencies who had high volumes of outstanding reviews and worked with them to develop plans to reduce the backlog. GOMB has provided training on Chief Accounting Officer calls to ensure agency staff have the knowledge to complete the reviews.

State Agency: Illinois State Board of Education (ISBE) Federal Agency: U.S. Department of Education (USDE) Program Name: Twenty-First Century Community Learning Centers, Student Support and Academic Enrichment ALN and Program Expenditures: 84.287 ($44,018,938), 84.424 ($94,706,515) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2025-004: Failure to Calculate Cash Requests in Accordance with the Treasury Regulations Condition Found: ISBE did not calculate cash requests for the Twenty-First Century Community Learning Centers (21st Century) and Student Support and Academic Enrichment (SSAE) programs in accordance with the requirements of 31 CFR part 205 (Treasury Regulations). The State is required to request federal funding from the U.S. Treasury for the 21st Century and SSAE programs based upon its immediate cash needs which is generally understood to require federal funding to be disbursed within three business days of receipt. During our testing of cash requests performed by ISBE during the year ended June 30, 2025, we noted ISBE did not perform its cash requests in accordance with Treasury Regulations. Specifically, in January 2025, ISBE requested $29,029,722 and $101,819,263 for the 21st Century and SSAE programs, respectively. These requests represented the entire remaining amount of available grant funding and did not reflect the immediate cash needs of the programs at the time the requests were made. Consequently, ISBE held significant excess federal cash balances in its accounts for most of the remainder of the fiscal year. Total expenditures for the fiscal year ended June 30, 2025 were $44,018,938 and $94,706,515 for the 21st Centuryand SSAE programs, respectively. Criteria or Requirement: According to 31 CFR 205.33(a), a State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure that Federal cash requests are prepared in accordance with Treasury Regulations. Cause: In discussing these conditions with ISBE officials, they stated the remaining federal funding was drawn down in January 2025 as a preemptive measure due to concerns that federal funding would be frozen. Possible Asserted Effect: Failure to draw funds in accordance with Treasury Regulations results in noncompliance with federal cash management standards and may result in an interest liability owed to the U.S. Treasury under the Cash Management Improvement Act (CMIA). Additionally, maintaining excessive federal cash balances increases the risk of federal sanctions or restrictive funding conditions. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-004) Recommendation: We recommend ISBE adhere strictly to federal cash management regulations and the State’s CMIA agreement, regardless of external concerns surrounding federal funding status. Views of ISBE Officials: Management accepts the recommendation. Management agrees that maintaining strong internal controls over the administration of federal grants is essential to ensuring compliance with grant requirements. In this instance, the federal government implemented actions under Memorandum M-25-13 that were not anticipated and created circumstances outside of ISBE’s control. Because no alternative approach was provided to address the resulting gap between those federal actions and the original grant terms, management acted quickly in an effort to continue meeting its responsibility to support and protect the State’s educational system. Following Memorandum M-25-14, ISBE proactively attempted to return funds drawn for 21st Century and SSAE. While ISBE did manage to return a portion of the funds for 21st Century and SSAE, it was unsuccessful in its attempt to return the full balances. As a result, ISBE applied the remaining balances to allowable program expenses during the fiscal year.

State Agency: Illinois State Board of Education (ISBE) Federal Agency: U.S. Department of Education (USDE) Program Name: COVID-19 – Education Stabilization Fund ALN and Program Expenditures: 84.425 ($968,653,091) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-005: Untimely Review of Subrecipient Performance Reports Condition Found: ISBE did not review subrecipient performance reports in a timely manner according to its program monitoring policies and procedures for subrecipients of the Education and Stabilization Fund - Elementary and Secondary Education (ESF) program for fiscal year 2025. The ESF program operates to provide State educational agencies and local educational agencies with emergency relief funds to address the impact that COVID-19 has had, and continues to have, on elementary and secondary schools across the nation. To monitor the ESF program activities performed by Illinois elementary and secondary schools, ISBE requires a performance report to be prepared on a periodic basis. The performance report includes information on the accomplishment of deliverables described in the grant, the status of performance measures, and the alignment of accomplishments with spending to date. ISBE’s monitoring policies and procedures require these reports to be reviewed within 14 days of receipt to ensure program activities and program results are consistent with program requirements. During our testing of ESF program performance reports submitted by 41 subrecipients with expenditures of $259,803,250 during the year ended June 30, 2025, we noted performance reports submitted by 2 subrecipients (with expenditures of $13,386,472) were not reviewed by program personnel within 14 days of receipt in accordance with ISBE’s policies. Delayed review of the reports were 19 and 55 days past ISBE’s required timeframe. ISBE passed through approximately $937,971,746 to 735 subrecipients of the ESF program during the year ended June 30, 2025. Criteria or Requirement: 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring program procedures and reviews are performed in a timely manner. Cause: In discussing these conditions with ISBE officials, they stated the delays in performing these reviews are attributable to the limited capacity of ISBE monitoring personnel as the responsibilities of existing program monitoring staff were expanded to accommodate the additional programs. Furthermore, management indicated that prior year corrective action plans have not fully resolved this issue because ESF program ended September 30, 2025 and additional staff were trained to support multiple programs. Possible Asserted Effect: Failure to timely review subrecipient semi-annual performance reports may result in untimely identification of subrecipients not properly administering federal program requirements in accordance with laws, regulations, and the grant agreement. This increases the risk that unallowable costs may be incurred which could result in questioned costs and federal disallowances. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-026. (Finding Code 2025-005, 2024-026, 2023-046). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ISBE evaluate its resource allocation and programmatic workflows to address the capacity constraints of its monitoring personnel. ISBE should implement strategies to ensure proper review procedures are performed in a timely manner in accordance with its program monitoring policies and procedures. Views of ISBE Officials: We agree with the finding. To ensure proper review procedures are performed in a timely manner in accordance with its program monitoring policies and procedures, the Fiscal department continues sending weekly lists of submitted, past due and disapproved Grant Periodic Reports (GPRS) to each applicable department. Program areas worked with Information Technology Department and enhanced the report to provide a daily detailed GPRS report beginning December 22, 2025. This report allows management staff to review and ensure that reports are not overlooked. Program analyzes the GPRS reports and prioritizes reviews based on submission dates.

State Agency: Illinois Environmental Protection Agency (IEPA) Federal Agency: U.S. Environmental Protection Agency (USEPA) Program Name: Clean Water State Revolving Fund, Drinking Water State Revolving Fund ALN and Program Expenditures: 66.458 ($98,866,713), 66.468 ($119,453,692) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: None Finding 2025-006 Inaccurate Reporting of Federal Expenditures Condition Found: IEPA did not accurately report Federal expenditures, including amounts passed-through to subrecipients, under the Clean Water State Revolving Fund (CWSRF) and Drinking Water State Revolving Fund (DWSRF) programs. Federal expenditures, including amounts provided to subrecipients, reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA), did not agree to IEPA’s financial records provided for audit. Specifically, we noted the following differences between amounts provided for audit by IEPA and the amounts passed through to subrecipients of the CWSRF and DWSRF programs reported to the IOC for the SEFA for the year ended June 30, 2025. "See full report for chart/table." Finally, we noted IEPA’s controls over reporting federal expenditures, including amounts passed-through to subrecipients, were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statements which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures, including amounts passed-through to subrecipients, are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with IEPA management, they stated the differences between IEPA records of federal expenditures and amounts passed through to subrecipients compared to the State’s SEFA were due to inclusion of accrued expenditures and some vouchers in transit at the end of the fiscal year. Possible Asserted Effect: Failure to accurately report federal expenditures impedes the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding code 2025-006) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IEPA establish procedures to accurately report federal expenditures (including subrecipient expenditures) used to prepare the SEFA to the IOC. Views of IEPA Officials: IEPA accepts the recommendation. IEPA will establish additional procedures to ensure federal expenditures (including subrecipient expenditures) are accurately reported.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs (AIP) ALN and Program Expenditures: 20.106 ($77,848,146) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2025-007 Failure to Report Subaward Information Required by FFATA Condition Found: IDOT failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs (AIP) program. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Unique Entity Identifier (UEI) 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that IDOT did not prepare or submit FFATA reports as required by federal regulations for any subawards made for the AIP program for the period July 1, 2024 through June 30, 2025. Additionally, we noted IDOT did not establish adequate internal controls over FFATA reporting to ensure all subawards were reported as required. IDOT passed through approximately $77,311,670 to subrecipients of the Airport Improvement Program during the year ended June 30, 2025. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Regulation (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Prime recipients must report subaward information by the end of the month following the month in which the subaward was made. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDOT officials, IDOT stated missing FFATA reporting was due to staffing transition combined with a lack of appropriate staffing resources. Furthermore, management indicated that prior year corrective action plans have not fully resolved this issue because staff had to be trained on a new system and had to catch up on over a year of reporting. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subaward in accordance with FFATA results in noncompliance with federal requirements. This lack of reporting diminishes the transparency of federal spending, preventing the public, federal oversight agencies, and Congress from tracking how federal grant funds are being distributed and utilized at the subrecipient level. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-039. (Finding Code 2025-007, 2024-039, 2023-043, 2022-029, 2021-036). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOT establish and formalize procedures to identify awards subject to FFATA reporting requirements and ensure the required subaward information is reported accurately and timely. Given challenges with staff turnover, IDOT should implement cross-training and establish monitoring controls to ensure reporting obligations continue without interruption during personnel or other transitions. Views of IDOT Officials: We agree with the finding. IDOT lost staff responsible for reporting in March 2025 and was unable to complete reporting until August 2025 due to competing priorities. Since IDOT needed to catch up on reporting and there was a change in the reporting system, the reporting for State fiscal year 2025 was not timely completed. Reporting will be completed timely on a going forward basis.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: Highway Planning and Construction (Federal-Aid Highway Program) ALN and Program Expenditures: 20.205 ($2,484,312,831) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-008 Inadequate Review of Subrecipient Single Audit Reports Condition Found: IDOT did not adequately review single audit reports received from its subrecipients for the Highway Planning and Construction (Federal-Aid Highway Program) (Highway Planning) program on a timely basis. The State of Illinois established the Grant Accountability and Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal and State programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $1,000,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning, to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State. As a State agency, IDOT is responsible for reviewing the reports assigned to them by GATU and determining whether Federal funds reported in the consolidated year-end financial report (CYEFR) reconcile to IDOT records. Additionally, as the cognizant State agency, IDOT is responsible for issuing management decisions on findings reported and applying sanctions to subrecipients who do not comply with reporting requirements (i.e. stop pay process). During our testing of a sample of single audit desk review files for 24 subrecipients (with expenditures of $57,137,691 in the fiscal year), we noted the following: • For five subrecipients (with expenditures totaling $1,034,141), IDOT did not issue a management decision letter within required timeframes. The delays in issuing management decision letters ranged from one to 30 days beyond the required timeframe. • For four subrecipients (with expenditures of $1,348,055), the subrecipient single audit reporting package was not submitted by the subrecipients within the required timeframe. The delays in the submission of the subrecipient reporting packages for these subrecipients ranged from 19 to 81 days after the required timeframe, and IDOT did not follow-up with the subrecipient or invoke the stop pay process. IDOT has not established controls over subrecipient single audit desk reviews at an adequate level of precision to ensure single audit reporting requirements, including obtaining and reviewing single audit reporting packages, issuing management decision letters, and invoking stop payment actions, are performed within required timeframes. IDOT passed through $134,639,907 to subrecipients of the Highway Planning program during the year ended June 30, 2025. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statues, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(e)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure Single Audit reports are obtained and reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with IDOT officials, they stated delays in following up on late single audits and untimely issuance of management decisions was the result of human error. Additionally, IDOT has not been using the State’s Grantee Compliance Enforcement System (Stop-Pay), which has limited the effectiveness of enforcement activities for late subrecipient single audit reports. Possible Asserted Effect: Failure to obtain, complete, and document reviews of subrecipient single audit reports in a timely manner may result in federal funds being expended for unallowable purposes and subrecipients not administering the federal programs in accordance with laws, regulations, and the grant agreement. Additionally, failure to issue management decisions within six months of acceptance of the single audit report by the FAC results in noncompliance with federal regulations. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-008) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOT establish procedures to ensure subrecipient single audit report reviews are completed and documented in a timely manner. Additionally, IDOT should implement procedures to ensure timely issuance of management decision letters and initiation of the stop pay process. Views of IDOT Officials: IDOT agrees with the finding and recommendation. The Audit Compliance Unit recently changed the process of issuing Provisional Federal Compliance Letters. A report is still being run each week, to determine which Grantees may need a Provisional Federal Compliance Letter, but instead of just issuing letters that are due within the week, the letters are issued for the entire month. The implementation date was July 27, 2026. IDOT staff are reviewing and planning to resume the stop pay notification process. The estimated implementation date is December 31, 2026.

State Agency: Illinois Department of Transportation (IDOT) Federal Agency: U.S. Department of Transportation Program Name: Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs (AIP) ALN and Program Expenditures: 20.106 ($77,848,146) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Special Test and Provision – Wage Rate Requirement Finding 2025-009 Failure to Follow Established Control Procedures for Approving Certified Payrolls for the Airport Improvement Program Condition Found: IDOT did not document approval of certified payrolls in accordance with its established internal control procedures for the Airport Improvement Program (AIP) program. Non-federal entities are required to comply with the requirements of the Davis-Bacon Act and the Department of Labor regulations applicable to contracts governing federally financed and assisted construction. These regulations require, in part, that all laborers and mechanics employed by contractors or subcontractors who work on construction contracts in excess of $2,000 financed by Federal assistance funds must be paid prevailing wage rates established for the locality of the project. Each subcontractor subject to the Wage Rate Requirement (formally known as the Davis-Bacon Act) must submit payrolls on a weekly basis and include a signed certification that they have complied with the prevailing wage rates. The resident engineer on the construction site is required to keep a log of contractors and monitor payroll submission. These logs are reviewed by the resident engineer, which indicates that the certified payrolls for that period have been received and meet IDOT’s program requirements. During our testing of 25 AIP contractor payments for construction projects managed by subrecipients (totaling $18,173,050), we noted that the certified payrolls for one AIP contractor payments on construction projects managed by subrecipients (totaling $5,097,334) did not contain documentation of approval by an IDOT resident engineer. Payments made to subrecipients for construction contracts under the Airport Improvement Program were $40,964,477 during the year ended June 30, 2025. Total payments made to subrecipients under the Airport Improvement Program were $77,311,669 during the year ended June 30, 2025. Criteria or Requirement: 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures in place to ensure certified payrolls are reviewed with proper documentation of resident engineer approval. Cause: In discussing these conditions with IDOT officials, they noted inconsistent approval documentation requirements for contracted resident engineers resulted in the exception noted. Furthermore, management indicated that prior year corrective action plans have not fully resolved this issue because the implementation date of IDOT’s correction action was planned for a future period. Possible Asserted Effect: Failure to approve certified payrolls in line with IDOT’s established control procedures could result in contractors not paying the prevailing wage rate to employees. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-038. (Finding Code 2025-009, 2024-038) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOT review its current process and consider any changes necessary to ensure weekly payroll certifications are reviewed and approved in accordance with federal requirements and IDOT’s procedures. Views of IDOT Officials: The Division of Aeronautics of the Office of Intermodal Project Implementation agrees with the finding. Division of Aeronautics, Bureau of Airport Engineering Construction Section Staff have been previously instructed to verify that certified payroll documentation submitted includes signature of approval from the airports contracted resident engineer. As such, staff should be already conducting this corrective action from June 30, 2026 based on a previous audit finding and implementation of its corrective action. Tentative corrective action and date not applicable. Applicable staff will be reminded of the following direction by September 21, 2026.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,467,054,918) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $2,687,867 Compliance Requirement: Eligibility Finding 2025-010: Unemployment Benefit Payments to Ineligible Claimants Condition Found: IDES failed to follow established policies when making eligibility determinations for claimants of the Unemployment Insurance (UI) program. The UI program administered by IDES provides benefits to eligible individuals that are unemployed and able and available to work. IDES utilizes the Illinois Benefits Information System (IBIS) to perform and document claimant eligibility determinations, to process claims for unemployment insurance benefits, and to assist IDES in complying with the requirements of the Illinois UI Act, rules, policies, and procedures applicable to unemployment benefits. UI program eligibility requirements include, among other criteria, the following: • The individual is unemployed through no fault of their own • The individual must register with IDES employment service system IllinoisJobLink.com • The individual has been paid $1,600 or more in wages during a recent 12-month period • The individual has earned at least $400 outside of the base period quarter in which his/her earnings were the highest • The individual must be actively seeking employment and be available to work • The individual must not refuse an offer of suitable work To be eligible to receive UI benefits, a claimant completes an application either online, in-person, or over the phone. Claimant applications are processed by the IBIS system which includes a number of edit checks which must be passed in order for a claimant to be eligible to receive UI benefits. However, these edit checks can be bypassed by staff when reviewing claimant applications. As a result, certain ineligible claimants were identified during our assessment of eligibility. Specifically, we noted the following exceptions: • 261 claimants were inappropriately determined to be eligible for UI benefits when the individuals should have been flagged as ineligible as the claimants were terminated from previous employment with cause, which is a disqualifying requirement. UI benefits paid to this group of claimants were $1,994,038. • 88 claimants were inappropriately determined to be eligible for UI benefits when the individuals should have been flagged as ineligible as the claimants voluntarily left work without cause, which is a disqualifying requirement. UI benefits paid to this group of claimants were $496,240. • 37 claimants were inappropriately determined to be eligible for UI benefits when the individuals should have been flagged as ineligible as the claimants were offered suitable work, but refused employment, which is a disqualifying requirement. UI benefits paid to this group of claimants were $197,589. Additionally, we noted adequate internal controls have not been established to ensure necessary changes resulting from the conclusion of pandemic related provisions are made to UI eligibility procedures in a timely manner. Benefits paid to UI claimants totaled $2,271,413,000 during the year ended June 30, 2025. Criteria or Requirement: According to the State of Illinois Unemployment Insurance Law Handbook, an individual who is discharged for misconduct with his work is ineligible for benefits for the week in which he was discharged for misconduct and thereafter until the individual has become re-employed and has had earnings equal to or in excess of their weekly benefit amount in each of four calendar weeks. Further, an individual will be ineligible for benefits if the individual has failed, without good cause, to accept suitable work when offered by the Department of Employment Security or an employing unit (i.e. business). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure eligibility determinations are made in accordance with the UI Act. Cause: In discussing these conditions with IDES officials, they stated ineligible claimants that were identified in this assessment were the result of staff error and ongoing staff limitations. Possible Asserted Effect: Failure to follow established policies to determine beneficiary eligibility may result in noncompliance with program regulations and payments to ineligible recipients. Repeat Finding: A similar finding was reported in the prior year as finding number 2024-030. (Finding Code 2025-010, 2024-030, 2023-038) Recommendation: We recommend IDES review its current procedures to ensure eligibility determinations are made in accordance with internal policy and federal regulations. Additionally, IDES should perform a comprehensive review of its UI eligibility process to ensure systems edits are functioning as expected. Views of IDES Officials: IDES accepts the recommendation to review its current procedures to ensure eligibility determinations are made in accordance with internal policy and federal regulations. IDES monitors several IBIS performance reports, including health checks as well as a daily report for management to review staff activity related to eligibility. Reports for management’s review serve as a basis to identity additional training needs for staff.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,467,054,918) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2025-011: Inadequate Process for Preparing ETA 9130 Financial Reports Condition Found: IDES does not have an adequate process in place to ensure that the ETA 9130 financial reports prepared for the Unemployment Insurance (UI) program are complete and accurate. On a quarterly basis, IDES is required to report program and administrative expenditure information for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects, on the ETA 9130, Financial Status Report, UI Programs. Financial data is required to be reported cumulative from grant inception through the end of each reporting period. During our test work of 25 ETA 9130 reports, we noted certain grant awards had inaccurate amounts reported for key line items for the September 30, 2024, reporting quarter. Specifically, we noted IDES inaccurately reported the following line items: "See full report for chart/table." We also noted IDES does not perform analytical or other procedures over previously reported information or expectations relative to current program activities. Additionally, supervisory review procedures are not designed to operate at a level of precision to identify errors of this nature. Criteria or Requirement: According to OMB Number 1205-0461, IDES is responsible for submitting a quarterly ETA 9130 report at the completion of each quarter. Each quarter should correspond to the following calendar quarter dates: March 31, June 30, September 30, and December 31. Additionally, the primary contact person, the designated authorized official in the recipient’s organization, is responsible for certifying the accuracy of the data reported to the USDOL. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal control should include procedures to ensure the completeness and accuracy of information reported in required financial reports. Cause: In discussing these conditions with IDES officials, they stated these conditions arose due to competing priorities with limited resources. Furthermore, management indicated that prior year corrective action plans have not fully resolved this issue for the same reason. Possible Asserted Effect: Failure to prepare accurate ETA 9130 reports may inhibit the USDOL from effectively monitoring the UI program. Repeat Finding: A similar finding was reported in prior year audit as finding 2024-031. (Finding Code 2025-011, 2024-031, 2023-040, 2022-026) Recommendation: We recommend IDES review its procedures for preparing ETA 9130 financial reports required for the UI program and implement analytical and any other procedures considered necessary to ensure the reports are complete and accurate prior to submission to the USDOL. Views of IDES Officials: IDES accepts the recommendation and will work to ensure the ETA 9130 financial reports are complete and accurate. IDES has undertaken a comprehensive set of improvements such as increasing staffing resources, evaluating and refining internal procedures, including improved analytical and supervisory review procedures, and modernizing reporting systems to remediate errors in its ETA 9130 reports.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,467,054,918) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2025-012: Inadequate Process for Preparing ETA 2208A Special Report Condition Found: IDES does not have an adequate process in place to ensure the ETA 2208A special reports prepared for the Unemployment Insurance (UI) program are complete and accurate. On a quarterly basis, IDES is required to report information on staff years worked and paid by program category on the ETA 2208A – Quarterly UI Above-Base (ETA 2208A) report. The information required to be reported includes UI program staff year usage (Section A), regular contingency entitlement certification (Section B), trade above-base entitlement certification (Section C), and additional benefits above-base entitlement certification (Section D). Key line items required for testing include items one through seven in Section A. IDES internal control procedures require a supervisor review and approval of quarterly reports prior to submission to the United States Department of Labor (USDOL). During our testing of a sample of two of the four quarterly ETA 2208A reports, we noted IDES was unable to provide evidence a supervisor reviewed and approved the December 31, 2024 and the March 31, 2025 reports prior to submission to USDOL. Criteria or Requirement: According to ET Handbook No. 336, 18th edition, IDES is required to submit quarterly UI above-base reports (known as ETA 2208A reports) by the first day of the second month after the quarter of reference. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal control should include performance and documentation of supervisory review procedures to ensure the information reported in required special reports is complete and accurate prior to submission to the USDOL. Cause: In discussing these conditions with IDES officials, they stated that misunderstanding of changes to USDOL’s reporting system during the audit period caused these issues. Furthermore, management indicated that prior year corrective action plans have not fully resolved this issue because they did not anticipate the USDOL system change. Possible Asserted Effect: Failure to consistently perform and document supervisory review procedures for required reports prior to submission increases the risk that inaccurate information is reported to federal agencies. This may prevent the USDOL from effectively monitoring the UI program and increases the risk of undetected noncompliance with federal reporting requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-032. (Finding Code 2025-012, 2024-032, 2023-041 2022-028, 2021-032) Recommendation: We recommend IDES management evaluate the root cause of its control procedures not being consistently followed. We also recommend IDES implement a more robust mechanism to ensure that all special reports are mathematically verified, reviewed, and formally approved by a supervisor prior to their submission to the USDOL. Views of IDES Officials: IDES accepts the recommendation. IDES has clarified its understanding of the new USDOL system functionality, developed a written job aid, and trained staff involved.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,467,054,918) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Finding 2025-013: Failure to Complete UI BAM Case File Reviews Within Required Timeframes Condition Found: IDES did not complete the Benefit Accuracy Measurement (BAM) case file reviews in accordance with United States Department of Labor (USDOL) requirements for the Unemployment Insurance (UI) program. The Payments Integrity Information Act (PIIA) of 2019 codified the requirement for valid statistical estimates of improper payments. State Workforce Agencies (SWAs) are required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is USDOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims. The BAM program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. To accomplish this, IDES’ BAM unit is required to select a weekly sample of payments and denied claims (known as a batch) from weeks specified by the USDOL, on which to complete prompt, and in-depth investigations to determine if the administration of the Unemployment Compensation program is consistent with state and federal law (20 CFR section 602.21(d)). USDOL has promulgated investigational requirements and instructions in ET Handbook No. 395 pursuant to 20 CFR section 602.30(a).The handbook states that for paid cases, a minimum (1) 70% of cases must be complete within 60 days of the last day of the week from which the batch was selected (2) 95% of cases must be completed within 90 days of the last day of the week from which the batch was selected and (3) 98% of cases for the calendar year must be completed within 120 days of the last date of the calendar year. In addition, a minimum of 480 cases must be complete during the calendar year. During our testing of paid claims, we noted IDES did not achieve each of the required percentage of case reviews within the required timeframes. Specifically, for batch range 202427-2025526, IDES failed to meet the 90-day time lapse standard of 95% complete as only 94.18% of case reviews were complete. We also noted IDES did not notify USDOL of the failed case completion percentage requirements nor receive a waiver of the requirements from the USDOL. Further, we noted IDES has not established adequate controls to ensure BAM case file review procedures are completed within timeframes established by the USDOL. Criteria or Requirement: According to 20 CFR 602.11(d), SWAs are required to operate and maintain a quality control system. In addition, 20 CFR 602.11(a) requires States to provide such methods of administration as will reasonably ensure prompt and full payment of unemployment benefits to eligible claimants, and collection and handling of income for the State unemployment fund, with greatest accuracy feasible. In addition, according to ET Handbook No. 395, 5th Edition, IDES is required to submit BAM case file data to the USDOL when case files are complete. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing and maintaining adequate resources to ensure the BAM case file reviews are completed in accordance with the required timeframes established by USDOL. Cause: In discussing these conditions with IDES officials, they stated the conditions were the result of understaffing caused by vacancies. Possible Asserted Effect: Failure to complete BAM case file reviews within established timeframes results in regulatory noncompliance and prevents the USDOL from effectively monitoring the integrity, error rates, and overall health of the State of Illinois’ UI program. Delayed investigations may also hinder the timely detection and prevention of systemic fraud and administrative overpayments. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-013) Recommendation: We recommend IDES review its procedures for completing BAM case file reviews to ensure they are completed in accordance with program regulations. IDES should also evaluate whether adequate resources have been assigned to ensure the BAM case file reviews are completed in accordance with the required timeframes established by USDOL. Views of IDES Officials: IDES accepts the recommendation. Two additional investigators were hired to mitigate this problem going forward. Additionally, IDES is working to automate some elements of the BAM review process to further improve timeliness of reviews.

State Agency: Illinois Department of Employment Security (IDES) Federal Agency: U.S. Department of Labor (USDOL) Program Name: Unemployment Insurance Program ALN and Program Expenditures: 17.225 ($2,467,054,918) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: None Finding 2025-014: Inaccurate Reporting of Federal Expenditures Condition Found: IDES did not accurately report Federal expenditures under the Unemployment Insurance (UI) program. Federal expenditures reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA) did not agree to IDES’ financial records provided for audit. Specifically, we noted the following differences between amounts provided for audit by IDES and the SEFA amounts reported to the IOC for the Unemployment Insurance program for the year ended June 30, 2025: "See full report for chart/table." Finally, we noted IDES’s controls over reporting federal expenditures were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statements which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA. Cause: In discussing these conditions with IDES officials, they stated competing priorities delayed the adjustments to remove Federal returns from the SEFA. Possible Asserted Effect: Failure to accurately report federal expenditures inhibits the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was reported in prior year audit as finding number 2025-014. (Finding Code 2025-014, 2024-033, 2023-042) Recommendation: We recommend IDES establish procedures to accurately report federal expenditures used to prepare the SEFA to the IOC. Views of IDES Officials: IDES accepts the recommendation. IDES is working with GOMB to create a policy around the removal of Federal returns.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Labor (USDOL) U.S. Department of Health and Human Services (USDHHS) Program Name: WIOA Act Cluster Low-Income Home Energy Assistance Program ALN and Program Expenditures: 17.258/17.259/17.278 ($146,186,461), 93.568 ($215,662,419) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2025-015 Failure to Properly Report Subaward Information Required by FFATA Condition Found: DCEO failed to properly report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the WIOA Cluster and Low-Income Home Energy Assistance Program (LIHEAP) programs. FFATA requires the State to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Unique Entity Identifier (UEI) 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During State fiscal year 2025, DCEO did not properly report the following key data elements, for each subaward made or modified for its major programs as follows: "See full report for chart/table." Additionally, we noted DCEO did not have adequate internal controls in place over FFATA reporting to ensure all subawards were accurately reported within required timeframes. DCEO passed through approximately $127,052,335 and $209,280,144 to subrecipients of the WIOA Cluster and LIHEAP programs, respectively, during the year ended June 30, 2025. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMBdesignated, government-wide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Prime recipients must report subaward information by the end of the month following the month in which the subaward was made. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure all FFATA reports are accurately prepared and timely submitted in accordance with federal regulations. Cause: In discussing these conditions with DCEO officials, they stated DCEO’s procedures did not include reporting award modifications. Possible Asserted Effect: Failure to properly report subaward information in accordance with FFATA results in noncompliance with federal requirements. This lack of reporting diminishes the transparency of federal spending, preventing the public, federal oversight agencies, and Congress from tracking how federal grant funds are being distributed and utilized at the subrecipient level. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-036. (Finding Code 2025-015, 2024-036, 2023-029) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO establish and formalize procedures and controls to identify awards and amendments subject to FFATA reporting requirements and ensure the required subaward information is reported accurately and timely in accordance with FFATA. Views of DCEO Officials: DCEO agrees with the finding and recommendations.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Labor (USDOL) Program Name: WIOA Cluster ALN and Program Expenditures: 17.258/17.259/17.278 ($146,186,461) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: None Finding 2025-016 Inaccurate Reporting of Federal Expenditures Condition Found: DCEO did not accurately report Federal expenditures under the WIOA Cluster program. Federal expenditures reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditures of federal awards (SEFA) did not properly reflect interagency expenditures for the WIOA Cluster program for the year ended June 30, 2025. Specifically, we noted the following differences between amounts provided for audit by DCEO and the SEFA amounts reported to the IOC for the WIOA Cluster program for the year ended June 30, 2025: "See full report for chart/table." Finally, we noted DCEO’s controls over reporting federal expenditures were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statement which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with DCEO officials, they stated the difference related to an error which eliminated the reporting of WIOA Cluster expenditures made by the Illinois Department of Employment Security for services provided as part of an intergovernmental agreement. Possible Asserted Effect: Failure to accurately report federal expenditures impedes the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-016) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO establish procedures to accurately report federal expenditures used to prepare the SEFAto the IOC. Views of DCEO Officials: DCEO agrees with the finding and recommendations.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low Income Home Energy Assistance Program (LIHEAP) ALN and Program Expenditures: 93.568 ($215,662,419) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2025-017 Failure to Re-certify to the Accuracy of the Clearance Pattern Condition Found: DCEO did not properly review or re-certify the accuracy of the clearance pattern specified in the Treasury-State Agreement related to cash draws for the Low Income Home Energy Assistance Program (LIHEAP). Annually, the State of Illinois negotiates the Treasury-State Agreement (TSA) with the U.S. Department of the Treasury (the Treasury) which details the funding techniques used for the draw down of federal funds. Certain approved finding techniques utilized by the State require the use of a clearance pattern that identifies the average number of days disbursements (warrants) take to clear the State Treasurer’s account. The established clearance pattern is then used to determine the date the State should request federal funds from the U.S. Treasury in order to minimize the time elapsing between the receipt of federal funds and the State Treasurer’s clearance of funds. Under federal regulations, these clearance patterns must be recertified at least every five years. During our testing over cash management requirements, we noted the clearance pattern included in the TSA in place for the fiscal year ended June 30, 2025, had not been recertified since 2016 (more than 5 years since previous recertification). Consequently, DCEO is operating using a warrant clearance pattern that is approximately nine years old. Additionally, we noted internal controls have not been established to ensure clearance patterns are calculated and recertified in accordance with Treasury regulations. Criteria or Requirement: 31 CFR 205.20 requires a State to ensure that a clearance pattern accurately represents the flow of Federal funds under the Federal assistance programs to which it is applied, and that a clearance pattern reflects seasonal or other periodic variations in clearance activity. A State shall also ensure that a clearance pattern is auditable.Further, 31 CFR 205.22 states an authorized State official shall recertify that a clearance pattern corresponds to a program’s clearance activity and shall recertify the accuracy of the clearance pattern at least every five years. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish, document, and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure clearance patterns are recertified in accordance with federal regulations. Cause: In discussing these conditions with DCEO officials, they stated DCEO did not have the correct funding technique listed within the TSA for LIHEAP. Furthermore, management indicated that prior year corrective action plans have not fully resolved this issue because corrective action was planned subsequent to State fiscal year 2025. Possible Asserted Effect: Failure to evaluate and recertify a program’s clearance pattern violates the requirement of 31 CFR 205 and could result in the inaccurate recalculation of DCEO’s interest obligation to the Treasury. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-034. (Finding Code 2025-017, 2024-034, 2023-027) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO establish procedures and controls to ensure clearance patterns are recertified within required timeframes. Views of DCEO Officials: DCEO agrees with this finding. DCEO’s Office of Financial Management requested the Governor’s Office of Management and Budget change the funding technique for the LIHEAP program within the TSA to pre-issuance effective for State fiscal year 2026.

State Agency: Illinois Department of Commerce and Economic Opportunity (DCEO) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Low Income Home Energy Assistance Program (LIHEAP) ALN and Program Expenditures: 93.568 ($215,662,419) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Cash Management Finding 2025-018 Failure to Perform Cash Draws in Accordance with the Treasury State Agreement Condition Found: DCEO did not perform its cash draws in accordance with the funding technique prescribed in the Treasury State Agreement (TSA). On an annual basis, the State of Illinois negotiates the TSA with the U.S. Department of the Treasury (the Treasury), which details, among other things, the funding techniques to be used for requesting federal funds. The TSA funding technique prescribed for the Low-Income Home Energy Assistance Program (LIHEAP) program the Average Clearance funding technique. This interest-neutral technique requires DCEO to request funds from the federal awarding agency so that they are deposited via ACH on the dollar-weighted average day of warrant clearance. According to the 2025 TSA the average day of clearance for program costs is three days. Because an ACH transfer typically takes one business day to settle, DCEO must request federal funds exactly two days after issuing warrants (payments) to ensure the federal funds are deposited on the third day (the day the warrants are expected to clear the State's bank account). During our testing of 18 cash draws (totaling $71,025,520) for LIHEAP program (subrecipient) expenditures during the year ended June 30, 2025, we sampled 40 underlying subrecipient payments totaling $19,169,382. We noted the expenditures supporting the cash draws were not disbursed in accordance with the timeframe required by the prescribed funding technique. Specifically, the full amount of federal funds tested were requested anywhere from 15 days earlier to 30 days later than permitted by the prescribed funding technique. Additionally, we noted internal controls have not been established to ensure cash draws are calculated and requested in accordance with Treasury regulations and the funding technique prescribed by the Treasury-State agreement. Criteria or Requirement: According to 31 CFR 205.6(a), a Treasury-State Agreement documents the accepted funding techniques and methods for calculating interest agreed upon by the U.S. Treasury and the State for each Federal program governed by subpart A of the Treasury regulations. Section 6.3.2 of the 2025 Treasury State Agreement (effective July 1, 2024 to June 30, 2025) states that the LIHEAP program is required to use the Average Clearance funding technique. Section 6.2.1 of the 2025 Treasury State Agreement describes the Average Clearance funding technique as being interest neutral and requiring the State to request funds such that they are deposited by ACH on the dollar-weighted average day of clearance for the disbursement. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish, document, and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure that Federal cash draws are performed in accordance with the TSA. Cause: In discussing these conditions with DCEO officials, they stated DCEO did not have the correct funding technique listed within the TSA for LIHEAP. Furthermore, management indicated that prior year corrective action plans have not fully resolved this issue because corrective action was planned subsequent to State fiscal year 2025. Possible Asserted Effect: Failure to draw funds in accordance with the TSA results in noncompliance with U.S. Treasury regulations and the Cash Management Improvement Act. Drawing federal funds prior to the average day of clearance results in the State holding excess federal cash, which generates an interest liability that must be calculated and remitted to the U.S. Treasury. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-035. (Finding Code 2025-018, 2024-035, 2023-028) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCEO implement procedures to ensure cash draws are performed in accordance with the TSA or work with the US Treasury to amend the TSA to obtain the Treasury’s approval of DCEO’s cash draw request practices. Views of DCEO Officials: DCEO agrees with this finding and recommendations.

State Agency: Illinois Emergency Management Agency and Office of Homeland Security (IEMA-OHS) Federal Agency: U.S. Department of Homeland Security (USDHS) Program Name: Disaster Grants – Public Assistance (Presidentially Declared Disasters) Homeland Security Grant Program ALN and Program Expenditures: 97.036 ($317,860,132), 97.067 ($80,821,527) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2025-019 Failure to Properly Report Subaward Information Required by FFATA Condition Found: IEMA-OHS failed to properly report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Public Assistance) and Homeland Security Grant Program (Homeland) programs. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Unique Entity Identifier (UEI) 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During State fiscal year 2025, we noted certain key data elements reported in the FFATA reporting portal (SAM.gov) were not consistent with IEMA-OHS' records or do not appear to have been reported within required timeframes, as follows: "See full report for chart/table." Additionally, we noted IEMA-OHS did not have adequate internal controls in place over FFATA reporting to ensure all subawards were accurately reported within required timeframes. IEMA-OHS passed through approximately $54,587,033 and $75,340,118 to subrecipients of the Public Assistance and Homeland programs, respectively, during the year ended June 30, 2025. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Prime recipients must report subaward information by the end of the month following the month in which the subaward was made. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure all FFATA reports are accurately prepared and timely submitted in accordance with federal regulations. Cause: In discussing these conditions with IEMA-OHS officials, they stated appropriate oversight procedures have not been implemented related to this process. Possible Asserted Effect: Failure to properly report subaward information in accordance with FFATA results in noncompliance with federal requirements. This lack of reporting diminishes the transparency of federal spending, preventing the public, federal oversight agencies, and Congress from tracking how federal grant funds are being distributed and utilized at the subrecipient level. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-019) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IEMA-OHS establish and formalize procedures and controls to ensure the required subaward information is reported accurately and timely in accordance with FFATA. Views of IEMA-OHS Officials: The Accountability Office has now developed the FFATA Reporting Submission Checklist and it will be distributed to the grant program area. The checklist will be required to be submitted with the FFATA Reporting template to the Accountability Officer. The Accountability Officer will file in SAM.gov and, then the form will be sent back to grant program area for its review for accuracy.

State Agency: Illinois Emergency Management Agency and Office of Homeland Security (IEMA-OHS) Federal Agency: U.S. Department of Homeland Security (USDHS) Program Name: Disaster Grants – Public Assistance (Presidentially Declared Disasters) ALN and Program Expenditures: 97.036 ($317,860,132) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-020 Inadequate Process for Subrecipient Single Audit Report Desk Reviews Condition Found: IEMA-OHS has not established effective internal controls or documented procedures to ensure subrecipients of the Disaster Grants - Public Assistance (Presidentially Declared Disasters) (Public Assistance) program perform audits required by the Uniform Guidance. IEMA-OHS coordinates Public Assistance program disaster requests with the USDHS Federal Emergency Management Agency (FEMA) related to disasters declared by the Governor and approved by the President. Local governments, non-profits, and other organizations receiving Public Assistance program funding are considered subrecipients of the State and are legally required to obtain single audits when federal expenditures exceed the established threshold under the Uniform Guidance. The State of Illinois established the Grant Accountability Transparency Unit (GATU) to implement the provisions of State's Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and, if required, submit their single audit reporting packages to the Federal Audit Clearinghouse (FAC). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, assigning any findings attributable to amounts passed through to the subrecipient(s) by the State to the applicable state agency, and working with program personnel to issue management decisions on findings. The State utilizes a contractor to perform the centralized functions of obtaining the single audit report, verifying the report meets the requirements, and assigning findings to the applicable State agency. While GATU has exempted Public Assistance program subrecipients from certain state-specific GATA filing requirements, these subrecipients remain subject to federal Uniform Guidance requirements. Many of these subrecipients receive other federal pass-through funding from the State and submit their single audits through GATU's centralized process. However, the centralized state process does not absolve IEMA-OHS of its primary federal responsibilities as the direct pass-through entity. During our audit procedures over IEMA-OHS' subrecipient monitoring and desk review processes, we noted that IEMA-OHS did not have documented policies, procedures, or established internal controls to: • Identify subrecipients subject to the Single Audit requirements contained in Subpart F of the Uniform Guidance and determine whether required Single Audit reporting packages were timely submitted; • Review Single Audit reports submitted by subrecipients to identify findings, questioned costs, modified opinions, or other compliance matters related to Federal programs administered by IEMA-OHS and document any required follow-up actions; • Verify that Federal expenditures attributable to IEMA-OHS-administered awards were accurately reported by subrecipients within their schedules of expenditures or federal awards (SEFA) and Data Collection Forms submitted to the FAC; and • Reconcile expenditures reported by subrecipients for IEMA-OHS pass-through awards to agency records, • award documentation, and other supporting information to determine whether reported amounts were complete, accurate, and consistent with IEMA-OHS' records. As a result of these deficiencies, IEMA-OHS could not demonstrate whether its subrecipients complied with Uniform Guidance audit requirements, nor could it verify whether required management decisions on subrecipient audit findings were issued within the federally mandated timeframes. Criteria or Requirement: 2 CFR 200.332(e) requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. This monitoring must include: 1. Verifying that every subrecipient that is expected to have a single audit performed meets the requirements of Subpart F of this part. 2. Reviewing the results of the subrecipient's audit and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award. 3. Issuing a management decision for audit findings that relate to the Federal awards it makes to subrecipients as required by 2 CFR 200.521. 2 CFR 200.521(d) states that the pass-through entity is responsible for issuing a management decision on subrecipient findings within six months of acceptance of the audit report by the FAC. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include implementing procedures to monitor whether single audit reports are obtained and reviewed, and management decision letters are issued within required timeframes. Cause: In discussing these conditions with IEMA-OHS officials, they stated the failure to monitor and conduct the compliance reviews were caused by the lack of an official procedure. Possible Asserted Effect: Failure to establish robust subrecipient monitoring controls significantly increases the risk that subrecipient noncompliance with Federal requirements, internal control deficiencies, questioned costs, and modified audit opinions will go undetected and unaddressed. Furthermore, without systematic procedures to verify and reconcile expenditures reported by subrecipients in their SEFAs, IEMA-OHS lacks assurance that its pass-through awards are being accurately reported at the subrecipient level. Consequently, unreported compliance issues, inaccuracies in federal reporting, and potential questioned costs may remain undetected, impairing IEMA-OHS' ability to effectively oversee Federal funds and increasing the risk of federal sanctions, including the potential withholding of future Public Assistance funding. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-020) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IEMA-OHS establish and implement comprehensive policies and procedures to strengthen its subrecipient monitoring process and ensure compliance with 2 CFR § 200.332. At a minimum, these procedures should require IEMA-OHS to: Establish a Tracking Mechanism: Develop and maintain a tracking log of all active subrecipients to monitor the submission status of their Single Audit packages to the FAC. Consideration should be to differentiate IEMA-OHS’ procedures for those subrecipients who are subject to GATA reporting requirements and those that are not. Formalize Desk Reviews: Establish a formal process for program personnel to review subrecipient Single Audit reports, document the evaluation of audit findings affecting the Public Assistance program, and ensure management decisions are issued within the required six-month timeframe. Implement Reconciliation Procedures: Implement procedures to verify and reconcile expenditures reported on subrecipients' SEFAs to IEMA-OHS’ internal award records.Retain Monitoring Documentation: Maintain centralized, audit-ready documentation of all subrecipient monitoring activities, including completed checklists, correspondence, and management decision letters. Views of IEMA-OHS Officials: IEMA-OHS agrees with the finding and recommendations. The Accountability Office will, with the assistance of the relevant grant programs, develop and implement clear and consistent procedures to ensure compliance with 2 CFR 200.

State Agency: Illinois Department of Public Health (IDPH) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: COVID-19 – Immunization Cooperative Agreements, COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases ALN and Program Expenditures: 93.268 ($140,960,195), 93.323 ($73,439,961) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2025-021 Failure to Properly Report Subaward Information Required by FFATA Condition Found: IDPH failed to properly report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the COVID-19 – Immunization Cooperative Agreements (ICA) and COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) programs. The State is required to report certain key elements related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Unique Entity Identifier (UEI) 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During State fiscal year 2025, IDPH did not have procedures in place to identify and report the following key data elements, for each subaward made or modified for its major programs as follows: "See full report for chart/table." Additionally, we noted IDPH did not have adequate internal controls in place over FFATA reporting to ensure all subawards were accurately reported within required time frames.IDPH’s subrecipient expenditures under its federal programs for the year ended June 30, 2025, were $12,763,931 and $2,261,991 for the ELC and ICA programs, respectively. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards st follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Regulation (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Prime recipients must report subaward information by the end of the month following the month in which the subaward was made.control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to maintain adequate documentation to substantiate information required by FFATA was reported within required timeframes. Cause: In discussing these conditions with IDPH officials, they stated the errors identified were the result of unexpected differences in dates within its subrecipient awarding system for agreements executed outside the system. Furthermore, management indicated that prior year corrective action plans have not fully resolved this issue because the previous corrective action did not specifically address the issue identified. Possible Asserted Effect: Failure to properly report subaward information in accordance with FFATA results in noncompliance with federal requirements. This lack of reporting diminishes the transparency of federal spending, preventing the public, federal oversight agencies, and Congress from tracking how federal grant funds are being distributed and utilized at the subrecipient level. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-024. (Finding Code 2025-021, 2024-024, 2023-032, 2022-020, 2021-021). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDPH establish procedures and formalize procedures and controls to identify awards and amendments subject to FFATA reporting requirements and ensure the required subaward information is reported accurately and timely in accordance with FFATA. Views of IDPH Officials: IDPH agrees with these findings and has corrected the subaward obligation date discrepancies. Additionally, a corrective action plan has been implemented to prevent reoccurrence in the future.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($67,630,897) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2025-022 Failure to Report Subaward Information Required by FFATA Condition Found: IDOA failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Aging Cluster program. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier (UEI) 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that IDOA did not prepare or submit FFATA reports as required by federal regulations for any subawards made for the Aging Cluster program for the period July 1, 2024 through June 30, 2025. Additionally, we noted IDOA did not establish adequate internal controls over FFATA reporting to ensure all subawards were reported as required. IDOA passed through $65,974,847 to 13 subrecipients of the Aging Cluster program during the year ended June 30, 2025. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMBdesignated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Prime recipients must report subaward information by the end of the month following the month in which the subaward was made. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include complying with FFATA. Cause: In discussing these conditions with IDOA officials, they stated the requirement to complete FFATA reports was overlooked and deadlines were missed. Furthermore, management indicated the prior year corrective action plan was not sufficient to mitigate the conditions identified in this finding. Possible Asserted Effect: Failure to identify and report subawards subject to FFATA results in noncompliance with federal regulations. This lack of reporting diminishes the transparency of federal spending, preventing the public, federal oversight agencies, and Congress from tracking how federal grant funds are being distributed and utilized at the subrecipient level. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-051. (Finding code 2025-022,2024-051) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDOA establish and formalize procedures to identify awards subject to FFATA reporting requirements and ensure the required subaward information is reported accurately and timely. Views of IDOA Officials: IDOA accepts this finding and will create a comprehensive action plan that includes training for staff responsible for submitting the information, written policies and procedures, and a tracking mechanism/reminder system to prevent this finding in the future.

State Agency: Illinois Department on Aging (IDOA) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Aging Cluster ALN and Program Expenditures: 93.044/93.045/93.053 ($67,630,897) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-023 Inadequate Review of Subrecipient Single Audit Reports Condition Found: IDOA did not issue management decision letters for single audit report findings for subrecipients of the Aging Cluster program within required timeframes.The State of Illinois established the Grant Accountability and Transparency Unit (GATU) to implement the provisions of the State’s Grant Accountability and Transparency Act (GATA) on a centralized basis. GATU has established standardized reporting requirements for subrecipients of the various Federal and State programs administered by the State through its various departments. Subrecipients of the State are required to certify whether they expended more than $750,000 in federal awards during the fiscal year and submit their single audit reporting packages to the Federal Audit Clearinghouse (if required). GATU is then responsible for obtaining the single audit reporting package, verifying the report meets the single audit requirements, and assigning to the applicable state agency, any findings attributable to amounts passed through to the subrecipient(s) by the State. IDOA staff are responsible for reviewing the reports assigned to them by GATU and determining whether: (1) federal funds reported in the schedule of expenditures of federal awards reconcile to IDOA records; (2) issuing management decisions on findings reported within required timeframes; and (3) applying sanctions to subrecipients who do not comply with reporting requirements (i.e. stop pay process). During our testing of a sample of single audit desk review files for seven subrecipients (with expenditures of $40,522,841 in the fiscal year), we noted IDOA did not issue a management decision letter within 180 days for six subrecipients (with expenditures totaling $22,839,932). The delays in issuing management decision letters ranged from 708 to 803 days beyond the required timeframe. IDOA has not established controls over subrecipient single audit reviews at an adequate level of precision to ensure single audit reporting requirements and the issuance of management decision letters are performed within required timeframes.IDOA passed through $65,974,847 to subrecipients of the Aging Cluster program during the year ended June 30, 2025. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subaward, and that the subaward performance goals are achieved. Additionally, 2 CFR 200.332(e)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure Single Audit reports are reviewed in a timely manner and management decisions are issued within required timeframes. Cause: In discussing these conditions with IDOA officials, they stated the delays resulted from a combination of factors, including limited staffing capacity and the absence of automated workflow tools needed to process audit assignments at the level of precision required under the Uniform Guidance. Furthermore, management indicated the prior year corrective action plan was not sufficient to mitigate the conditions identified in this finding. Possible Asserted Effect: Failure to timely issue management decisions on subrecipient single audit findings results in noncompliance with federal regulations and prevents IDOA from ensuring that subrecipients implement prompt corrective action. When resolution is delayed by more than two years, there is a significantly increased risk that subrecipients may not comply with federal requirements across multiple subsequent grant periods without detection or remediation. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-049. (Finding Code 2025-023, 2024-049) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample.Recommendation: We recommend IDOA establish procedures to ensure management decision letters are issued for all findings affecting its federal programs in accordance with the Uniform Guidance. Such procedures should address how the State will address any remaining backlog of unresolved subrecipient single audit findings requiring management decisions. Views of IDOA Officials: IDOA is committed to bringing all audit reviews current and will meet timelines outlined in 2 CFR 200.521(a) going forward. IDOA accepts this finding and will create a comprehensive corrective action plan that includes additional staff capacity, development of standard operating procedures, staff training, and ongoing tracking to prevent this finding in the future.

State Agency: Illinois Department of Children and Family Services (DCFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families Foster Care – Title IV-E Adoption Assistance ALN and Program Expenditures: 93.558 ($593,881,225), 93.658 ($190,740,988), 93.659 ($114,759,333) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Activities Allowed/Unallowed Allowable Costs/Costs Principles Finding 2025-024: Failure to Provide Supporting Documentation for Payroll and Related Costs Condition Found: DCFS could not provide adequate supporting documentation to substantiate payroll and related costs claimed for federal reimbursement under the Foster Care – Title IV-E (Foster Care), Adoption Assistance, and Temporary Assistance for Needy Families (TANF) programs. On a weekly basis, DCFS employees complete and sign timesheets to report and certify their time. These timesheets are then reviewed and approved by the employee’s immediate supervisor. The supervisor approves the timesheets based on their knowledge of the employee’s hours worked during the pay period. Timesheets are scanned for archiving once a month by the payroll department. Timesheets are manually entered into the time reporting system (Employee Monthly Time Report) which is used to accumulate the costs related to each cost center. Cost pool data from the time reporting system is used to identify personal service expenditures attributable to DCFS’s State and federal programs and to calculate and allocate the related fringe benefit charges and indirect costs. During our testing of 40 direct payroll expenditures charged to the cost pools allocated to the Foster Care, Adoption Assistance, and TANF programs (totaling $159,725) during the year ended June 30, 2025, we noted the following: "See full report for chart/table." The timesheet for one employee (supporting cost pool payroll expenditures sampled of $3,338) could not be provided for testing. DCFS personnel stated they were unable to locate the timesheet for this employee for the sampled period. Upon further review, DCFS personnel noted timesheets were unable to be located for this employee and all employees within the same pay group (totaling 16 additional employees) for the entire fiscal year, resulting in approximately 403 missing timesheets (related to payroll, fringe benefits, and indirect costs included in the cost pool totaling $1,636,270, $1,389,016, and $726,519, respectively). As a result, the personal service (payroll and fringe benefit) expenditures, as well as related indirect costs, were not appropriately supported in accordance with the requirements of the applicable cost principles. Accordingly, the personal service expenditures and indirect costs were not allowable. The hours reported for one employee (with sampled personal services expenditures from the cost pool of $5,074) in the timekeeping system used to allocate personal services expenditures to Foster Care, Adoption Assistance, TANF, and other programs operated by the agency exceeded the hours reported on manual timesheets prepared by the employees and approved by supervisors. There were 2.5 unsupported hours reported in the timekeeping system resulting in unsupported personal service expenditures from the cost pool of $11. Additionally, we noted the controls to ensure required documentation is obtained to support payroll and related costs and maintained to evidence management approval of payroll information were not operating effectively. We also noted adequate internal controls have not been established to ensure the data included in the timekeeping system and used to allocate personal services expenditures to Foster Care, Adoption Assistance, TANF, and other programs operated by DCFS is consistent with the hours reported on manual timesheets prepared by the employees and approved by supervisor. Personal service (payroll and fringe benefit) expenditures and related indirect costs charged to the Foster Care, Adoption Assistance, and TANF programs for the year ended June 30, 2025, were as follows: "See full report for chart/table." Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that the expenditure be adequately documented. According to 2 CFR 200.430(g), charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be, among other things, supported by a system of internal control, comply with the established accounting policies and practices of the non-Federal entity, and support the distribution of the employee’s salary or wages amount across specific activities or cost objectives if the employee works on more than one federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure required documentation is obtained to support payroll and related costs and to maintain documentation evidencing management approval of payroll information. Cause: In discussing these conditions with DCFS officials, they stated these exceptions were due to human error and the limitations of keeping a complete file record for the paper-based overtime approval and timesheet process. Furthermore, management indicated that prior year correction action plans have not fully resolved this issue because the anticipated transition date of the payroll and timekeeping system has been delayed. Possible Asserted Effect: Failure to accurately document and maintain required timesheets results in noncompliance with federal regulations and unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-023. (Finding code 2025-024, 2024-023) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCFS review its current procedures and consider any changes necessary to ensure supporting documentation for payroll and related costs is maintained and accurately reflects work performed in accordance with the applicable federal regulations. Views of DCFS Officials: DCFS has improved communication with and the training of its timekeepers in order to ensure accurate and consistent timekeeping standards. DCFS has also instituted new quality control procedures to identify and correct errors. All timekeepers are required to submit timesheets for digital archive to ensure proper record retention. DCFS is also actively pursuing modernization efforts for both payroll and timekeeping, using timekeeping and payroll systems available from the Illinois Department of Central Management Services.

State Agency: Illinois Department of Children and Family Services (DCFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Foster Care – Title IVALN and Program Expenditures: 93.658 ($190,740,988) Award Numbers: Various – see table Federal Award Year: Various – see table Questioned Costs: None Compliance Requirement: Activities Allowed/Unallowed Allowable Costs/Cost Principles Finding 2025-025: Inadequate Process for Foster Care Daycare Maintenance Assistance Payments Condition Found: DCFS does not have an adequate process in place to ensure Foster Care – Title IV-E (Foster Care) daycare maintenance assistance payments are accurately paid based on its approved rate schedule. The foster care program provides funds to States for maintenance assistance payments to deliver substitute care for children who are under the jurisdiction of a Title IV-E agency and who need temporary placement or care outside their homes. Maintenance payments are made on behalf of eligible Title IV-E beneficiaries to individuals serving as foster family homes, to childcare institutions, or public or private child-placement or child-care agencies in accordance with the Title IV-E agency’s maintenance rate schedule.During our review of internal controls over beneficiary payments charged to the Foster Care program during the year ended June 30, 2025, we noted the review procedures for approving the manually prepared certification rate forms submitted to DCFS by child care providers for Foster Care daycare payments do not include verifying the rate entered by the child care provider agrees to the approved rate schedule. Daycare maintenance assistance payments made on behalf of Foster Care beneficiaries totaled $671,019 during the year ended June 30, 2025. Payments made on behalf of beneficiaries of the Foster Care program totaled $36,036,485 during the year ended June 30, 2025. Criteria or Requirement: 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure payments are made at the approved rates. Cause: In discussing these conditions with DCFS officials, they stated the issue was due to the certification rate forms that were erroneously completed by childcare providers. Furthermore, management indicated the prior year corrective action plan has not fully resolved this issue for State fiscal year 2025 because the corrective action was planned for future periods. Possible Asserted Effect: Failure to ensure payment calculations are properly performed and approved provider rates are accurately entered in the system may result in unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-022. (Finding code 2025-025, 2024-022) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCFS implement procedures to ensure foster care maintenance payments are properly calculated and consistent with the approved DCFS payment rate schedules. Views of DCFS Officials: DCFS agrees and has implemented corrective action. In July 2025, the daycare eligibility program discontinued the use of certification rate forms. As a result, all childcare providers now receive the State established reimbursement rate, regardless of the rate they charge private-paying families. This change ensures that all childcare providers receive the funding to which they are entitled.

State Agency: Illinois Community College Board (ICCB) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.575/93.596 ($424,695,722) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2025-026 Failure to Properly Report Subaward Information Required by FFATA Condition Found: ICCB failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Child Care and Development Fund (CCDF) Cluster (CCDF Cluster) program. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that ICCB did not prepare or submit FFATA reports required by federal regulations for any subawards made for the CCDF Cluster program for the period July 1, 2024 through June 30, 2025. Additionally, we noted ICCB did not establish adequate control over FFATA reporting to ensure all subawards were reported as required. ICCB passed through $4,443,162 to subrecipients of the CCDF Cluster program during the year ended June 30,2025. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing,OMB-designated, government-wide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Prime recipients must report subaward information by the end of the month following the month in which the subaward was made. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures designed to ensure FFATA reporting is completed in accordance with federal requirements. Cause: In discussing these conditions with ICCB officials, they noted this funding originated from an interagency agreement with the Illinois Department of Human Services (IDHS) which caused technical challenges for reporting awards made by ICCB. As a result of these reporting challenges, ICCB was unable to complete the required reporting and implement its planned corrective action from the prior audit. Possible Asserted Effect: Failure to identify and report subawards subject to FFATA results in noncompliance with federal regulations. This lack of reporting diminishes the transparency of federal spending, preventing the public, federal oversight agencies, and Congress from tracking how federal grant funds are being distributed and utilized at the subrecipient level. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-029. (Finding code 2025-026, 2024-029) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend ICCB establish and formalize procedures to identify awards subject to FFATA reporting requirements and ensure the required subaward information is reported accurately and timely. Given the challenges with the interagency relationship for these particular awards, ICCB should also work with IDHS to ensure required reporting requirements are met by the State. Views of ICCB Officials: ICCB disagrees with the finding and recommendation as presented. ICCB does not dispute that the applicable first-tier subaward information was not reported. However, ICCB disagrees that the failure to report is attributable to ICCB. When attempting to implement the prior corrective action, ICCB determined that the federal reporting system only permits the recipient associated with the federal award to report first-tier subawards. ICCB's UEI is not associated with the federal award as the prime recipient, and the federal reporting system does not permit ICCB to submit its downstream awards as first-tier subawards. Appendix A to 2 CFR Part 170 assigns responsibility for reporting applicable first-tier subawards to the recipient. Because ICCB cannot make the required submission under the federal award, ICCB cannot independently correct the reporting condition identified in this finding. For future federal funding received through another State agency, ICCB will work with that agency to identify applicable FFATA reporting responsibilities, timely provide information necessary for the responsible recipient to complete required reporting, and document the respective agencies' responsibilities. Auditors’ Comment: ICCB is part of the primary government of the State of Illinois and executed subawards relative to a first-tier award under the CCDF Cluster which are required to be reported by the State according to 2 CFR 170.200. We understand the difficulties ICCB encountered in attempting to report its subawards; however, a transfer of federal funding within the primary government does not eliminate the requirement for the State to report such subawards. We continue to recommend ICCB work with IDHS to properly report these subawards.

State Agency: Illinois Board of Higher Education (IBHE) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.575/93.596 ($424,695,722) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Reporting Finding 2025-027 Failure to Properly Report Subaward Information Required by FFATA Condition Found: IBHE failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Child Care and Development Fund (CCDF) Cluster (CCDF Cluster) program. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing of seven CCDF Cluster program subrecipients (with expenditures totaling $7,436,068) we noted FFATA reporting was not completed for any of the subawards sampled. Upon additional review, we noted IBHE did not complete FFATA reporting for any of its CCDF Cluster program subawards during the year ended June 30, 2025. We also noted IBHE did not establish adequate control procedures to ensure FFATA reports were properly completed for all subawards as required by federal regulations.IBHE’s subrecipient expenditures under the CCDF Cluster for the year ended June 30, 2025 were $9,821,550. Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMBdesignated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures designed to ensure FFATA reporting is completed in accordance with federal requirements. Cause: In discussing these conditions with IBHE officials, they noted this funding originated from an interagency agreement with the Illinois Department of Human Services which caused technical challenges for reporting awards made by IBHE. As a result of these reporting challenges, IBHE was unable to complete the required reporting. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-027) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IBHE establish procedures to identify awards subject to FFATA reporting requirements and establish internal controls to report required subaward information. Views of IBHE Officials: IBHE agrees with the finding and recommendation.

State Agency: Illinois Board of Higher Education (IBHE) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.575/93.596 ($424,695,722) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-028 Inadequate Process to Communicate Award Information to Subrecipients Condition Found: IBHE does not have an adequate process in place to ensure required award information is accurately communicated to subrecipients of the Child Care Development Fund (CCDF) Cluster (CCDF Cluster) program. IBHE is responsible for coordinating program funding of certain subrecipients of the CCDF Cluster program. While IBHE uses a standard contract document for its agreements with subrecipients, the specific award information is manually input into each contract by program contracting personnel. During our testing of CCDF Cluster program subrecipient contracts under which federal funds were expended during the year ended June 30, 2025, we noted IBHE did not accurately communicate all required information to its subrecipients. Specifically, we noted the award communication included incorrect details as follows: "See full report for chart/table." Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that the expenditure be adequately documented. According to 2 CFR 200.430(g), charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be, among other things, supported by a system of internal control, comply with the established accounting policies and practices of the non-Federal entity, and support the distribution of the employee’s salary or wages amount across specific activities or cost objectives if the employee works on more than one federal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure required documentation is obtained to support payroll and related costs and to maintain documentation evidencing management approval of payroll information. Cause: In discussing these conditions with DCFS officials, they stated these exceptions were due to human error and the limitations of keeping a complete file record for the paper-based overtime approval and timesheet process. Furthermore, management indicated that prior year correction action plans have not fully resolved this issue because the anticipated transition date of the payroll and timekeeping system has been delayed. Possible Asserted Effect: Failure to accurately document and maintain required timesheets results in noncompliance with federal regulations and unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-023. (Finding code 2025-024, 2024-023) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DCFS review its current procedures and consider any changes necessary to ensure supporting documentation for payroll and related costs is maintained and accurately reflects work performed in accordance with the applicable federal regulations. Views of DCFS Officials: DCFS has improved communication with and the training of its timekeepers in order to ensure accurate and consistent timekeeping standards. DCFS has also instituted new quality control procedures to identify and correct errors. All timekeepers are required to submit timesheets for digital archive to ensure proper record retention. DCFS is also actively pursuing modernization efforts for both payroll and timekeeping, using timekeeping and payroll systems available from the Illinois Department of Central Management Services.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA) Program Name: Summer Electronic Benefits Transfer Program for Children ALN and Program Expenditures: 10.646 ($243,395,495) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Finding 2025-029 Failure to Retain Detailed Transactions for Summer EBT Program Beneficiary Payments Condition Found: IDHS did not retain transaction-level detail for beneficiary payments under the Summer Electronic Benefits Transfer Program for Children (Summer EBT) program. IDHS provides Summer EBT benefits to Illinois children from households with incomes at or below 185% of the federal poverty standard who are enrolled in a National School Lunch Program or School Breakfast Program participating school. During our testing of the Summer EBT program, IDHS was only able to provide summary-level payment data. Consequently, we were unable to obtain sufficient, appropriate audit evidence to identify individual payments made to specific beneficiaries, precluding us from selecting a sample from a complete population of claimed expenditures to verify that expenditures: 1. Met the general allowability criteria under the Uniform Guidance (2 CFR 200, Subpart E); 2. Were disbursed only to eligible beneficiaries; and 3. Were accurately calculated and issued in accordance with program requirements. Due to the absence of transaction-level records, we were unable to conclude on IDHS’ compliance with federal requirements applicable to the Summer EBT program. Criteria or Requirement: 7 CFR 292 requires participating state agencies to maintain adequate systems and documentation to verify household eligibility and benefit issuance. Specifically, 7 CFR 292.21(b)(8) requires financial management systems for the Summer EBT program to provide support and source documents for costs. 2 CFR 200.302(b)(3) also requires the financial management system of each non-Federal entity to provide records that identify adequately the source and application of funds for federally funded activities, including authorizations, obligations, unobligated balances, expenditures, and allowable costs supported by source documentation. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure transactional level detail is maintained for Summer EBT beneficiary payments. Cause: In discussing these conditions with IDHS officials, they stated they disagree with the finding. Possible Asserted Effect: Failure to maintain transaction-level records and effective internal controls results in a scope limitation, prevents verification of program compliance, and increases the risk of issuing unallowable or erroneous payments to ineligible recipients. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-029) Statistical Sampling: A sample could not be selected due to the lack of a transaction-level population. The planned testing was not intended to be a statistically valid sample. Recommendation: We recommend that IDHS review and enhance its fiscal and information systems processes to ensure that detailed, transaction-level beneficiary payment records are maintained and readily retrievable. Specifically, IDHS should implement reconciliation controls between summary accounting records and individual beneficiary issuance data to ensure compliance with Uniform Guidance and federal program regulations. IDHS Response: The Department disagrees with the finding. The IDHS and its partners maintain detailed records of beneficiaries and the data will be made available in future inquiries. Auditors’ Comment: As noted in the finding above, the transaction level detail requested for our procedures was not available prior to completion of our audit.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA) Program Name: Food Distribution Cluster ALN and Program Expenditures: 10.565/10.568/10.569 ($50,371,063) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Accountability for USDA Foods Finding 2025-030 Inadequate Review of Recipient Agencies of the Food Distribution Cluster Program Condition Found: IDHS did not adequately review the recipient agencies of the Food Distribution Cluster (FDC) program. IDHS has entered into agreements with nine subrecipients (recipient agencies) that operate the FDC program locally across the State of Illinois. The USDA purchases and provides food and administrative funds to IDHS, which in turn provides the USDA foods and a portion of the administrative funds to the recipient agencies. IDHS has implemented procedures where FDC program staff perform annual reviews of the storage facilities operated by the recipient agencies. These annual reviews include inspecting the annual inventory records of USDA foods maintained by the recipient agency. During State fiscal year 2025, we noted IDHS did not perform annual reviews for seven recipient agencies (with food commodities of $35,076,395), including the largest recipient of USDA food commodities in the State (with food commodities of $22,503,183). Additionally, during our testing of the annual reviews for two recipient agencies (with food commodity expenditures of $10,542,951), we noted IDHS’ review procedures did not include a reconciliation of the annual inventory count performed by the recipient agency to USDA food records as required by program regulations. IDHS passed through $50,196,115 to the nine recipient agencies during the year ended June 30, 2025. Criteria or Requirement: In accordance with 7 CFR 247.28(b), a physical inventory of all USDA Foods must be conducted annually at each storage and distribution site where USDA Foods are stored. Results of the physical inventory must be reconciled with inventory records and maintained on file by the State or local agency. In addition, 7 CFR 250.12 states on an annual basis the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency (or by a subdistributing agency) and must reconcile physical and book inventories of donated foods. 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to reconcile recipient agency food inventory records to USDA food records and ensure all recipient agencies are reviewed annually. Cause: In discussing these conditions with IDHS officials, they stated during State fiscal year 2025, IDHS was unaware of an annual requirement to obtain year-end inventory counts performed by recipient agencies and to reconcile the counts to USDA food records. Possible Asserted Effect: Failure to obtain and reconcile physical inventory records for all recipient agencies could result in food commodities not being used in accordance with program requirements and results in noncompliance with federal program requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-005. (Finding Code 2025-030,2024-005) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS update procedures and controls to ensure the annual review of recipient agencies includes reconciling the inventory records of the recipient agency to USDA food records or establish a separate process to obtain and reconcile physical inventory records. Views of IDHS Officials: The Department accepts the recommendation. Program and fiscal officials have already taken steps to address the deficiencies noted, including collection of inventory records and appropriate reviews.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.558 ($593,881,225), 93.575/93.596 ($424,695,722) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $535 (TANF Federal), $51,927 (TANF Maintenance of Effort (MOE)), $7,556 (CCDF Federal), $1,573 (CCDF MOE) Compliance Requirement: Activities Allowed/Unallowed, Allowable Costs/Cost Principles, Period of Performance, Special Test and Provision – Written Agreements as Part of Program Integrity and Accountability Finding 2025-031 Unallowable Costs Charged to the TANF and CCDF Cluster Programs Condition Found: IDHS could not provide documentation to support payments made on behalf of beneficiaries of the Temporary Assistance for Needy Families (TANF) and Child Care and Development Fund (CCDF) Cluster programs. The State of Illinois operates the Child Care Assistance Program (CCAP) which provides eligible families child care services at approved, licensed providers. IDHS also contracts with Child Care Resource and Referral (CCR&Rs) organizations who assist the State in coordinating and monitoring the activities of child care providers. Providers submit billings to IDHS or the CCR&R organizations detailing the name of the recipient of the services and the number of days for which services were received. Payments are made by IDHS directly to the child care provider on behalf of an eligible family based upon certifications prepared by the provider either manually or through a telephone verification system. Depending on the provider type, the certifications are subject to periodic monitoring procedures by IDHS or the CCR&R organizations as outlined in the approved State Plan. IDHS also is required to periodically review the monitoring activities performed by the CCR&R organizations. IDHS has not updated its monitoring procedures or frequency for the CCAP program since August 2020.During our testing of CCAP beneficiary payments claimed under the TANF program (40 payments totaling $535 in federal claims and $51,927 in MOE claims) and CCDF (40 payments totaling $7,556 in federal claims and $1,573 in MOE claims), we noted 40 TANF payments and 40 CCDF payments for which IDHS could not provide documentation supporting the services provided to eligible beneficiaries because: • For one payment for the TANF program and one payment for the CCDF Cluster program, the provider was allowed to certify services had been provided using the Illinois Child Care Telephone Billing System instead of using paper certificates to the State. We noted IDHS has not performed a monitoring review in 2025 or either of the previous two fiscal years to ensure billing information provided by the child care providers either in hard copy or through the Illinois Child Care Telephone Billing System is accurate. • For 39 payments for the TANF program and 39 payments for the CCDF Cluster program, the provider is monitored by a CCR&R organization and IDHS does not obtain source documentation for these payments. Rather, IDHS relies on the procedures performed by the CCR&R organizations and performs an on-site review of the CCR&R organizations once every three years. We noted only one of the 16 CCR&R organizations were subject to monitoring procedures during the year ended June 30, 2025. We also noted IDHS does not have adequate controls in place to ensure billing information from providers is accurate and the related child care payments made were appropriate given IDHS does not obtain source documentation (certified attendance records) for child care billings as stated in section 10.1.4(e) of the CCDF State Plan and did not obtain them for our audit procedures. As a result, we have identified these items as unallowable costs which were reported and claimed to federal programs as follows: "See full report for chart/table." Additionally, during our testing of 33 CCDF subrecipient payments (totaling $58,594,511) we noted a payment of $52,702,921 to a subrecipient to advance fund the Smart Start Workforce Grant (SSWG) program. The SSWG program is intended to provide stable, ongoing funds to cover costs and invest in quality without burdening families by raising tuition or co-pays. The advance payment made in September 2024 to the subrecipient was paid from federal award number 2101ILCD6 which had a period of performance from October 1, 2020 through September 30, 2024 (obligation period ended September 30, 2023) and State agreement number FCSDI05951 which had a term of July 1, 2024 through June 30, 2025. IDHS was unable to provide documentation supporting that the subrecipient had expended the advance payment prior to the end of the federal period of performance (9/30/2024) or evidence an extension of the federal period of performance had been extended since the agreement under which this funding was expended was executed after the obligation period ended (9/30/2023). Upon further review, we noted an additional $5,268,079 in subrecipient payments were made under these awards during State fiscal year 2025. Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that each expenditure must be necessary, reasonable, and supported by adequate documentation. Additionally, 45 CFR 98.67 requires lead agencies to expend and account for CCDF funds in accordance with their own laws and procedures, and for fiscal control and accounting procedures to be sufficient to permit the tracing of funds to a level of expenditure adequate to establish that such funds have not been used in violation of those laws and procedures. IDHS CCAP Policy Memo 07.10.01 requires the agency to perform monitoring reviews over all Child Care Resource and Referrals (CCR&Rs), site administered, and non-contracted child care providers who participate in the IDHS Child Care Assistance Program. These reviews are conducted to ensure that services billed to the Department are adequately documented and contractual obligations are fulfilled. Section 10.1.3(b) of the approved CCDF State Plan for federal fiscal years 2025-2027 states the Lead Agency performs random audits of CCDF subrecipients annually where expenditures of CCDF funds are reviewed to ensure they are supported and allowable. Section 10.1.4(e) of the approved CCDF State Plan for federal fiscal year 2025-2027 states billings are supported by legible attendance/sign-in sheets. The OMB Compliance Supplement, dated November 2025, states supplemental funds provided under the American Rescue Plan Act (Public Law No. 117-2) have specific obligation and liquidation timeframes. Obligations must be made by the end of federal fiscal year 2023 (September 30, 2023) and must be liquidated by the end of federal fiscal year 2024 (September 30, 2024). 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should be designed to ensure that supporting documentation for CCAP payments is obtained and maintained. Effective internal controls should also be designed to ensure that billing information provided by providers is complete and accurate. Finally, effective internal controls should also be designed to ensure program funds are obligated and liquidated within required timeframes for each specific CCDF grant award. Cause: In discussing these conditions with IDHS officials, management stated inadequate oversight and monitoring of the period of performance resulted in IDHS not requesting an extension when necessary. IDHS management also stated additional time was necessary to implement corrective action related to the monitoring performed for providers using the telephone billing system. IDHS management stated they disagree with the finding regarding inadequate monitoring procedures for other providers and believe their procedures are consistent with the approved State Plan. Possible Asserted Effect: Failure to maintain documentation supporting CCAP payments and to adequately monitor participating childcare providers increases the risk that funds are expended for unallowable purposes. Failure to obligate and liquidate CCDF funding in accordance with program regulations results in noncompliance with period of performance requirements. These conditions result in unallowable costs for the TANF and CCDF programs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-011. (Finding Code 2025-031, 2024-011, 2023-014). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS strengthen its internal controls to ensure all payments made to CCAP providers are supported by adequate and verifiable underlying documentation. We also recommend IDHS evaluate its criteria for and frequency of monitoring of child care providers to ensure adequate supporting documentation is available for billed services. Furthermore, we recommend IDHS obligate and liquidate CCDF grant funding in accordance with the applicable period of performance. Views of IDHS Officials: The Department partially accepts the recommendation. The Department accepts the recommendation to obligate and liquidate CCDF grant funding within the applicable period of performance and to strengthen internal controls related to CCAP payments. The Department has already begun implementing corrective action. The Department does not agree that an evaluation of the criteria for monitoring childcare providers is necessary. The Department has been and will continue operating in accordance with the federally approved monitoring procedures for fiscal years 2025 through 2027. The Department does not agree with the calculation indicating that 40 CCDF and 40 TANF federal claims were unsupported. Based on the Department’s review, the finding applies to only one unsupported federal claim for TANF and CCDF, and the entire federal grant amount is not impacted. Auditors’ Comment: As discussed in the finding above, IDHS did not provide certified attendance records for any of the CCDF payments sampled in our testing because they rely on supporting organizations to monitor providers and, in turn, monitor those supporting organizations on a cyclical basis (every three years). IDHS has not updated its risk assessments or evaluated the nature and frequency of monitoring processes in response to increased risk in the CCDF Cluster program.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA) U.S. Department of Health and Human Services (USDHHS) Program Name: SNAP Cluster, Temporary Assistance for Needy Families, Children’s Health Insurance Program, Medicaid Cluster ALN and Program Expenditures: 10.551/10.561 ($4,676,894,737), 93.558 ($593,881,225), 93.767 ($583,280,105), 93.775/93.777/93.778 ($20,821,414,891) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Eligibility, Special Tests and Provisions – Penalty for Refusal to Work, Special Tests and Provisions – ADP System for SNAP, Finding 2025-032 Missing Documentation in Beneficiary Files Condition Found: IDHS could not locate case file documentation supporting certain eligibility and special test requirements for beneficiaries of the Temporary Assistance for Needy Families (TANF), Children’s Health Insurance Program (CHIP), and Medicaid Cluster program.The State of Illinois uses a single application and process to determine the eligibility of beneficiaries of the Supplemental Nutrition Assistance Program Cluster (SNAP Cluster), TANF, CHIP, and Medicaid Cluster programs. IDHS is the State agency primarily responsible for performing eligibility determinations for these programs and administers the SNAP Cluster and TANF program activities. The Illinois Department of Healthcare and Family Services (DHFS) is the State Medicaid agency and is responsible for administering the CHIP and Medicaid Cluster program activities. IDHS and DHFS work together to develop policies and maintain the information systems involved in the administration of SNAP Cluster, TANF, CHIP, and Medicaid Cluster programs. During our test work, we selected 50 TANF, 60 CHIP, and 120 Medicaid Cluster program eligibility files to review for compliance with eligibility requirements and for the allowability of the related benefits provided. We also selected 40 Penalty for Refusal to Work (Refusal to Work) and 40 Child Support Non-Cooperation beneficiaries to review for compliance with the respective special test and provision requirements. We noted the following exceptions: In six of 50 TANF cases (with payments sampled of $3,765), IDHS could not provide the completed Responsibility Service Plan (RSP) signed by the beneficiary for the period covering the payment date. Total TANF cash assistance paid to these beneficiaries during the year ended June 30, 2025 totaled $27,179. In five of 40 TANF Child Support Non-Cooperation cases, IDHS could not provide evidence of a sanction, or supporting documentation of actions performed by DHS. TANF cash assistance paid to these beneficiaries during the year ended June 30, 2025 totaled $36,624. In seven of 40 TANF Refusal to Work special test cases, IDHS could not provide evidence that a Responsibility Service Plan (RSP) was obtained and signed by the beneficiary for the applicable benefit period. TANF cash assistance paid to these beneficiaries during the year ended June 30, 2025 totaled $44,946. For one Medicaid case (with a sampled payment of $468), the beneficiary was initially determined to be an eligible non-citizen due to an asylum claim; however, documentation supporting the asylum claim could not be provided by the IDHS or DHFS. The beneficiary was later determined to be ineligible for medical benefits and was identified as such in the Integrated Eligibility System (IES); however, the case remained eligible in the Medicaid Management Information System (MMIS). Medical benefits paid on behalf of this beneficiary during the year ended June 30, 2025 totaled $5,699. For one Medicaid case (with a sampled payment of $9,735), documentation was not available in the case file to substantiate the individual was eligible for federal Medicaid benefits. Case file documentation evidenced the individual was a non-citizen Victim of Trafficking, Torture, or Other Serious Crimes and was not eligible for federal Medicaid benefits, but may have been eligible for State funded medical benefits. Medical benefits paid on behalf of this beneficiary and claimed to the Medicaid Cluster program during the year ended June 30, 2025 totaled $32,898. For two Medicaid cases (with sampled payments of $309), an income test was not performed due to the misapplication of a COVID-19 override of the redetermination requirement. Medical benefits paid on behalf of these beneficiaries during the year ended June 30, 2025 totaled $73,478. For one CHIP case (with a sampled payment of $1,700), although the case record identified eligibility ended in October 2024, benefits continued to be paid on behalf of this individual for medical services provided subsequent to this date. Medical benefits paid on behalf of this beneficiary during the year ended June 30, 2025 totaled $31,979. Details of the beneficiary payments selected in our samples for the TANF, CHIP, and Medicaid Cluster programs are as follows: "See full report for chart/table." We also noted the State does not have adequate resources to perform and document eligibility determinations. Additionally, the State has not established appropriate monitoring procedures to ensure eligibility determinations are properly documented in accordance with program requirements. Because the State uses a single application and eligibility determination process for the SNAP Cluster, TANF, CHIP, and Medicaid Cluster programs, the TANF, CHIP, and Medicaid Cluster eligibility compliance exceptions and the inadequate internal control matters discussed above also impact the SNAP Cluster program. Details of the beneficiary payments paid by the State during the year ended June 30, 2025 for the SNAP Cluster, TANF, CHIP, and Medicaid Cluster programs are as follows: "See full report for chart/table." Criteria or Requirement: According to 42 USC 602(a)(1)(B)(iii) (the State Plan for TANF), IDHS is required to determine client eligibility in accordance with eligibility requirements defined in the approved State Plans. The TANF State Plan amended December 2022, Section L Personal Responsibility, requires all adults and minor parents applying for or receiving assistance be required to sign a RSP and follow through with its provisions. The TANF State Plan also required an application to be completed to apply for assistance. For refusal to work, the State must reduce or terminate the assistance payable to the family if an individual in a family receiving assistance refuses to work, subject to any good cause or other exemptions established by the State (42 USC 609(a)(14); 45 CFR sections 261.14, 261.16, and 261.54). 42 USC 608(a)(2) states that if the State determines that an individual is not cooperating with the State in establishing paternity or in establishing, modifying, or enforcing a support order with respect to a child of the individual, the State will deduct part of the assistance that would otherwise be provided to the family, or may deny the family any assistance under the State program. In accordance with 42 CFR 435.948 through 435.956 and the OMB Compliance Supplement, dated November 2025, the State is required to verify financial and nonfinancial factors of eligibility in accordance with eligibility requirements defined in the approved State Plans for the CHIP and Medicaid programs. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include maintaining adequate controls over beneficiary case files to ensure all required documentation is obtained, and appropriate sanctions applied. Cause: In discussing these conditions with IDHS officials, they stated the exceptions noted were related to TANF RSPs completed by telephone and a process requiring staff to send a copy to the beneficiary to obtain a manual signature. Furthermore, IDHS management indicated that implementation of prior year corrective action plans for system enhancements was delayed because of competing priorities resulting from Federal House Resolution 1 which required benefit changes and greatly impacted the timing of eligibility system enhancements. Possible Asserted Effect: Failure to establish robust eligibility controls and maintain required documentation (such as applications, RSPs, and verification records) results in federal noncompliance. This increases the risk that benefits are paid to ineligible beneficiaries, resulting in questioned, unallowable costs for the SNAP Cluster, TANF, CHIP, and Medicaid Cluster programs. Furthermore, the lack of coordination between IES and MMIS databases prevents the timely termination of benefits for ineligible individuals. Repeat Finding: A similar finding was reported in prior year audit as finding number 2024-009. (Finding Code 2025-032, 2024-009, 2023-007, 2022-005, 2021-011, 2020-010, 2019-005, 2018-004, 2017-004, 2016-004, 2015-004, 2014-004, 2013-004, 12-04, 11-04, 10-06, 09-06, 08-08, 07-19, 06-16, 05-30, 04-18, 03-20, 02-26, 01-15) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for collecting and maintaining SNAP Cluster/TANF/CHIP/Medicaid Cluster eligibility support and documentation to support the appropriate TANF application of sanctions. Views of IDHS Officials: The Department accepts the recommendation. IDHS will work to ensure that support for all eligibility items is properly retained in the record. Improved collection and retention of eligibility items will be achieved through IES enhancements and through implementation of quarterly administrative reviews of TANF cases to track trends and address any issues identified.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families ALN and Program Expenditures: 93.558 ($593,881,225) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $240,573 Compliance Requirement: Eligibility Finding 2025-033 Improper TANF Beneficiary Payments Condition Found: IDHS made improper payments to beneficiaries of the Temporary Assistance for Needy Families (TANF) program. During our testing of 50 TANF program beneficiary payments (with total payments sampled of $24,885), we noted one beneficiary (with a sampled payment of $674) incorrectly included an ineligible child in the standard payment determination. As a result of the determination error, the beneficiary received incorrect beneficiary payments. The full standard payment used was $1,067, when the correct full standard payment that should have been used was $910. This resulted in an overpayment to the beneficiary of $157. Total payments made to this beneficiary under the TANF program totaled $4,294 during the year ended June 30, 2025. We also noted one TANF beneficiary payment sampled (totaling $307) that was improperly calculated due to a diverted income system error. Diverted income occurs in dependent eligible only TANF cases where an ineligible working adult in the household has income which is allocated to the eligible members of the household to determine the overall TANF program benefit payment. The State’s benefit system was erroneously excluding the ineligible working adult in the diverted income calculation potentially resulting in an overpayment of TANF benefits on cases with diverted income. As a result of this error, the monthly payment made to this one beneficiary was overstated by $52. Total payments made to this one beneficiary under the TANF program were $1,798 for the year ended June 30, 2025. In response to the error identified in our testing, IDHS identified benefit payments paid during the year ended June 30, 2025 for 732 beneficiaries (totaling $1,124,389) were calculated using diverted income. The system calculation error related to these benefit payments resulted in total TANF overpayments of $240,573 during the year ended June 30, 2025. The payment errors identified above had not been corrected by IDHS or refunded to USDHHS (if required) as of the date we communicated our findings to IDHS (August 27, 2026). We further noted IDHS did not establish control procedures at an adequate level of precision to ensure TANF program benefits were accurately calculated based on the beneficiary’s case file supporting documentation. Payments made to beneficiaries of the TANF cash assistance program totaled $51,125,066 during the year ended June 30, 2025. Criteria or Requirement: 2 CFR 200.403 establishes principles and standards for determining costs for federal awards carried out through grants, cost reimbursement contracts, and other agreements with state and local governments. To be allowable under federal awards, costs must meet certain general criteria. Those criteria require, among other things, that each expenditure must be necessary, reasonable, and supported by adequate documentation. In accordance with the OMB Compliance Supplement, dated November 2025, IDHS is required to determine eligibility in accordance with eligibility requirements defined in the approved State Plan. The current State Plan requires payments to be made to eligible beneficiaries in accordance with payment levels established within the State Plan. Further, the State Plan requires an excluded or ineligible individual’s income to be considered in the calculation of the payment level of the TANF unit. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing internal control at an appropriate level of precision to identify and correct benefit payment errors in a timely manner. Cause: In discussing these conditions with IDHS officials, management stated the exceptions noted were due to not securing or uploading supporting documentation adequately and case actions not being thoroughly reviewed. Furthermore, IDHS management indicated that implementation of prior year corrective action plans for system enhancements was delayed because of competing priorities resulting from Federal House Resolution 1 which required benefit changes and greatly impacted the timing of eligibility system enhancements. Possible Asserted Effect: Failure to properly calculate benefit payments may result in unallowable costs being charged to the TANF program. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-010. (Finding Code 2025-033, 2024-010, 2023-016) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for calculating beneficiary payments and consider changes necessary to ensure payments are properly calculated and paid. Views of IDHS Officials: The Department accepts the recommendation. IDHS will review its current process for calculating beneficiary payments and make changes necessary to ensure payments are properly calculated and paid. Temporary Assistance for Needy Families (TANF) training was provided in 2026 to address policies and procedures. Additionally, monthly communications have been established by the Associate Director for the Office of Family and Community Resource Centers (FCRCs) to ensure TANF reviews are prioritized and findings are addressed. Finally, agency leadership has scheduled needed system enhancements.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA) U.S. Department of Health and Human Services (USDHHS) Program Name: WIC Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 10.557 ($211,116,030), 93.558 ($593,881,225), 93.575/93.596 ($424,695,722) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Activities Allowed/Unallowed Allowable Costs/Cost Principles Special Test and Provision – Written Agreements as Part of Program, Integrity and Accountability Finding 2025-034 Inadequate Process for Monitoring Interagency Program Expenditures Condition Found: IDHS does not have an adequate process for monitoring interagency expenditures claimed under or used to meet maintenance of effort (MOE) requirements of the WIC Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Temporary Assistance for Needy Families (TANF) and CCDF Cluster (CCDF) programs. Federal and State expenditures under the WIC, TANF and CCDF Cluster programs are comprised of programs operated by various State agencies. As the State agency responsible for administering these programs, IDHS has executed interagency agreements with each of the State agencies expending federal and/or State program funds. The interagency agreements require periodic reporting of a summary of the agency’s “allowable” expenditures to IDHS for preparation of the financial reports required for each program. As the State agencies expending program funds do not determine under which program IDHS reports their expenditures, IDHS is responsible for establishing procedures to ensure the expenditures reported by the expending State agencies meet the specific requirements applicable to the federal program. During the year ended June 30, 2025, IDHS reported expenditures from other agencies that were claimed for reimbursement or used to meet MOE requirements as follows: "See full report for chart/table." IDHS’ procedures to monitor other State agencies expending program funds reported by IDHS include the following: Interagency agreements were reviewed and updated (where necessary) to include all State programs claimed under or used to meet MOE requirements of the WIC, TANF and CCDF Cluster programs in its interagency agreement. Program questionnaires were updated where necessary and distributed to each of the State agencies to assist in documenting the nature of the expenditures provided to IDHS and the internal controls established to ensure compliance with the applicable federal regulations. Quarterly certification reports were collected from each of the State agencies to support amounts reported in the federal reports required for each federal program. Expenditure details were obtained from each of the State agencies and were reconciled to the quarterly certifications. However, during our test work over the documentation of the monitoring procedures discussed above, we noted the following deficiencies: Program questionnaires describing internal control procedures for the WIC and CCDF programs were not obtained by IDHS from the Illinois Department of Healthcare and Family Services, Illinois Student Assistance Commission, Illinois Board of Higher Education, and Illinois Community College Board. Rather, for the CCDF program passthroughs a more limited questionnaire was obtained in the State's Grant Accountability and Transparency Act (GATA) Audit Report Review Management System (ARRMS) which is used to complete risk assessments procedures for the State’s subrecipients. Quarterly certification reports were not prepared during the period for the WIC, CCDF, and TANF programs by the Illinois Department of Healthcare and Family Services, Illinois Student Assistance Commission, Illinois Board of Higher Education, Illinois Department of Children and Family Services, and Illinois Community College Board. IDHS did not perform a detailed review of costs claimed from expenditures reported by any of the other State agencies to ensure they met the specific program requirements. The other State agencies do not necessarily know which federal program or maintenance of effort requirement the costs they are providing to IDHS will be claimed or used and are not able to assess whether the costs are allowable. Further, IDHS did not assess whether the expenditures reported by other State agencies were paid during State fiscal year 2025 to ensure the amounts reported to the Illinois Office of Comptroller (IOC) and used to prepare the schedule of expenditures of federal awards (SEFA) were cash basis expenditures. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statement which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with IDHS officials, management stated that the current monitoring process was not adequate to ensure interagency expenditures and MOE of federal monies from other State agencies met applicable program regulations as they relate to WIC, TANF, and CCDF. Possible Asserted Effect: Failure to properly monitor interagency expenditures may result in claiming of expenditures that are inconsistent with the objectives of the federal program and federal funds being expended for unallowable purposes. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-006. (Finding Code 2025-034, 2024-006, 2023-017) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its current process for identifying and reporting interagency expenditures and implement monitoring procedures to ensure that federal and state expenditures expended by other State agencies meet the applicable program regulations.Views of IDHS Officials: The Department accepts the recommendation. IDHS will establish additional monitoring procedures, including sampling interagency expenditures and reviews of support documentation to ensure expenditures related to federal grants (including those made by other agencies and those made to subrecipients) are accurately reported in accordance with federal program requirements.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse, ALN and Program Expenditures: 93.558 ($593,881,225), 93.575/93.596, ($424,695,722), 93.667 ($53,464,167), 93.959 ($102,558,387) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Subrecipient Monitoring Finding 2025-035 Failure to Follow Established Program Subrecipient Monitoring Procedures Condition Found: IDHS did not follow its established program monitoring policies and procedures for subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care Development Fund Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. IDHS has implemented procedures whereby program staff perform periodic program on-site and desk reviews of IDHS subrecipient compliance with regulations applicable to the federal programs administered by IDHS. IDHS also has implemented procedures whereby staff perform periodic on-site and desk reviews of IDHS subrecipient compliance with fiscal and administrative requirements applicable to multiple State and federal programs. Generally, these reviews are formally documented and include the issuance of a report of the review results to the subrecipient summarizing the procedures performed, results of the procedures, and any findings or observations for improvement noted. IDHS’s policies require the subrecipient to respond to each finding by providing a written corrective action plan. Additionally, IDHS program staff perform reviews of expenditure reports submitted by subrecipients. IDHS subrecipient monitoring procedures are subject to the review and approval of a supervisor. During our test work over program on-site review procedures performed for 81 subrecipients of the TANF, CCDF, SSBG, and SAPT programs, we noted IDHS did not follow its established program monitoring procedures as follows: We tested the program on-site review procedures and fiscal administrative review procedures performed by IDHS during the year ended June 30, 2025 for a sample of subrecipients of the TANF, CCDF, SSBG, and SAPT programs comprised of the following: "See full report for chart/table." We noted the following exceptions in our testing of program on-site reviews performed during the year ended June 30, 2025: IDHS did not perform on-site monitoring reviews of subrecipients in fiscal year 2025 in accordance with IDHS’ planned monitoring schedule and/or could not provide support for the review. Specifically, we noted the following exceptions: "See full report for chart/table." IDHS did not provide timely notification (within 60 days) of the results of the programmatic on-site reviews. We noted the following exceptions: "See full report for chart/table." IDHS did not complete their quality review on a timely basis (within 60 days). We noted the following exceptions: "See full report for chart/table." IDHS did not receive a corrective action plan from the subrecipient after findings were identified during the review. We noted the following exceptions: "See full report for chart/table." IDHS personnel were unable to provide support for management review of the program review tool. We noted the following exceptions: "See full report for chart/table." In addition, we noted the SAPT program requires subrecipients to submit periodic reports to allow IDHS to monitor certain programmatic performance metrics. These reports are reviewed quarterly by IDHS program personnel. Any subrecipients who meet less than 80% of the performance metrics reported are also required to submit a corrective action plan to IDHS. During our testing, we noted IDHS was unable to provide documentation evidencing monitoring of the quarterly program reports as follows: "See full report for chart/table." We also noted for one subrecipient tested under the CCDF Cluster (with expenditures of $707,862), the IDHS monitoring review documented an income calculation error within its sample of child care subsidy payments. While IDHS asserted the error did not affect the beneficiary’s underlying eligibility for services or the final subsidy amount paid, IDHS failed to perform a root cause analysis or expand its sample size to evaluate the potential financial impact and prevalence of errors across the broader population. Further, IDHS did not have adequate policies or procedures to ensure fiscal and administrative reviews were completed timely to detect potential non-compliance. Criteria or Requirement: According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. According to 2 CFR 200.332(c), a pass-through entity must evaluate each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include ensuring on-site program procedures and expenditure reviews are performed in a timely manner and adequate documentation is maintained. Cause: In discussing these conditions with IDHS officials, they stated the deficiencies identified result from a combination of factors including operational constraints due to staffing, oversight, system transitions, and a need to strengthen governance over timeliness, monitoring, and documentation controls. Furthermore, management indicated that implementation of prior year corrective action plans was delayed as a result of these factors. Possible Asserted Effect: Failure to adequately perform and document program on-site monitoring reviews of subrecipients and notify subrecipients of findings in a timely manner may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Failure to properly review subrecipient expenditures may result in inaccurate payments or unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-007. (Finding Code 2025-035, 2024-007, 2023-010, 2022-008, 2021-017, 2020-015, 2019-013, 2018-012, 2017-013, 2016-012, 2015-011, 2014-008, 2013-009, 12-07, 11-09) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS ensure programmatic on-site and expenditure report reviews are performed and documented for subrecipients in accordance with established policies and procedures. In addition, we recommend IDHS review its process for reporting and following up on program findings relative to subrecipient on-site reviews to ensure timely corrective action is taken. Views of IDHS Officials: The Department accepts the recommendation. IDHS will work to ensure programmatic on-site and expenditure report reviews are completed and documented in accordance with policies and procedures and will review its process for reporting and follow up on program findings resulting from on-site reviews. IDHS will continue to work to fill vacancies, administer training programs, increase oversight, develop automated processes, implement tracking tools, and review and revise procedures to improve internal controls over these functions.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse, ALN and Program Expenditures: 93.558 ($593,881,225), 93.575/93.596 ($424,695,722), 93.667 ($53,464,167), 93.959 ($102,558,387) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2025-036 Failure to Report Subaward Information Required by FFATA Condition Found: IDHS failed to report information required by the Federal Funding Accountability and Transparency Act (FFATA) for awards granted to subrecipients of the Temporary Assistance for Needy Families (TANF), Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. The State is required to report certain identifying information related to awards made to subrecipients in amounts greater than or equal to $30,000. Of the information required to be reported, the following key data elements are required to be audited: 1. Subawardee Name 2. Subawardee Unique Entity Identifier 3. Amount of subaward 4. Subaward obligation or action date 5. Date of report submission 6. Subaward number 7. Subaward project description 8. Subawardee names and compensation of highly compensated officers During our testing, we noted that IDHS did not establish control procedures to submit FFATA reports for all subawards as required by federal regulations. During our testing of 81 subawards and 41 amendments (which included 239 FAINs that were subject to FFATA reporting requirements), we noted the following exceptions: "See full report for chart/table." Additionally, we noted FFATA reporting was not submitted for 22 (totaling $19,232,126) and 17 (totaling $8,205,622) subawards/amendments executed for th+e SAPT and SSBG programs, respectively, during the year ended June 30, 2025. IDHS’s subrecipient expenditures under the federal programs for the year ended June 30, 2025 were as follows: "See full report for chart/table." Criteria or Requirement: In accordance with 2 CFR 170.200, Federal awarding agencies are required to publicly report Federal awards that equal or exceed the micro-purchase threshold and publish the required information on a public-facing, OMB-designated, governmentwide website and follow OMB guidance to support Transparency Act implementation. Consistent with the Federal Acquisition Register (FAR) threshold for subcontract reporting, OMB raised the reporting threshold for subawards that equal or exceed $30,000. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures designed to ensure FFATA reporting is completed in accordance with federal requirements. Cause: In discussing these conditions with IDHS officials, they stated FFATA reports could not be submitted until federal agencies published the awards and transmitted information to FSRS/SAM.gov. The reporting of incorrect signature dates is due to a periodic delay between the day the contract is signed and the day the contract is recorded in the State’s financial records. IDHS management also stated they noted processing errors related to the transition between FSRS and SAM.gov. Possible Asserted Effect: Failure to identify awards subject to FFATA and to report subawards in accordance with FFATA results in noncompliance with federal requirements. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-013. (Finding Code 2025-036, 2024-013, 2023-009, 2022-007, 2021-014, 2021-015) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to identify awards subject to FFATA reporting requirements and report required subaward information in accordance with the FFATA. Views of IDHS Officials: The Department accepts the recommendation. The Office of Contract Administration (OCA) staff coordinated with IDHS Fiscal Services, Bureau of Federal Reporting staff and the Illinois Department of Innovation and Technology (DoIT) staff in 2025 to create an Application Programming Interface (API) between the IDHS grant making system and the IDHS accounting system to perform a coding validation look-up that auto- populates the award coding information which is designed to eliminate end user manual entry errors.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA) U.S. Department of Health and Human Services (USDHHS) Program Name: WIC Special Supplemental Nutrition Program for Women, Infants, and Children, Temporary Assistance for Needy Families, Child Care Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse ALN and Program Expenditures: 10.557 ($211,116,030), 93.558 ($593,881,225), 93.575/93.596 ($424,695,722), 93.667 ($53,464,167), 93.959 ($102,558,387) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Subrecipient Monitoring Finding 2025-037 Inadequate Process to Communicate Award Information to Subrecipients Condition Found: IDHS does not have an adequate process in place to ensure required award information is accurately communicated to subrecipients of the WIC Special Supplemental Nutrition Program for Women, Infants, and Children (WIC), Temporary Assistance for Needy Families (TANF), Child Care Development Fund Cluster (CCDF), Social Services Block Grant (SSBG), and Block Grants for Prevention and Treatment of Substance Abuse (SAPT) programs. IDHS is responsible for coordinating program funding across several Federal and State programs through its program and administrative divisions, bureaus, and offices. While IDHS uses a standard contract document for its agreements with subrecipients, the specific award information is manually input into each contract by program contracting personnel. During our testing of WIC, TANF, CCDF, SSBG, and SAPT subrecipient contracts under which federal funds were expended during the year ended June 30, 2025, we noted IDHS did not accurately communicate all required information to its subrecipients. Specifically, we noted the award communication included incorrect details as follows: "See full report for chart/table." We noted the review of contract documents did not include verifying the FAIN and ALN agreed to award documents between the State and the respective federal agencies. While the instances of noncompliance identified in this finding only pertain to CCDF, SSBG, and SAPT, we noted the processes and deficient internal control pertain to contracts for all of IDHS’ major programs with subrecipient expenditures. Details of the subrecipient payments selected in our samples are as follows: "See full report for chart/table." Criteria or Requirement: According to 2 CFR 200.332(b), a pass-through entity is required to identify Federal awards made by informing each subrecipient of required information. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures in place to ensure required information is properly communicated. Cause: In discussing these conditions with IDHS officials, management stated that the exceptions noted are due to inaccuracies in the manual entry of subawards. Additionally, not all awards were being identified through the existing information process flow. Possible Asserted Effect: Failure to communicate required award information may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-037) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS implement additional procedures to ensure award information communicated to subrecipients is reviewed for completeness and accuracy. Views of IDHS Officials: The Department accepts the recommendation. The Office of Contract Administration (OCA) staff coordinated with IDHS Fiscal Services, Bureau of Federal Reporting staff and the Illinois Department of Innovation and Technology (DoIT) staff in 2024 and 2025 to create an Application Programming Interface (API) between the IDHS grant making system and the IDHS accounting system to perform a coding validation look-up that autopopulates the award coding information which is designed to eliminate end user manual entry errors.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Child Care and Development Fund (CCDF) Cluster ALN and Program Expenditures: 93.575/93.596 ($424,695,722) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Finding 2025-038 Failure to Monitor Child Care Provide Health and Safety Requirements IDHS did not perform monitoring reviews of health and safety requirements for providers of the Child Care Development Fund Cluster (CCDF) program. As a condition of receiving CCDF Cluster funding, IDHS is required to certify procedures are in place to ensure child care providers comply with all applicable health and safety requirements. Such requirements include prevention and control of infectious diseases, building and physical premises safety, and basic health and safety training for providers. IDHS’ procedures require health and safety monitoring reviews to be performed on an annual basis. During our review of 40 providers (with child care expenditures totaling $15,160,676), we noted a health and safety monitoring review was not performed for three providers sampled (with expenditures totaling $19,190) during the year ended June 30, 2025. We also noted IDHS has not established monitoring or other control activities to ensure health and safety monitoring reviews are performed for all child care providers as required by State and Federal law. Additionally, as of the date of our testing, IDHS has not evaluated the population of providers to determine if there are other providers for which reviews were not performed. Amounts passed through to CCDF Cluster program providers totaled $256,601,418 during the year ended June 30, 2025. Criteria or Requirement: In accordance with 45 CFR 98.41, the State is required to certify that there are monitoring and enforcement requirements designed to protect the health and safety of children that apply to child care providers receiving federal funding. In accordance with 45 CFR 98.42, the State is also required to certify it has monitoring policies and practices applicable to all child care providers and facilities eligible to deliver services for which assistance is provided. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal Award that provides reasonable assurance that the non-Federal entity is managing the Federal Award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures in place to ensure child care providers are monitored for health and safety requirements as required under State and Federal law. Cause: In discussing these conditions with IDHS officials, management stated that a shortage of staffing resources resulted in the Department’s inability to complete the required annual compliance visits. Furthermore, management stated that monitoring and process oversight improvements are still needed to ensure timely monitoring of providers. Possible Asserted Effect: Failure to monitor compliance with State health and safety requirements results in noncompliance with federal regulations. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-038) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review its process for monitoring childcare provider compliance with State health and safety requirements and implement the changes necessary to ensure required monitoring is performed. Views of IDHS Officials: The Department accepts the recommendation. Staffing capacity for the Department has been increased. Since May 2025, the Department has increased staffing and management capacity. As of August 26, 2026, the Department has onboarded eight managers and plans to hire five additional licensing representatives and one additional manager by early 2027. Additionally, as of July 1, 2026, this program has transitioned to the Illinois Department of Early Childhood (IDEC), and IDHS understands that IDEC is continuing efforts to fill remaining vacancies. IDHS (and now IDEC) have revised policies and procedures and associated training and have implemented additional monitoring and oversight tools to track and monitor inspections to ensure inspections are conducted timely and in compliance with requirements.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Temporary Assistance for Needy Families ALN and Program Expenditures: 93.558 ($593,881,225) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Reporting Finding 2025-039 Inaccurate Annual TANF ACF-204 Special Report Condition Found: IDHS does not have an adequate process in place to ensure the ACF-204, Annual special report for the Temporary Assistance for Needy Families (TANF) program is complete and accurate. IDHS is required to prepare the ACF-204, Annual Report including the Annual Report on State Maintenance-of-Effort Programs for the program year. During our testing over the TANF ACF-204 special report for the federal fiscal year ending September 30, 2024, we noted IDHS inaccurately reported the following key line item: "See full report for chart/table." We also noted IDHS does not perform analytical or other procedures during the report preparation process to ensure amounts reported are reasonable in relation to previously reported information or expectations relative to current program activities. Additionally, supervisory review procedures are not designed to operate at a level of precision to identify errors of this nature. Criteria or Requirement: According to 45 CFR 265.9(a), the State must file an annual report containing information on the TANF program and the State’s MOE program(s) for that year. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure required program data is accurately reported in the special reports. Cause: In discussing these conditions with IDHS officials, management stated that the error identified on the ACF-204 report occurred due to a lack of oversight in obtaining all required monthly reports from the Illinois Department of Healthcare and Family Services. Possible Asserted Effect: Failure to prepare accurate special reports prevents USDHHS from effectively monitoring the TANF program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-039) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS review the process and procedures for preparing ACF-204 reports required for the TANF program and implement analytical and other procedures necessary to ensure the reports are complete and accurate prior to submission to USDHHS. Views of IDHS Officials: The Department accepts the recommendation. IDHS will implement additional controls to ensure the data is obtained, compiled, and reviewed to ensure complete and accurate reporting on the ACF-204.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Social Services Block Grant ALN and Program Expenditures: 93.667 ($53,464,167) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Reporting Finding 2025-040 Inadequate Procedures to Determine Accuracy of the Post Expenditure Report Condition Found: IDHS did not maintain or provide supporting documentation for the post-expenditure report including a key line item, the number of eligible individuals who received services paid for in part or in whole with federal funds under the Social Services Block Grant (Title XX) program. During our testing of the 2024 post-expenditure report, we noted the total individuals served was reported as 1,712,187. This line item represents services provided by various departments and third parties. In reviewing the summary schedule used to support these line items, we noted supporting documentation was not available to identify the individuals served for certain line items or did not match the individuals reported on the summary schedule. As a result, testing a sample of individuals to verify the individual was eligible for the service received could not be performed. We noted the following exceptions in our testing of the 2024 post-expenditure report: "See full report for chart/table." Effective internal controls have not been established to ensure supporting documentation is maintained for data reported in the post-expenditure report key line items. Criteria or Requirement: 42 USC 1397e requires states to submit to the federal administering agency an annual post-expenditure report. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective controls include implementing a formalized methodology and retaining verifiable documentation to ensure that reports submitted to federal agencies are complete, accurate, and properly supported. Cause: In discussing these conditions with IDHS officials, management stated uniform procedures for quarterly reporting, tracking and submitting client identifying information had not been established. Possible Asserted Effect: Failure to maintain adequate documentation to support the post-expenditure report constitutes non-compliance with federal regulations and prevents IDHS from demonstrating its accountability for federal funds and the eligibility of individuals served. These conditions also prevent USDHHS properly monitoring program activities and effectiveness and may result in disallowance of program expenditures. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-008. (Finding Code 2025-040, 2024-008, 2023-006) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to maintain documentation supporting the post-expenditure report. IDHS should also establish supervisory review procedures to ensure the report is complete, accurate, and properly supported. Views of IDHS Officials: The Department accepts the recommendation. IDHS has established uniform procedures to ensure the maintenance of documentation supporting the post-expenditure report. Additionally, IDHS will establish a supervisory review process to ensure the report is complete, accurate, and properly supported.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Education (USDE) Program Name: Rehabilitation Services – Vocational Rehabilitation Grants to States ALN and Program Expenditures: 84.126A ($157,890,252) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Reporting Finding 2025-041 Inaccurate RSA-911 Performance Reports for the Vocational Rehabilitation Program Condition Found: IDHS does not have an adequate process in place to ensure the Case Service Report (RSA-911) performance report for the Rehabilitation Services Vocational Rehabilitation Grants to States (Vocational Rehabilitation) program is complete and accurate. IDHS is required to prepare the Case Service Report (RSA 911) on a quarterly basis to report data on open Vocational Rehabilitation program cases to the USDE. The key line items are as follows: the date of application (element 7), the date of eligibility determination (element 38), date of initial individualized plan for employment (IPE) (element 398), start date of employment in primary occupation (element 350), Employment outcome at exit (element 356), date of exit (element 353), and the hourly wage at exit (element 359). This data is maintained in Vocational Rehabilitation beneficiary case files. During our testing of the Vocational Rehabilitation Case Service Reports (RSA-911) prepared and submitted during the year ended June 30, 2025, we noted the Start Date of Employment in Primary Occupation (element 350) reported for three of the 25 cases tested did not agree to data documented in the program beneficiary case file. We further noted the supervisory review procedures performed for this report were not designed to operate at an appropriate level of precision to ensure the special report was accurately prepared. Criteria or Requirement: In accordance with 34 CFR 361.47 the State must maintain a record of services for each application and eligible individual. This record must include if the employment outcome has been achieved, and maintained, by the individual. Also, 34 CFR 361.40 requires the State to report several data elements in accordance with the Workforce Innovation and Opportunity Act. In addition, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain internal control over the Federal Award that provides reasonable assurance that the non-Federal entity is managing the Federal Award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure information reported in required financial reports is accurate. Cause: In discussing these conditions with IDHS officials, management stated an inaccurate report query used for the Case Service Report resulted in the identified discrepancies with the program beneficiary case file. Possible Asserted Effect: Failure to prepare accurate performance reports prevents the USDE from effectively monitoring the Vocational Rehabilitation program. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-041) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS implement more precise review procedures to ensure the reports submitted to the USDE are complete, accurate, and agree to the case management system and underlying case file documentation. Views of IDHS Officials: The Department accepts the recommendation. The Department has adjusted the report query for obtaining the information needed for reporting from the case management system to ensure that the information is accurate and agrees to data documented in the program beneficiary case file. Additionally, the Department will implement a quarterly review process to ensure reports submitted are complete, accurate, and agree with the case management system and underlying file documentation.

State Agency: Illinois Department of Human Services (IDHS) Federal Agency: U.S. Department of Agriculture (USDA), U.S. Department of Education (USDE), U.S. Department of Health and Human Services (USDHHS), U.S. Social Security Administration (USSSA), Program Name: Supplemental Nutrition Assistance Program Cluster Special Supplemental Nutrition Program for Women, Infants, and Children, Food Distribution Cluster, Rehabilitation Services – Vocational Rehabilitation, Temporary Assistance for Needy Families, Child Care and Development Fund (CCDF) Cluster, Social Services Block Grant, Block Grants for Prevention and Treatment of Substance Abuse, Disability Insurance/SSI Cluster ALN and Program Expenditures: 10.551/10.561 ($4,676,894,737), 10.557 ($211,116,030), 10.565/10.568/10.569 ($50,371,063), 84.126A ($157,890,252), 93.558 ($593,881,225), 93.575/93.596 ($424,695,722), 93.667 ($53,464,167), 93.959 ($102,558,387), 96.001/96.006 ($79,315,142) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: None Finding 2025-042 Inaccurate Reporting of Federal Expenditures Condition Found: IDHS did not accurately report Federal expenditures, including amounts provided to subrecipients, under the Supplemental Nutrition Assistance (SNAP) Cluster, WIC Special Supplemental Nutrition for Women, Infants, and Children (WIC) programs, Food Distribution Cluster (FDC), Vocational Rehabilitation (VR), Temporary Assistance for Needy Families (TANF), Child Care Development Funds (CCDF) Cluster, Social Services Block Grants (SSBG), Block Grants for Prevention and Treatment of Substance Abuse (SAPT), and Disability Insurance/SSI (SSDI) Cluster. Federal expenditures, including amounts provided to subrecipients, reported to the Illinois Office of Comptroller (IOC) which were used to prepare the schedule of expenditure of federal awards (SEFA) did not agree to IDHS’ financial records provided for audit. Specifically, we noted the following differences between amounts provided for audit by IDHS and the SEFA amounts reported to the IOC for each program for the year ended June 30, 2025: "See full report for chart/table." The following differences were also identified relative to amounts provided to subrecipients for the following major programs: "See full report for chart/table." Additionally, we noted the cash basis expenditures provided by IDHS for our audit procedures included accrued (not paid) expenditures. We also noted these same amounts were reported to the IOC and were used to prepare the SEFA. Specifically, we noted expenditures that were not paid as of June 30, 2025, were erroneously reported as cash basis expenditures for the year ended June 30, 2025: "See full report for chart/table." We also noted the interagency expenditures provided by IDHS for our audit procedures included out of period expenditures. These same amounts were reported to the IOC and were used to prepare the SEFA. Specifically, we noted TANF Emergency Assistance (EA) payments which were claimed in fiscal year 2025 but reported in fiscal year 2024 totaling $14,742,262, and we noted EA payments which were claimed in fiscal year 2026 but were reported in fiscal year 2025 totaling $14,849,458. The net impact is an overstatement of TANF expenditures of $107,196 for the year ended June 30, 2025. Finally, we noted IDHS’ controls over reporting federal expenditures were not designed at a sufficient level of precision to ensure complete and accurate reporting in a timely manner. Criteria or Requirement: According to 2 CFR 200.510(b), a recipient of federal awards is required to prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the entity’s financial statement which must include the total Federal awards expended as determined in accordance with 2 CFR 200.502. Among other things required by 2 CFR 200.510(b), the SEFA must include the total amount provided to subrecipients from each Federal program. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are accurately reported on the SEFA and to other State agencies, where applicable. Cause: In discussing these conditions with IDHS officials, they stated the differences in the amounts of federal expenditures and amounts passed through to subrecipients in IDHS’ records compared to the SEFA were due to inclusion of accrued expenditures in IDHS’ records and/or some slight differences related to vouchers in transit at the end of the fiscal year. Also, IDHS’ records for one federal grant program did not initially include non-cash expenditures which had been reported on the SEFA. Possible Asserted Effect: Failure to accurately report federal expenditures impedes the completion of an audit in accordance with the Uniform Guidance which may result in the suspension of federal funding. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-014. (Finding Code 2025-042, 2024-014, 2023-012, 2022-010) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend IDHS establish procedures to accurately report federal expenditures (including subrecipient expenditures) used to prepare the SEFA to the IOC. Views of IDHS Officials: The Department accepts the recommendation. IDHS has established additional procedures to ensure federal expenditures (including subrecipient expenditures) are accurately reported.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program ALN and Program Expenditures: 93.767 ($583,280,105) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: $13,580,339 Compliance Requirement: Eligibility Finding 2025-043 Failure to Discontinue CHIP Benefits for Ineligible Individuals Condition Found: DHFS improperly continued providing benefits under the Children’s Health Insurance Program (CHIP) program to individuals who were over the age of 18. The CHIP program provides benefits to children under the age of 19 at an enhanced federal participation (FFP) rate. CHIP benefits should be discontinued when a beneficiary turns 19; however, if they meet all other eligibility criteria, these beneficiaries are allowed to transition to benefits under the Medicaid Cluster program. During our testing of 60 payments (federal share totaling $65,490) made on behalf of CHIP beneficiaries during the year ended June 30, 2025, we identified three individuals receiving CHIP benefits who were over the age of 18. DHFS performed a review of all medical payments made under the CHIP program during the year ended June 30, 2025 and identified 8,741 CHIP beneficiaries over the age of 18 for whom medical payments totaling $13,580,339 were made during the year ended June 30, 2025. In addition, we noted DHFS has not established adequate controls to identify and remove individuals over the age of 18 from the CHIP program and to determine if they are eligible for benefits under the Medicaid Cluster program. Medical payments made on behalf of CHIP beneficiaries during the year ended June 30, 2025 totaled $564,858,560. Criteria or Requirement: In accordance with 42 CFR 435.10 and the OMB Compliance Supplement, dated November 2025, the State is required to determine client eligibility in accordance with eligibility requirements defined in the approved State Plans for the CHIP program. Specifically, 42 CFR 457.320(a) requires the State CHIP agency to provide benefits for groups of children up to, but not including, the age 19 in addition to other eligibility criteria. State Plan Amendment IL-14-0009 includes general eligibility considerations which allows benefits to be provided for children up to the age of 19 which is consistent with 42 CFR 457.320(a). In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include establishing and maintaining adequate controls over processes to perform and document beneficiary eligibility determinations. Cause: In discussing these conditions with DHFS officials, they stated timely redeterminations were not performed on individuals turning 19 because either the redetermination form was returned and the caseworker failed to process the redetermination timely or the redetermination form was not returned and the IES batch process failed to close the eligibility. Possible Asserted Effect: Failure to properly perform eligibility determinations in accordance with State Plans may result in federal funds being awarded to ineligible beneficiaries, which are unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-016. (Finding Code 2025-043,2024-016, 2023-022, 2022-016) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS review its current process for performing eligibility decisions and consider changes necessary to ensure all initial and redetermination decisions are performed in accordance with guidelines set forth by the State Plan. Views of DHFS Officials: DHFS accepts the recommendation. Management indicated that prior year corrective action plans have not fully resolved this issue because those cases requiring manual review were not processed timely. However, since 2023, the Department has reinforced their efforts toward this population group and has reduced the number of ineligible individuals and associated misspent dollars by 85%.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program, Medicaid Cluster ALN and Program Expenditures: 93.767 ($583,280,105), 93.775/93.777/93.778 ($20,821,414,891) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: $67,708,545 Compliance Requirement: Activities Allowed/Unallowed Allowable Costs/Cost Principles Finding 2025-044 Failure to Adequately Document Payment of Medical Expenditures Condition Found: DHFS could not provide sufficient supporting documentation to evidence that certain expenditures claimed under the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs were disbursed (paid) during the year ended June 30, 2025. Expenditures claimed under the CHIP and Medicaid Cluster programs are reported on a cash basis. During our testing of CHIP and Medicaid Cluster program expenditures, we noted the expenditure population provided by DHFS included transactions for which evidence of cash disbursement by the Illinois Office of Comptroller (IOC) during the year ended June 30, 2025, could not be substantiated. Specifically, we noted the following during our testing of 60 CHIP and 120 Medicaid beneficiary payments (with payments amounting to $65,490 and $265,020, respectively): • One Medicaid Cluster expenditure for medical services (with a voucher amount totaling $10,003,128) was not paid prior to June 30, 2025. • Support for one Medicaid Cluster medical services expenditure (voucher amount of $57,900) consisted solely of internal screenshots from the Medicaid Management Information System (MMIS). DHFS was unable to provide warrant numbers, electronic funds transfer (EFT) records, or other evidence confirming that payments were issued by the IOC. • Sufficient evidence of payments was not provided for two CHIP dental service expenditures (voucher amounts totaling $3,633,489). We noted payments for dental claims are processed through a third-party processor. DHFS authorizes the IOC to make periodic transfers of State funds to a locally held fund for the third-party processor to use to pay approved dental provider claims. While documentation evidencing the transfer of State funds to the locally held fund was provided, DHFS was unable to provide evidence these sampled dental expenditures were paid by its third-party processor. • DHFS could not provide warrant numbers, warrant issue dates, or paid dates to demonstrate 28 CHIP and 8 Medicaid Cluster expenditure transactions (with voucher amounts totaling $25,629 and $63,991,527, respectively) received from other State agencies for claiming under the Medicaid Cluster program had been paid during the fiscal year. We also noted DHFS has not established internal controls at a sufficient level of precision to ensure evidence supporting amounts claimed under the CHIP and Medicaid Cluster programs were paid by the IOC during the fiscal year. In addition to the exception items noted above, we noted significant time and effort was spent by DHFS and other State agencies to provide payment information for several transactions sampled in our testing because DHFS’ records did not include sufficient detail to identify the payment in the IOC’s records which delayed the completion of our audit procedures. Payments made to providers on behalf of beneficiaries of the CHIP and Medicaid Cluster programs totaled approximately $564,858,560 and $20,117,784,983, respectively, during the year ended June 30, 2025. Criteria or Requirement: 45 CFR 95.13 and 42 CFR 430.30 require federal financial participation (FFP) claimed on Form CMS-64 must be based on actual cash disbursements made by the State for medical assistance payments and administration, supported by verifiable accounting and payment records. 2 CFR 200.302(b)(3) also requires the financial management system of each non-Federal entity to provide records that adequately identify the source and application of funds for federally-funded activities. These records must contain information pertaining to, among other things, Federal awards, authorizations, financial obligations, unobligated balances, expenditures, and allowable costs. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure federal expenditures are paid within the fiscal year they are claimed where the cash basis of accounting is used and to retain evidence the payment was made by the IOC. Cause: In discussing these conditions with DHFS officials, they stated the $10 million expenditure in question crossed fiscal years due to the timing of the process for payments funded by intergovernmental transfers (IGTs). Supporting documentation was provided for the noted dental and other agency transactions, but the audit requests were received later in the audit process and involved significant research and cooperation with other State agencies, and therefore, were not able to be resolved prior to established deadlines for audit completion. Possible Asserted Effect: Claiming expenditures without verification of actual cash payment results in noncompliance with Uniform Guidance and federal Medicaid regulations. This condition may lead to premature federal cash drawdowns, misstatement of expenditures on the Schedule of Expenditures of Federal Awards and Form CMS-64, and potential questioned costs. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-044) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS: • Establish and enforce internal controls to reconcile internal MMIS adjudication and voucher processing data to IOC warrant and EFT disbursement records prior to claiming federal reimbursement. • Perform a cut-off review each quarter to ensure vouchers not yet paid by the IOC are excluded from cash basis federal claims until they are disbursed. • Require other State agencies to provide sufficient detail (including warrant numbers and payment dates) confirming the funds were disbursed within the applicable reporting period. Views of DHFS Officials: DHFS partially accepts the recommendation. DHFS agrees to review and adjust its internal control procedures surrounding its financial reporting process to address timing issues to properly reflect the transactions on the cash-basis Schedule of Expenditures of Federal Awards (SEFA). DHFS will also explore any necessary improvements to the level of detail associated with transactions presented for federal claiming by other State agencies. Where applicable, DHFS will work with the applicable state agencies to obtain a sufficient level of detail supporting their claimed payments, while at the same time not expending unnecessary State resources to perform duties the other State agencies are otherwise already documenting. DHFS respectfully disagrees with the portion of the finding that it could not support the payment and subsequent federal claiming of $64 million in other State agencies’ Medical Assistance spending. As noted in the above cause statement, the audit requests were received late in the audit process and involved significant research and cooperation with other state agencies, and therefore, were not able to be resolved prior to established deadlines for audit completion. As of the date of this response, the DHFS believes it can support the proper payment and federal claiming of the $64 million in question; however, due to external time pressures further audit procedures were forgone. Auditors’ Comment: As reported in the finding above, the documentation provided for the transactions included in the Condition Found was not sufficient to permit us to ascertain accurate payments were made during the audit period. The State spent significant time and effort to research and provide documentation supporting payment details during the audit process which should have been readily available in accordance with the requirements of 2 CFR 200.302(b)(3) cited above.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program, Medicaid Cluster ALN and Program Expenditures: 93.767 ($583,280,105), 93.775/93.777/93.778 ($20,821,414,891) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Activities Allowed/Unallowed Allowable Costs/Cost Principles Finding 2025-045 Unallowed Costs Charged to the CHIP and Medicaid Cluster Programs DHFS did not consistently and sufficiently document the rates charged for medical services expenditures charged to the CHIP and Medicaid Cluster programs. During our testing of a sample of 60 CHIP and 120 Medicaid claims (with payments amounting to $65,490 and $265,020, respectively), we noted the following exceptions: • One Medicaid Cluster medical payment (total computable expenditure totaling $10,360) with a date of service of August 27, 2024, that was incorrectly processed using the obsolete 2023 diagnosis related group (DRG) pricing calculator instead of the 2024 Cook County DRG pricing calculator, which became effective on January 1, 2024. As a direct result of utilizing the incorrect DRG pricing calculator, the claim was underpaid by $1,944. • Four Medicaid Cluster medical payments (total computable expenditures totaling $67,478) used rates with group care credits that were inconsistent with supporting documentation. Differences related to these inconsistencies ranged from $29 to $691. • Twelve CHIP and one Medicaid medical payments (with total computable expenditures totaling $10,253 and $274, respectively) utilized a rate that was not properly supported as it could not be recalculated based upon the documentation provided during our testing. • Two CHIP and nine Medicaid Cluster medical payments (with total computable expenditures totaling $333 and $2,850, respectively) utilized a rate that was impacted by a third-party liability or personal need allowance that was not properly supported at the time of our testing. DHFS has not performed a comprehensive analysis to determine if other similar documentation or calculation errors occurred during the year ended June 30, 2025. We also noted DHFS’ controls over the determination of the rates used for medical services provided under the CHIP and Medicaid Cluster programs do not operate at an appropriate level of precision to ensure they are properly calculated and supported. DHFS also lacks adequate systemic or manual internal controls to ensure claims are automatically or manually routed to the correct DRG pricing calculator based on the applicable service date. Payments made to providers on behalf of beneficiaries of the CHIP and Medicaid Cluster programs totaled approximately $564,858,560 and $20,117,784,983, respectively, during the year ended June 30, 2025. Criteria or Requirement: 42 CFR 447.201 requires that claims should be reimbursed in in accordance with the reimbursement methodology and fee schedule approved in the State’s Medicaid State Plan and applicable provider reimbursement handbooks. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls over the claims adjudication process must include systematic checks to ensure the correct pricing logic and calculators are applied based on specific dates of service. Cause: In discussing these conditions with DHFS officials, they noted the Medicaid Management Information System (MMIS) system contained an incorrect rate due to human error. Supporting documentation was provided for the other agency transactions, but the audit requests were received later in the audit process and involved significant research and cooperation with other State agencies, and therefore, were not able to be resolved prior to established deadlines for audit completion. Possible Asserted Effect: The failure to maintain effective internal controls over the documentation of the calculation of medical rates and the assignment of DRG pricing calculators results in systemic noncompliance with the approved Medicaid State Plan methodologies. Furthermore, these conditions may cause inaccurate reimbursements to providers, resulting in unallowable costs being charged to the CHIP and Medicaid Cluster programs. Repeat Finding: A similar finding was not reported in the prior year audit (Finding Code 2025-045). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate and implement additional internal controls to ensure that (1) medical payment rates used are properly calculated and supported and (2) the correct DRG pricing calculators are uniformly applied to all claims based on the corresponding dates of service. Additionally, DHFS should implement periodic post-payment reviews or exception reporting to proactively identify and recoup any improper payments resulting from improper rates and DRG pricing calculator misalignments. Views of DHFS Officials: DHFS accepts the recommendation. DHFS is implementing a review of the rates currently entered into the Medicaid Management Information System (MMIS) and will ensure rates are updated consistently with the rates provided in the DRG pricing calculators. DHFS respectfully disagrees with the portion of the finding that it could not support the payment rates. As noted in the above cause statement, the audit requests were received late in the audit process and involved significant research and cooperation with other State agencies, and therefore, were not able to be resolved prior to established deadlines for audit completion. As of the date of this response, the DHFS believes it can support the rates in question; however, due to external time pressures further audit procedures were forgone. Auditors’ Comment: As reported in the finding above, the documentation provided for the transactions included in the Condition Found was not sufficient to permit us to ascertain accurate payment rates were used during the audit period. The State spent significant time and effort to research and provide documentation supporting payment details during the audit process. Documentation should be readily available to support the payments rates used for expenditures charged to federal programs.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($20,821,414,891) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Provider Eligibility Finding 2025-046 Inadequate Procedures to Determine Provider Eligibility Condition Found: DHFS has not established adequate procedures to ensure providers of the Medicaid Cluster program meet all of the State and Federal provider eligibility requirements. The State is required to establish and evaluate criteria to ensure providers enrolled to provide services to recipients of the Medicaid Cluster program are eligible to participate in the program under federal, state, and local laws and regulations and to determine whether providers have made required disclosures. DHFS is the State Medicaid agency responsible for coordinating these activities on behalf of the State of Illinois. The Illinois Medicaid Program Advanced Cloud Technology (IMPACT) system is used by DHFS for the enrollment and screening of Medicaid providers. During our testing of 60 providers who were enrolled in and received payments for services provided under the Medicaid Cluster program during the year ended June 30, 2025, we noted the following: • A valid license was not available in the IMPACT system for State fiscal year 2025 for one provider tested with expenditures totaling $1,038,543 during the year ended June 30, 2025. • The license identification number documented within the IMPACT system did not agree to the provider’s license number issued by the Illinois Department of Public Health (IDPH) for two providers with expenditures totaling $981,533 during the year ended June 30, 2025. • Recertification surveys for two dialysis providers tested with expenditures totaling $68,087 were not performed within required timeframes. As of June 30, 2025, delays in performing these recertifications were 209 and 182 days beyond the maximum survey interval of 3.5 years. Payments made to providers on behalf of beneficiaries of the Medicaid Cluster program totaled approximately $20,117,784,983 during the year ended June 30, 2025. Criteria or Requirement: According to 42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Social Security Act (42 USC 139a(a)(9)), providers must be licensed according to federal, state, and local laws and regulations to participate in the Medicaid program. Also, according to 42 CFR Part 455, Subpart E, the providers must be screened and enrolled, including recertification surveys. Centers for Medicare & Medicaid Services (CMS) guidance requires states to conduct recertification surveys of End Stage Renal Disease (ESRD) facilities to ensure ongoing provider eligibility. Specifically, CMS guidance establishes a maximum interval of 3.5 years (42.9 months) between surveys for any ESRD facility. Accordingly, by not completing the required recertification surveys, the providers did not meet these program requirements. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing adequate procedures to screen providers and maintaining the integrity of provider data used to administer the Medicaid Cluster program. Cause: In discussing these conditions with DHFS officials, they stated providers entered the incorrect license numbers due to human error, and the recertification surveys did not occur timely due to IDPH staffing levels. Possible Asserted Effect: Failure to properly screen and enroll program providers and maintain accurate provider data results in noncompliance with program requirements and may result in payments to ineligible providers, increased risk of improper payments, and reduced assurance that services are rendered by properly licensed providers. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-020. (Finding Code 2025-046, 2024-020, 2023-021, 2022-015, 2021-006) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate its procedures for performing and documenting provider eligibility screening and enrollment and implement the changes necessary to ensure: (1) provider records are complete and accurate and (2) required recertifications are performed within required timeframes. Additional internal control procedures should be implemented to monitor the accuracy of the data maintained in the IMPACT system and timeliness of necessary updates. Views of DHFS Officials: DHFS partially accepts the recommendation. The first bullet point notes there was not a valid license in IMPACT for State fiscal year 2025. DHFS respectfully disagrees. The Illinois Department of Public Health (IDPH) is charged with the licensing and surveying of facilities. As the Statewide Medicaid Agency, DHFS is charged with checking the IDPH website to ensure the facility is licensed before making payment. DHFS staff did check for the facility’s licensure and provided documentation to support the facility had an active license during the audit period. This information was included in the IMPACT system. As part of the auditors’ testing, they requested IDPH to provide a physical copy of the license. IDPH was unable to locate a physical copy of a license that covered three months of the audit period; however, DHFS had valid license information in its system of record (IMPACT) and supported it acted appropriately. The second bullet point notes two providers’ license numbers in the IMPACT system did not match the license number issued by IDPH. The providers are responsible for updating their information in the IMPACT system. The license number is part of that information. It is management’s belief that DHFS staff did verify that both of these providers had a valid license but did not update the license number in the IMPACT system. DHFS agrees the license numbers should have been updated and will work with staff to ensure they update this information when discrepancies are noted. The third bullet point notes recertification surveys were not conducted timely. IDPH is the State Survey Agency, meaning that it is considered the only state agency responsible for the surveys for federal CMS’ purposes, and is responsible for conducting surveys of facilities. DHFS does not perform this function and has no operational control over doing so. IDPH is also responsible for suspending a facility’s license due to survey findings. DHFS takes appropriate action, including suspension of payments, when IDPH notifies DHFS a facility’s license has been suspended. IDPH indicated staffing issues will be addressed. Auditors’ Comment: DHFS is designated by the State of Illinois as the Statewide Medicaid Agency and is responsible for ensuring expenditures charged to the Medicaid program meet all applicable federal requirements, including provider eligibility requirements. Documentation to support a valid license as of the date of the service was not provided for all sample items selected for our audit procedures.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster ALN and Program Expenditures: 93.775/93.777/93.778 ($20,821,414,891) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Medicaid Fraud Control Unit (MFCU) Finding 2025-047 Failure to Properly Report Medicaid Overpayments Identified by the Medicaid Fraud Control Unit Condition Found: DHFS did not properly report monetary recoveries of overpayments identified by the Medicaid Fraud Control Unit (MFCU) on its quarterly CMS-64 report. Medicaid Cluster program regulations require the State to establish a MFCU to investigate allegations of fraud, waste, and abuse related to the Medicaid Cluster program. The Illinois MFCU is operated by the Illinois Office of the Attorney General who receives allegations and referrals of suspected fraud, waste, and abuse from personnel in the DHFS Office of the Inspector General and the Illinois State Police. These referrals and allegations are ultimately evaluated by the Illinois Office of the Attorney General for potential prosecution and recovery of overpayments. During our testing of nine cases closed by the MFCU during the year ended June 30, 2025, we noted two overpayment recoveries (totaling $37,314) were not reported to the U.S. Department of Health and Human Services (USDHHS) on the quarterly CMS-64 report. DHFS was unable to provide evidence that this MFCU overpayment recovery, specifically the federal share of the recovery, was reported on any of the quarterly CMS-64 reports filed during the fiscal year ended June 30, 2025. We also noted DHFS has not established internal controls at a sufficient level of precision to ensure all overpayments identified and recovered by the MFCU are communicated, tracked, and properly reported on the quarterly CMS-64 report. Specifically, there is no formal reconciliation process between the Attorney General's recovery records, the MFCU closed-case database, and the overpayment amounts reported on the CMS-64 report. Criteria or Requirement: Section 1903(d)(2)(C) of the Social Security Act requires that when an overpayment is discovered, which was made by a State to a person or other entity, the State shall have a period of one year in which to recover or attempt to recover such overpayment before adjustment is made in the Federal payment to such State on account of such overpayment. Except as otherwise provided in subparagraph (D), the adjustment in the Federal payment shall be made at the end of the one year period, whether or not recovery was made. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing procedures to ensure that MFCU-identified overpayments are tracked and accurately reported on the quarterly CMS-64 reports as required. Cause: In discussing these conditions with DHFS officials, they noted two other State agencies administering Medicaid services failed to report MFCU recoveries to DHFS for return of Federal Financial Participation (FFP). Possible Asserted Effect: Failure to track and report MFCU-identified overpayments within required timeframes results in federal noncompliance. This deficiency leads to an understatement of federal share recoveries on the CMS-64 report, meaning federal funds are not adjusted or returned to the federal government in a timely manner. Repeat Finding: A similar finding was not reported in the prior year audit (Finding Code 2025-047). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS implement reconciliations or other procedures to ensure MFCU-identified overpayments are properly reported on the quarterly CMS-64 report in accordance with program regulations. Views of DHFS Officials: DHFS accepts the recommendation. DHFS will reinforce with other agencies the requirement that MFCUidentified over payments as well as other recoveries be reported to DHFS for proper inclusion and return of FFP on the CMS-64.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program, Medicaid Cluster CFDA # and Program Expenditures: 93.767 ($583,280,105), 93.775/93.777/93.778 ($20,821,414,891) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Managed Care Financial Audit Finding 2025-048 Failure to Ensure Managed Care Organizations Properly Prepare Financial Reports Condition Found: DHFS did not ensure the annual financial audits prepared during the year ended June 30, 2025 for Managed Care Organizations (MCOs) of the Children’s Health Insurance Program (CHIP) and Medicaid Cluster programs met the requirements of the MCO contracts and federal regulations. Specifically, DHFS did not obtain audited annual financial reports that meet the requirements of the federal Medicaid regulations for MCOs as reported in the State’s single audit reports for fiscal years 2021, 2022, 2023, and 2024 and did not perform procedures to obtain compliant reports for any of these prior periods during the year ended June 30, 2025. While we noted audited financial reports were prepared during State fiscal year 2025 for each of the six Illinois MCOs, the MCO auditors issued an adverse opinion on the annual financial reports for one MCO. Accordingly, this MCO’s financial report was not prepared in accordance with generally accepted accounting principles (GAAP) as required by program regulations and the provisions of the MCO contracts. The auditors’ report (dated in May 2025) noted the MCO annual financial report was prepared on a statutory basis of accounting which is assumed to be materially different than GAAP. During our audit procedures, DHFS stated they received the MCO reports for calendar year 2025 outside the audit period. Payments made to the MCO which did not prepare a GAAP financial report totaled $5,437,330,341 under the CHIP and Medicaid Cluster programs during the year ended June 30, 2025. Payments made to all MCOs under the CHIP and Medicaid Cluster programs during the year ended June 30, 2025 totaled $19,355,541,905. Criteria or Requirement: According to 42 CFR 438.3(m), the State’s contracts with its MCOs require MCOs to submit annual audited GAAP financial reports specific to the CHIP/Medicaid Cluster program contract. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure financial data submitted by, or on behalf of each of its MCOs, meets program and contractual requirements. Cause: In discussing these conditions with DHFS officials, they stated they disagree with the finding. Possible Asserted Effect: Failure to ensure the annual financial audits prepared by the MCOs meet the requirements of the MCO contracts and federal regulations results in noncompliance with program requirements. This diminishes the State's ability to effectively monitor the financial health of the MCOs and may result in inaccurate capitation rate setting, which increases the risk of unallowable costs and federal disallowances. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-019 (Finding Code 2025-048, 2024-019, 2023-020). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS evaluate its procedures for reviewing financial audit reports for compliance with program and contractual requirements. Additionally, we recommend DHFS implement robust controls, such as a formal tracking mechanism, to determine whether MCO financial reports are prepared in accordance with GAAP program regulations and contract requirements. DHFS should also ensure appropriate and timely followup procedures are formally documented when an MCO submits a non-compliant or modified audit report. Views of DHFS Officials: DHFS accepts this recommendation and believes it acted in accordance with federal regulations. DHFS amended the MCO contracts in 2023 to state, in accordance with 42 CFR 438.3(m) Contractor must submit to the Department on an annual basis an audited financial report specific to this Contract. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. The audited financial report for calendar year 2022 is due to the Department no later than July 31, 2023. Contractor shall conduct the audit on an annual basis and submit future financial reports to the Department no later than July 31st of the following calendar year. DHFS received the 2023 audit reports timely in July 2024; however, they were reviewed by DHFS and determined to be not compliant with GAAP reporting requirements. DHFS provided additional guidance to the MCOs to ensure reporting requirements were compliant or corrective actions/sanctions would be applied. DHFS received the 2024 audit reports by August 29, 2025, which was considered timely after an approved extension. These are the audit reports noted in this finding. DHFS reviewed the reports timely and discovered only one of the audit reports to be not GAAP compliant. DHFS immediately notified the MCO and issued a sanction. DHFS also conducted discussions with the MCO to resolve the non-compliance. A compliant report was requested, and a due date was given. When the MCO didn’t meet the due date, DHFS sanctioned the MCO again. A compliant report was received in February 2026. DHFS is tracking the report submissions, reviewing the reports for compliance and taking action to ensure compliant reports are received. The audit reports are completed near State fiscal year end, so DHFS does not receive them until the beginning of the next fiscal year. If the auditors do not take into consideration documentation received and acted upon outside of the audit period this will never be resolved as the timing of these audits, and receipt thereof, don’t allow us to take action within the audit period. Auditors’ Comment: As described in the finding above, DHFS has not received fully compliant GAAP reports for the past several years and did not seek to obtain corrected reports for previous periods during State fiscal year 2025. Our audit procedures cover compliance activities during the State’s fiscal year and do not extend to future periods.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster CFDA # and Program Expenditures: 93.775/93.777/93.778 ($20,821,414,891) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: None Compliance Requirement: Activities Allowed/Unallowed Allowable Costs/Cost Principles Finding 2025-049 Failure to Perform Drug Rebate Activities within Required Timeframes Condition Found: DHFS did not perform certain Medicaid Cluster program drug rebate activities within required timeframes. DHFS is required to provide drug utilization data to drug manufacturers within 60 days of the end of each quarter as part of the invoicing of drug rebates to be paid to the Medicaid Cluster program. The drug rebates are shared between the State and federal government and are due to be paid by the pharmaceutical companies to the State within 30 days of the invoice, unless the manufacturer provides the State with a written notice of dispute. During our testing of 40 drug rebate invoices (for rebate amounts totaling $951,981), we identified the following: • Three invoices (for rebate amounts totaling $36,800) were not billed within 60 days of the end of the quarter ended December 31, 2024. All three invoices were completed on March 6, 2025, which was 6 days later than required. • Additionally, three drug rebate invoices (for rebate amounts totaling $64,791) were not paid or disputed within 30 days of the invoiced date by the drug manufacturer. As of the date we communicated this finding (August 28, 2026), these amounts still had not been received, disputed, or resolved. The delay related to these rebates ranged from 646 to 735 days beyond the 30 day requirement. • Payments received for 24 drug rebate invoices (rebate amount totaling $523,523) were dated and received more than 30 days later than the invoiced date. Payment dates ranged from one to 232 days beyond the 30 day requirement. We also noted DHFS has not established adequate internal control procedures to ensure drug rebate activities are performed within required timeframes and appropriate corrective actions are taken. Drug rebates reported by DHFS during the year ended June 30, 2025 totaled $940,160,468. Criteria or Requirement: 42 CFR 447.511(a) requires states to bill participating drug manufacturers an invoice within 60 days of the end of each quarter. This invoice includes, at a minimum, all relevant data and any subsequent changes to the data fields on the invoice form. Section 1927(b)(1)(A) of the Social Security Act (42 U.S.C. 1396r-8(b)(1)(A)) requires participating drug manufacturers to pay the state rebate amount within 30 days after receiving the state’s utilization information. 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include establishing and maintaining adequate controls over processes to ensure drug rebates are invoiced and follow-up on late payments is performed in a timely manner. Cause: In discussing these conditions with DHFS officials, they noted calendar year 2024 quarter four drug rebate invoices were issued later than scheduled due to an information system error with the contracted pharmacy benefit manager (PBMS). Possible Asserted Effect: Failure to bill drug manufacturers within 60 days of the end of the quarter may result in delayed collection of drug rebates, increasing the risk that rebate receivables, recoveries, and related federal reporting are not recorded timely. Furthermore, a lack of tracking for unpaid drug rebate invoices results in uncollected State and federal funds, potential interest revenue loss, and non-compliance with drug rebate collection guidelines. Repeat Finding: A similar finding was not reported in the prior year audit (Finding Code 2025-049). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS implement additional procedures to ensure that drug rebate invoices are billed within required timeframes and timely follow-up is conducted for payments exceeding the 30-day payment timeframe. Views of DHFS Officials: DHFS accepts the recommendation regarding pursuit of outstanding drug rebate receivables. As noted in the cause statement above and as discussed below, the reason for the late invoicing for calendar year 2024 quarter four was an information technology system issue with the PBMS vendor which was beyond DHFS’ control. After identifying the information system error, the Department elected to delay issuance of invoices until the system corrections were completed. This decision was made to prevent the distribution of inaccurate invoices to drug manufacturers for that invoicing cycle. DHFS does track outstanding drug rebate receivables but will focus efforts on collections of amounts outstanding beyond the federal guidelines

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster CFDA # and Program Expenditures: 93.775/93.777/93.778 ($20,821,414,891) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: $107,746,045 Compliance Requirement: Reporting Finding 2025-050 Failure to Report Drug Rebates on the Medicaid CMS-64 Report in a Timely Manner Condition Found: DHFS did not accurately report certain Medicaid Cluster program drug rebates on quarterly federal financial (CMS-64) reports. DHFS is the State Medicaid agency and is responsible for calculating drug rebates, billing pharmaceutical companies for drug rebates, and reporting drug rebates on the quarterly CMS-64 reports. In October 2024, DHFS identified significant inaccuracies in the drug rebates billed to and paid by pharmaceutical companies which were reported on quarterly CMS-64 reports submitted to USDHHS. Specifically, DHFS determined the data used to calculate drug rebates beginning in the quarter ended September 30, 2019 through June 30, 2024 erroneously included Medicare Part D drug data which did not pertain to beneficiaries of the Medicaid Cluster program. The data error resulted in drug rebates billed to and paid by pharmaceutical companies reported on the quarterly CMS-64 reports being overstated and Medicaid expenditures being understated for the impacted periods. During State fiscal year 2025, DHFS provided credits of approximately $107,746,045 to the pharmaceutical companies impacted by the prior period drug rebate billing errors. These credits were netted against the drug rebates billed and collected in the quarterly CMS-64 reports filed in State fiscal year 2025. As a result, the drug rebates reported on the 2025 CMS-64 reports filed in 2025 were understated and the related drug expenditures were overstated by these prior period credits. We also noted DHFS did not obtain approval from USDHHS relative to how these prior period adjustments should be reported. Additionally, during our testing of the CMS-64 reports for the quarters ending March 31, 2025 and June 30, 2025, we noted the information provided for our audit procedures did not agree to the amounts reported by DHFS for the following items: "See full report for chart/table." Additionally, in considering the reporting process for the CMS-64 report, we noted IDHFS does not perform analytical or other procedures during the report preparation process at a level of precision to ensure amounts reported are reasonable in relation to previously reported information or expectations relative to current program activities. Criteria or Requirement: 42 CFR 430.30(c) requires States to submit Form CMS-64 (Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program) to the central office not later than 30 days after the end of each quarter. This report is the State’s accounting of actual recorded expenditures. According to the Center for Medicaid and CHIP Services Information Bulletin dated July 24, 2014, CMS requires drug rebates to be reported in the quarter in which the State incurs the expenditure. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure adjustments are properly reported and necessary approvals are obtained from USDHHS. Cause: In discussing these conditions with DHFS officials, they noted they disagree with the finding. Possible Asserted Effect: Failure to accurately report drug rebate amounts and program expenditures on the CMS-64 inhibits USDHHS’ ability to monitor the Medicaid Cluster program and may result in unallowable costs. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-015. (Finding Code 2025-050, 2024-015, 2023-019) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS obtain USDHHS approval prior to reporting prior period errors related to drug rebates on the CMS-64. Views of DHFS Officials: DHFS respectfully disagrees with the recommendation. DHFS believes it received the necessary federal CMS approval to report the drug rebate billing errors on its quarterly federal revenue claims (CMS-64) in accordance with governing federal regulations. Specifically, on December 17, 2024, DHFS requested a Good Cause Waiver from CMS-USDHHS. The waiver request to USDHHS included two delineated paths to recover the federal share of the incorrectly calculated drug rebate claims: (1) procedures for drug rebate claims currently within the two-year federal claiming requirement; and (2) procedures for drug rebate claims outside the two-year claiming period. With regards to the claims within the two-year federal claiming requirement (April 2023-March 2024), DHFS management believed it consistently followed 45 CFR 95.7, which requires states to request federal matching revenue within two years of payment of an eligible expenditure. The federal share of drug rebate revenue is, and has always been, transmitted to CMS via reductions to DHFS’ federal revenue claims. Therefore, DHFS made the decision to report the reimbursement of the pharmaceutical manufacturers to CMS as an adjustment to federal matching revenue claims in order to recover the federal share of the Medicare Part D rebates previously transmitted in error. DHFS made that decision based on current operational protocols and after engaging with federal CMS staff. During multiple cooperative meetings between DHFS staff and federal CMS staff, CMS staff advised DHFS to adjust drug rebate claims within the initial two-year period and to therefore recover the federal share of drug rebates within that initial two-year period as was done. With regards to the claims outside the two-year federal claiming requirement (July 2019-March 2023), as stated above, DHFS requested a Good Cause Waiver of the aforementioned two-year federal claiming requirement to recover the federal share of impacted drug rebates beyond the two-year period. The federal approval of the Good Cause Waiver was dated June 6, 2025. In addition to the above, DHFS would like to note that its Good Cause Waiver request cited the full period impacted by the incorrect rebate billings as well as specifically referencing DHFS’ intent to report pharmaceutical manufacturer reimbursement adjustments within the two-year window on its upcoming CMS-64 reports. In the federal approval letter, federal CMS authorized DHFS to report the pharmaceutical manufacturer reimbursement adjustments on its CMS-64 reports. While DHFS acknowledges the initial deficiencies internal control which led to the omission of the Medicare Part D drugs from rebate billings, DHFS would like to emphasize that it has taken corrective action by rectifying the system’s programming in August 2024 and has developed revised review procedures to continue to monitor quarterly variances within the drug rebates included in the CMS-64. Finally, DHFS does not believe that the drug rebate amounts reported on the March 31, 2025, and June 30, 2025, CMS-64 reports were necessarily incorrect. DHFS has several drug rebate billing system reports that support the amounts listed on those CMS-64s. While DHFS provided the report utilized for the auditors’ comparison table upon their request, DHFS also shared written guidance from the drug rebate information technology vendor explaining the limitations of that specific report and why it may not align with the auditors’ intended use. Auditors’ Comment: The drug rebates reported in the CMS-64 financial reports for the quarters ended March 31, 2025 and June 30, 2025 were reduced for credits provided to pharmaceutical companies that were erroneously overcharged during prior periods. These items were not reported and explained in the adjustments section of the CMS-64 report, they were offset against current period drug rebate amounts, increasing current period Medicaid Cluster program expenditures. The good cause waiver did not approve the reporting methodology used and the instructions for the CMS-64 report do not prescribe reporting requirements for these types of errors.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Medicaid Cluster CFDA # and Program Expenditures: 93.775/93.777/93.778 ($20,821,414,891) Award Numbers: Various – See schedule of award numbers Federal Award Year: Various – See schedule of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Special Tests and Provisions – Utilization Control Finding 2025-051 Failure to Perform Reviews over Home and Community Based Waiver Services (HCBS) Condition Found: DHFS failed to conduct utilization reviews over HCBS services for the nine waivers contracted out to its vendor during fiscal year 2025. DHFS is required to follow the State plan’s methods and procedures to safeguard against unnecessary utilization of care and services. HCBS services are furnished to beneficiaries who would otherwise need inpatient care that is furnished in a hospital, nursing facility or other institutional setting which are reimbursable for Medicaid claims under the State plan. One of these requirements is to perform reviews over HCBS waiver services. There are nine total HCBS waivers subject to these reviews, which DHFS historically outsources to a vendor. These nine waivers are: Persons with Disabilities, People with HIV or AIDS, Persons with Brain Injury, Adults with Developmental Disabilities, Persons who are Elderly, Children and Young Adults with Developmental Disabilities – Support, Children and Young Adults with Developmental Disabilities – Residential, Supportive Living Program, and Persons who are Medically Fragile, Technology Dependent. During our audit procedures and based on inquiries with DHFS officials, the vendor contract came to an end on February 28, 2023, and a new contract has not been in place to cover July 1, 2024 through June 30, 2025 (fiscal year 2025). As a result, we identified no reviews performed during fiscal year 2025. The failure to perform reviews from July 1, 2024 through June 30, 2025 resulted in $2,787,671,905 in Medicaid claims that were not subject to contractor reviews during fiscal year 2025. Payments made on behalf of beneficiaries of the Medicaid Cluster program totaled $20,117,784,983 during the year ended June 30, 2025. Criteria or Requirement: 42 CFR 456 discusses the entire utilization control program to help ensure appropriate care is being provided for Medicaid services. Specifically, 42 CFR 456.22 and 456.23 requires the State Medicaid agency to have a sampling plan in place to perform reviews over the quality of Medicaid services. Additionally, 42 CFR 456.4 discusses the responsibilities of the state Medicaid agency to monitor these requirements even if the execution of the reviews are outsourced to a third-party to perform these reviews. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal control designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include implementing procedures to ensure HCBS services and providers are properly reviewed in accordance with program requirements. Cause: In discussing these conditions with DFHS officials, they stated the contract with the third-party servicer expired in State fiscal year 2023 and DHFS was unable to renew the contract as originally planned. Additionally, DHFS did not receive any responses to its request for quote to secure a replacement vendor and did not possess adequate internal resources to perform the required reviews in the interim. Possible Asserted Effect: Failure to properly review and monitor Medicaid services bypasses critical safeguards designed to prevent unnecessary utilization of care. This may result in inadequate services or poor quality of care being provided in home and community-based settings. Furthermore, the lack of oversight significantly increases the risk of overpayments and unallowable costs, which could lead to federal disallowances. Repeat Finding: A similar finding was reported in the prior year audit as finding number 2024-021 (Finding Code 2025-051, 2024-021, 2023-025). Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS expedite the procurement process to secure a qualified third-party vendor to resume required HCBS utilization reviews. In the event a vendor cannot be promptly secured, we recommend DHFS develop and implement an interim, risk-based internal monitoring plan and allocate the necessary resources to ensure critical utilization controls are executed in accordance with the State plan and federal regulations. Views of DHFS Officials: DHFS accepts the recommendation. A vendor has been procured, and quality assurance reviews began in June 2026.

Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Child Support Services ALN and Program Expenditures: 93.563 ($146,728,300) Award Numbers: Various – see table of award numbers Federal Award Year: Various – see table of award numbers Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-052 Failure to Communicate Award Information to Subrecipients Condition Found: DHFS did not communicate required information in its award documents to subrecipients of the Child Support Services (CSS) program. During our testing of the award communications for our sample of subrecipients, we selected the contracts under which funds were disbursed during fiscal year 2025 to review for compliance with federal award communication requirements. During our review of the award communication files for our sample of 3 awards (related to subrecipient expenditures of $9,542,471), we noted the following information was not communicated in the subrecipient award agreement for any of the subrecipients sampled: Federal Award Identification Number (FAIN) Subrecipient’s Unique Entity Identifier (UEI) Federal award date Additionally, we noted DHFS has not established internal controls at a sufficient level of precision to detect whether all required information has been communicated to each subrecipient in accordance with federal regulations. Amounts passed through to subrecipients under the CSS program totaled $11,760,786 during the year ended June 30, 2025. Criteria or Requirement: According to 2 CFR 200.332(b), a pass-through entity is required to identify Federal awards made by informing each subrecipient of required information In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures in place to ensure required information is properly communicated. Cause: In discussing these conditions with DHFS management, they stated they stated that the omission of this subrecipient award information was an oversight due to a misinterpretation of the communication requirements related to these contracts. Possible Asserted Effect: Failure to communicate required award information may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. Repeat Finding: A similar finding was not reported in the prior year audit. (Finding Code 2025-052) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS implement additional procedures to ensure award information communicated to subrecipients is reviewed for completeness and accuracy. Views of DHFS Officials: DHFS accepts the recommendation. DHFS will ensure that future communications with subrecipients comply with all federal requirements. The services contracted from these three subrecipients are supported by intergovernmental agreements dating from 2020 through 2024. These agreements each contain reference to the applicable requirements of Title IV-D of the Social Security Act, the applicable CFDA number, start and end dates of the award period and maximum expenditure amounts by year. DHFS also sends an annual verification of the actual funds expended to each entity for audit pu rposes. DHFS adopted a policy beginning July 1, 2025 that these agreements are of a vendor arrangement instead of a subrecipient relationship and therefore will not require the elements discussed in the finding. However, the fiscal year 2025 audit period falls before this policy change.

State Agency: Illinois Department of Healthcare and Family Services (DHFS) Federal Agency: U.S. Department of Health and Human Services (USDHHS) Program Name: Children’s Health Insurance Program, Medicaid Cluster ALN and Program Expenditures: 93.767 ($583,280,105) 93.775/93.777/93.778 ($20,821,414,891) Award Numbers: Various - see table of award numbers Federal Award Year: Various - see table of award numbers Questioned Costs: Cannot be determined Compliance Requirement: Eligibility Finding 2025-053 Inadequate Procedures to Determine and Document Beneficiary Eligibility Condition Found: DHFS could not locate case file documentation supporting certain eligibility requirements for beneficiaries of the Children’s Health Insurance Program (CHIP) and Medicaid Cluster program. The State of Illinois uses a single application and process to determine the eligibility of beneficiaries of the Supplemental Nutrition Assistance Program Cluster (SNAP Cluster), Temporary Assistance for Needy Families (TANF), CHIP, and Medicaid Cluster programs. The Illinois Department of Human Services (IDHS) is the State agency primarily responsible for performing eligibility determinations for these programs and administers the SNAP Cluster and TANF program activities. DHFS is the State Medicaid agency and is responsible for administering the CHIP and Medicaid Cluster program activities. IDHS and DHFS work together to develop policies and maintain the information systems involved in the administration of SNAP Cluster, TANF, CHIP, and Medicaid Cluster programs. During our testing, we selected 60 CHIP and 120 Medicaid payments and reviewed documentation supporting the determination the beneficiary met program eligibility requirements for the benefits provided and documentation supporting the benefits paid on their behalf. We noted the following exceptions in our testing: For one Medicaid case (with a sampled payment of $468), the beneficiary was initially determined to be an eligible non-citizen due to an asylum claim; however, documentation supporting the asylum claim could not be provided by the IDHS or DHFS. The beneficiary was later determined to be ineligible for medical benefits and was identified as such in Integrated Eligibility System (IES); however, the case remained eligible in Medicaid Management Information System (MMIS). Medical benefits paid on behalf of this beneficiary during the year ended June 30, 2025 totaled $5,699. For one Medicaid case (with a sampled payment of $9,735), documentation was not available in the case file to substantiate the individual was eligible for federal Medicaid benefits. Case file documentation evidenced the individual was a non-citizen Victim of Trafficking, Torture, or Other Serious Crimes and was not eligible for federal Medicaid benefits, but may have been eligible for State funded medical benefits. Medical benefits paid on behalf of this beneficiary and claimed to the Medicaid Cluster program during the year ended June 30, 2025 totaled $32,898. For two Medicaid cases (with sampled payments of $309), an income test was not performed due to the misapplication of a COVID-19 override of the redetermination requirement. Medical benefits paid on behalf of these beneficiaries during the year ended June 30, 2025 totaled $73,478. For one CHIP case (with a sampled payment of $1,700), although the case record identified eligibility ended in October 2024, benefits continued to be paid on behalf of this individual for medical services provided subsequent to this date. Medical benefits paid on behalf of this beneficiary during the year ended June 30, 2025 totaled $31,979. Details of the beneficiary payments selected in our samples for the CHIP and Medicaid Cluster programs are as follows: "See full report for chart/table." We also noted the State does not have adequate resources to perform and document eligibility determinations. Additionally, the State has not established appropriate monitoring procedures to ensure eligibility determinations are properly documented in accordance with program requirements. Details of the beneficiary payments paid by the State during the year ended June 30, 2025 for the CHIP and Medicaid Cluster programs are as follows: "See full report for chart/table." Criteria or Requirement: In accordance with 42 CFR 435.948 through 435.956 and the OMB Compliance Supplement, dated November 2025, the State is required to verify financial and nonfinancial factors of eligibility in accordance with eligibility requirements defined in the approved State Plans for the CHIP and Medicaid programs. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include maintaining adequate controls over beneficiary case files to ensure all required documentation is obtained, and appropriate sanctions applied. Cause: In discussing these conditions with DHFS officials, they stated these exceptions were due to failure to process redeterminations timely (prior to age 19), failure to manually remove COVID overrides, a system logic error and failure to maintain appropriate documentation to support eligibility. Furthermore, management indicated that prior year corrective action plans have not fully resolved this issue because caseworkers are less familiar with the COVID overrides as there are fewer in the system, redeterminations were not performed on individuals turning 19 because either the redetermination form was returned and the caseworker failed to process it timely or the redetermination was returned and the IES batch process failed to close the eligibility. Possible Asserted Effect: Failure to properly perform eligibility determinations in accordance with State Plans may result in federal funds being paid to ineligible beneficiaries, which are unallowable costs. Repeat Finding: A similar finding was reported in prior year audit as finding number 2024-017. (Finding Code 2025-053, 2024-017) Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend DHFS review its current process for performing eligibility determinations and consider changes necessary to ensure all initial determinations and subsequent redeterminations are performed in accordance with guidelines set forth in the State Plan. Views of DHFS Officials: DHFS accepts the recommendation. DHFS will reinforce with eligibility caseworkers to take appropriate actions on cases, maintain supporting documentation of determinations made, and complete work in a timely manner. An annual training has been developed and is required for all casework staff. Efforts continue on troubleshooting the various causes of eligibility being closed on the Illinois Eligibility System (IES) and remaining open or more often being reopened on the Medicaid Management Information System (MMIS). Once validated solutions are reached, a system fix will be implemented. During the interim, we will continue to run the monthly procedure to reconcile the systems. We are averaging around 4,000 eligibility closures per month through our special Recipient Database update process.