Corrective Action Plans

Finding: The Housing Finance Commission did not have adequate internal controls over reporting requirements for the Homeowner Assistance Fund program. Questioned Costs: Assistance Listing # 21.026 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: To address the deficiencies identified by the auditors in completing annual performance reports, the Commission has taken the following corrective actions to strengthen controls over reporting for the Homeowner Assistance Fund (HAF) program: • Updated procedures to require: o Homeownership Division and Finance Division staff to perform regular reconciliation of records to identify any discrepancies and to ensure all records are complete and accurate. o Supporting data obtained for reporting be vetted by the contractor and the Homeownership Division staff. o Leadership (division manager or above) to perform final review of data as well as the quarterly or annual report prior to submission to the grantor. • Designated the records maintained by the Finance Division, specifically the general ledgers, as the source of financial data for the quarterly and annual reports for the Washington HAF program. • Required third parties to develop or update a program manual regarding data used for reporting purposes. The manual incorporated recommendations of the audit finding. As of June 30, 2024, the Commission consulted with the U.S. Department of the Treasury to determine if revision and resubmission of the reports are necessary to correct amounts reported. No corrective action was required. The conditions noted in this finding were previously reported in finding 2023-025. Completion Date: June 2024 Agency Contact: Lucas Loranger Senior Finance Director 1000 Second Ave, Suite 2700 Seattle, WA 98104-3601 (206) 464-7139 Lucas.Loranger@wshfc.org

Finding: The Housing Finance Commission did not have adequate internal controls over earmarking requirements for the Homeowner Assistance Fund program. Questioned Costs: Assistance Listing # 21.026 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Commission has taken the following corrective actions to strengthen controls over earmarking requirements for the Homeowner Assistance Fund (HAF) program: • Developed a system to track and monitor expenditures in relation to overall program expenditures to ensure earmarking requirements are within allowable parameters. • Selected an increased percentage of approved, denied, and withdrawn HAF applications that have previously been reviewed by the contractor, as part of the Quality Control process, for a secondary review by program staff. • Reviewed a selection of HAF applications independent of the Quality Control process performed by the contractor. • Reviewed a selection of approved HAF applications prior to disbursing funds to confirm eligibility determinations are proper. The conditions noted in this finding were previously reported in finding 2023-023. Completion Date: October 2024 Agency Contact: Lucas Loranger Senior Finance Director 1000 Second Ave, Suite 2700 Seattle, WA 98104-3601 (206) 464-7139 Lucas.Loranger@wshfc.org

Finding: The Housing Finance Commission did not have adequate internal controls over eligibility requirements for the Homeowner Assistance Fund program. Questioned Costs: Assistance Listing # 21.026 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Commission has taken the following corrective actions to strengthen controls over eligibility requirements for the Homeowner Assistance Fund (HAF) program: • Selected an increased percentage of approved, denied, and withdrawn HAF applications that have previously been reviewed by the contractor, as part of the Quality Control process, for a secondary review by program staff. • Reviewed a selection of HAF applications independent of the Quality Control process performed by the contractor. • Reviewed 100% of approved HAF applications prior to disbursing funds to confirm eligibility determinations are proper. The conditions noted in this finding were previously reported in finding 2023-022. Completion Date: June 2024 Agency Contact: Lucas Loranger Senior Finance Director 1000 Second Ave, Suite 2700 Seattle, WA 98104-3601 (206) 464-7139 Lucas.Loranger@wshfc.org

Finding: The Washington State Department of Transportation did not have adequate internal controls over and did not comply with quality assurance program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed testing for projects funded by the Highway Planning and Construction program. Questioned Costs: Assistance Listing # 20.205 Amount $0 Status: Corrective action in progress Corrective Action: The Department is committed to ensuring that our grant programs comply with federal regulations related to quality assurance (QA) requirements and safeguarding that materials and workmanship conform to approved plans and specifications through testing, inspections, or certifications. The Department has worked closely with the Federal Highway Administration (FHWA) on our QA program and continues to receive feedback on the strength of our program. As indicated in the prior year’s corrective action plan concerning a similar issue, the Department has been working towards replacing the Record of Materials (ROM) legacy system. Therefore, it was not practical to modify the system to help correct issues previously reported in the fiscal year (FY) 2022 and 2023 audits. During FY 2023, the Department eliminated the practice requiring updates to the ROM within 30 days of payment and instead relied on the required documentation as evidence of proper materials acceptance. The FY 2024 audit identified only two out of 58 materials tests that were either not documented properly or the required test was not performed. In January 2023, as a result of recommendations from the FY 2022 audit, the Department modified its practice related to how tester data is reviewed and entered into the tester certification tracking system. All offices now funnel tester data to the Headquarters Quality Systems Section for review and entry. These procedure changes were communicated to appropriate staff and are reflected in the Construction Manual, which was reviewed and approved by FHWA. The Department is assessing the replacement of additional software legacy programs associated with the QA program. Due to the timing of the implementation, these changes were not fully reflected in the current year’s audit for the auditors to perform control testing. Nevertheless, only four out of 57 testers were found to have certification issues during the FY 2024 audit. The Department will continue to improve the QA program while waiting for the new software programs to be fully developed. To address the audit recommendations, the Department’s Construction Division will examine current policies and procedures/practices related to the audit issues. The Department will: • Communicate with the FHWA to discuss the audit’s recommendations and any changes required to be compliant with federal requirements. • Provide training to Project Engineering Office staff to emphasize QA program requirements, the FY 2024 finding, and audit exceptions. • Update policies and procedures as needed from discussions and training above. • Obtain approval of updates to the Construction Manual from the FHWA, if needed. • Communicate changes in policies and procedures to division staff and stakeholders. The conditions noted in this finding were previously reported in findings 2023-014, 2022-011, 2021-011, 2020-017, and 2019-019. Completion Date: Estimated June 2025 Agency Contact: Jesse Daniels External Audit Liaison PO Box 47320 Olympia, WA 98504-7320 (360) 705-7035 danielje@wsdot.wa.gov

Finding: The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to collect certified payrolls from contractors on projects funded by the Highway Planning and Construction program. Questioned Costs: Assistance Listing # 20.205 Amount $0 Status: Corrective action in progress Corrective Action: In July 2020 and November 2024, the Department received management decision letters from the Federal Highway Administration (FHWA) in response to similar findings for the fiscal years 2018, 2019, and 2023, respectively, which stated: • FHWA approved the Department’s Construction Manual and Standard Specifications and confirmed that documented procedures contain the necessary controls to ensure reasonable compliance with 29 CFR 5.5 and the Davis-Bacon and Related Acts. • FHWA agreed that current processes in place are reasonable and satisfy the intent of the Department of Labor’s certified payroll requirements. • Ensuring all certified payrolls are collected, and considering sanctions or other appropriate actions for missing payrolls using the methods outlined in WSDOT’s procedures provide sufficient internal control and reasonable compliance, notwithstanding the collection of the payrolls within a seven-day period. • FHWA considers this finding to be resolved. The Department continues to strive for improvements in this area. To further address the prior year’s audit recommendations, the Department took actions to update the Construction Manual, which was approved by FHWA and released in February 2025. This includes: • Updated language for certified payroll collection requirements when no work is performed on federal projects. • Clarified the authority to withhold payments regarding federal wage administration. • Standardized the required frequency of checking for certified payroll collection and the methods to document tracking. • Defined “timely,” given the circumstances surrounding weekly collection of certified payrolls and sanctions on a monthly pay estimate, including: o The timeline when the Department must communicate overdue certified payroll to the contractor and the allowable methods of that communication. o The timeline for determining when the Department must consider imposing sanctions on the contractor after a certified payroll is overdue. o The minimum required documentation that sanctions (e.g., partial deferral of payment) were considered against the contractor regarding an overdue certified payroll. The Department discussed the updates to the Construction Manual and the audit findings at the statewide Documentation Engineering meeting, which was held in February 2025. Additionally, the Department will: • Release the Construction Bulletin to include highlights on the updates in the Construction Manual. • Share the details of the audit testing and exceptions with the Regional Documentation Engineers. The conditions noted in this finding were previously reported in finding 2023-013. Estimated June 2025 Jesse Daniels External Audit Liaison PO Box 47320 Olympia, WA 98504-7320 (360) 705-7035 danielje@wsdot.wa.gov

Finding: The Washington State Department of Transportation did not have adequate internal controls over and did not comply with federal requirements for suspension and debarment and wage rate notification. Questioned Costs: Assistance Listing # 20.205 Amount $0 Status: Corrective action complete Corrective Action: The Department is committed to ensuring our programs comply with federal regulations related to procurement, suspension, and debarment. The Department has policies and procedures in place, approved by the Federal Highway Administration (FHWA), to ensure all federally funded construction contracts have the necessary elements to meet both state and federal requirements. The Department provided clear guidance to teams to ensure Form FHWA-1273 Required Contract Provisions Federal-Aid Construction Contracts is included in all contracts. It was simply a mistake that Form 1273 was left out of the contract in question. In this case, the contract documents were some 1,200 pages and the inclusion of this form in an appendix was overlooked by the project team. As a result of various other checks and balances in place, the Department subsequently discovered the oversight and a change order was executed on July 18, 2024, to include the form. This was completed before any contract work commenced and prior to audit work beginning for the program. For added assurance, all contracts include language that requires the contractor to meet the various requirements associated with Form FHWA-1273, whether the form is included in the contract or not. The Department had follow-up conversations with appropriate staff to ensure all contracts awarded contain the required elements. Completion Date: February 2025 Agency Contact: Jesse Daniels External Audit Liaison PO Box 47320 Olympia, WA 98504-7320 (360) 705-7035 danielje@wsdot.wa.gov

Finding: The Employment Security Department did not have adequate internal controls over and did not comply with requirements to ensure it profiled all claimants under the Unemployment Insurance program to identify people likely to need reemployment services and ensure staff providing those services received required training. Questioned Costs: Assistance Listing # 17.225 17.225 COVID-19 Amount $0 Status: Corrective action in progress Corrective Action: The Department concurs with the audit recommendation to review the Worker Profiling and Reemployment Services calculation of the profile score within the Unemployment Tax and Benefit (UTAB) system. In response to the prior year’s finding, the Department began investigating the process of the score calculation in October 2024. The Department is also examining resource allocation to more effectively validate the profile score and ensure that coefficient values are correctly determined and assigned by the UTAB system. The Department partially concurs with the recommendation to reconcile the UTAB and Reemployment Appointment Scheduler (RAS) interface. There is currently a process in place to notify the RAS team if a record fails at the time of data transmission between UTAB and RAS. The Department will review its processes to verify the complete UTAB exit file was successfully received by RAS. The Department partially concurs with the recommendation to ensure staff have completed the required training before providing services to claimants. The Department currently monitors local offices to ensure staff have taken the required training to be able to provide reemployment screening services to claimants. The exception cited in the finding was due to one staff out of 277 who missed the refresher training during fiscal year 2024. The Department will continue to monitor local staff training to ensure compliance. The conditions noted in this finding were previously reported in finding 2023-010. Completion Date: Estimated May 2025 Agency Contact: Jay Summers  External Audit Manager   PO Box 9046   Olympia, WA 98507-9046  (360) 529-6718  Joshua.Summers@esd.wa.gov

Finding: The Employment Security Department did not have adequate internal controls to ensure compliance with federal requirements to annually certify that employer tax credits reported under the Federal Unemployment Tax Act are matched against employer contributions paid under the Unemployment Insurance program. Questioned Costs: Assistance Listing # 17.225 17.225 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Department is committed to ensuring that the required reports for the Federal Unemployment Tax Act are properly reviewed and in compliance with federal requirements. The Department has a process in place for a secondary review of the employer tax credit reports prior to certification. The two exceptions identified in the audit were isolated incidents where both the preparer and reviewer missed one of the 50 lines on the two reports being reviewed. The Department will ensure management adequately reviews employer account reconciliations performed by staff to ensure the required number of accounts are reviewed for all reports prior to submission. Completion Date: February 2025 Agency Contact: Jay Summers External Audit Manager PO Box 9046 Olympia, WA 98507-9046 (360) 529-6718 Joshua.Summers@esd.wa.gov

Finding: The Employment Security Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the Benefit Accuracy Measurement program of the Unemployment Insurance program in a timely manner. Questioned Costs: Assistance Listing # 17.225 17.225 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Department is committed to ensuring our Benefit Accuracy Measurement (BAM) program complies with federal regulations. Historically, the BAM unit has been challenged to maintain full levels of staffing. Staff turnover, lengthy training requirements, and unique skill sets make these positions difficult to maintain. The Department has implemented changes to position descriptions which have resulted in the hiring and retention of qualified staff. As a result, the unit has improved its case sampling timelines by implementing regular case reviews to ensure the 60-day, 90-day, and 120-day timelines are met. Additionally, the Department, in collaboration with the U.S. Department of Labor (USDOL), developed a State Quality Service Plan (SQSP) which includes metrics to improve program outcomes. The team has implemented additional internal communication to follow up on cases which are approaching the 120-day timeline. Although the 120-day timeline is not an improvement measure listed on the SQSP, the Department will continue to work with USDOL to implement guidance and processes to meet the 120-day requirement. The conditions noted in this finding were previously reported in findings 2023-009, 2022-006, 2021-005, and 2020-011. Completion Date: January 2025 Agency Contact: Jay Summers External Audit Manager PO Box 9046 Olympia, WA 98507-9046 (360) 529-6718 Joshua.Summers@esd.wa.gov

Finding: The Office of Superintendent of Public Instruction did not have internal controls over and did not comply with requirements to verify single audits were completed for all subrecipients of the Child and Adult Care Program. Questioned Costs: Assistance Listing # 10.558 Amount $0 Status: Corrective action in progress Corrective Action: The Office has implemented internal controls to ensure all subrecipients requiring a single audit are identified and to follow up on any program-related findings that require a management decision. Procedures are also updated to maintain the subrecipient audit tracking log. The Office will implement a training plan for the Child Nutrition Services fiscal team, which includes cross training and completing the State Auditor’s Office subrecipient monitoring training. The Office will follow up with the subrecipient identified in the audit to ensure it obtains its required single audit. The conditions noted in this finding were previously reported in finding 2023-004. Completion Date: Estimated June 2025 Agency Contact: Debbie Libra Fiscal & Claims Supervisor PO Box 47200 Olympia, WA 98504-7200 (564) 233-8620 Debbie.libra@k12.wa.us

See the PDF.

The RIEMA Recovery staff will conduct an additional review of all projects prior to obligation including both small and large projects. This review will include not only that the state required documentation is included but will also review the FEMA final validation report submitted with the project. We acknowledge the errors which were reported by the State audit review of project number 694201 for federal disaster declaration DR-4505-RI. The agency will contact the Office of Housing and Community Development of the finding and they will be required to reimburse FEMA the unallowable costs. Anticipated Completion Date: RIEMA is implementing this immediately for all project reviews. Contact Person: Lawrence Macedo, Recovery Branch Chief, Rhode Island Emergency Management Agency lawrence.macedo@ema.ri.gov

This audit finding refers to retroactive Medicaid billing from BHDDH for dates of service in 2022 and 2023 once the IMD status was removed from ESH. That provider type currently does not require the Medicare information to be submitted to EOHHS for processing. They bill with a type of bill and if there is eligibility on file for Eleanor Slater, the claim is paid. EOHHS will pursue a project to correct this finding. Project PH0630 - OI Edit for ESH was created and is being worked on by Gainwell and the State. The Project Charter states that the state must have controls in place to ensure that claims from the State Hospital, including Eleanor Slater Hospital (ESH) are reimbursed by Medicaid as the payer of last resort. Meetings, requirements gathering, and business designs are ongoing. The Business Design is anticipated to be completed by end of April 2025. Anticipated Completion Date: To Be Determined Contact Person: Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov

2024-065a: Rhode Island did not participate in the February 2024 PARIS interstate match due to a file issue that has since been addressed in April 2024. The May and August 2024 PARIS matches were suspended at the Federal level for all States due to an outstanding computer matching agreement between the DoD and HHS/ACF. Enhancements to existing PARIS Interstate match logic are scheduled to run as planned for fall/winter 2025. EOHHS completed implementation of an interface on 3/5/24 between The Work Number (TWN) and RI Bridges. Contract and budget actions for TWN services were not completed until fall 2024. The system requirements that Equifax initially communicated to the State and our Integrated Eligibility System implementation partner were incomplete and the original integration configured in fall 2024 did not successfully pass testing. A system modification to correct the original specifications was originally scheduled for February 2025 but was delayed due to the 12/13/24 RI Bridges cyber event. Target date for TWN implementation is July 2025. The Death Match process resumed in Spring 2025. Long-term modifications are scheduled for December 2025. These modifications include connecting RI Bridges to the SSA Death Master File (DMF) and utilizing the data from DMF as the primary source for monthly death verifications. During SFY 2024, several system fixes were deployed to address the findings noted in 2024-065. Specifically, in September 2024, a system fix was put in place to ensure children with verified SSNs were appropriately evaluated for Medicaid/CHIP coverage and excluded from Cover All Kids. The system automatically identifies individuals aging out of Medicaid Expansion prior to their 65th birth month and redetermines eligibility. EOHHS will improve controls of this process and ensure that if the system is unable to accurately remove the member from the Medicaid expansion category, a manual workaround will be implemented. Anticipated Completion Date: January 1, 2026 Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-065b: EOHHS will proactively work with the system vendor and other State agencies to implement controls over eligibility system and process deficiencies. Corrective actions will include, but are not limited to, manual processes, code fixes, and new system enhancements. Anticipated Completion Date: Ongoing Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-065c: EOHHS will identify and return any potential ineligible costs by end of the current Federal Fiscal Year (FFY). Anticipated Completion Date: September 30, 2025 Contact Person: Allison Shartrand, Assistant Director, Financial & Contract Management, Executive Office of Health and Human Services allison.shartrand@ohhs.ri.gov

EOHHS amended and updated its guidelines and standard operating procedures leveraging the CMS ‘Delivering Service in School-Based Settings: A Comprehensive Guide to Medicaid Services and Administrative Claiming’ as a source document. In addition to ensuring alignment with CMS requirements, the updated guidelines include a uniform schedule of quarterly submission dates and details the billing responsibilities of participating LEAs. These responsibilities include meeting all Medicaid documentation requirements; submitting the Certification of Local Funds on a quarterly basis; and signing provider agreements and maintaining all other records used to support claims submitted for Medicaid reimbursement. Upon receipt of these submissions a new audit tool will be utilized to ensure each submissions contains the required documentation. Beginning June 2025, EOHHS will initiate on-site reviews of twenty (20) LEAs using a tiered, randomized sample of claims from State Fiscal Year 2023 (SFY23). The sample will include claims with at least 20 claims per LEA, selected to ensure wide geographic representation. If documentation is missing, incomplete, or found to be in error, the LEA and their billing contractor will be notified and corrective action will be implemented. Lastly, EOHHS is also working in partnership with the CMS School-Based Services Technical Assistance Center to ensure continued alignment with federal expectations and the implementation of national best practices in school-based Medicaid claiming and update guidance. Anticipated Completion Date: Administrative Claiming Materials – June 1, 2024; On-site Audit – June 30, 2025 Contact Persons: Tyler McFeeters, Health Program Administrator, Executive Office of Health and Human Services tyler.mcfeeters@ohhs.ri.gov Mark Kraics, Deputy Medicaid Director, Executive Office of Health and Human Services mark.kraics@ohhs.ri.gov

Each health plan reports TPL recoveries to EOHHS in its quarterly financial report (FDCR). These recoveries are used as a direct offset to medical expenses. As such, claims paid by the plans on behalf of a member with TPL will remain in the EOHHS encounter data warehouse. Health plans do not void claims that have previously been paid to account for any TPL liability. Rather, they seek to recover from the third party any amount owed and report that amount to the state. In each of the last two fiscal years, this reduced medical expenditures by just under $8 million. 2025 Update: Following the process from 2023 and 2024, we are requesting a new TPL files from Gainwell that will be shared to each MCO. Anticipated Completion Date: Ongoing Contact Person: Jeffrey Schmeltz, Chief, Family Health Systems, Executive Office of Health and Human Services jeffrey.schmeltz@ohhs.ri.gov

EOHHS has met expectations on aligning the FSR and FDCR reports, has updated files to Milliman, and continues to monitor compliance. EOHHS is currently in a maintenance phase and will continue monthly oversight going forward. Anticipated Completion Date: Current and Ongoing Contact Person: Steven Corvese, Plan Analyst, Executive Office of Health and Human Services steven.corvese@ohhs.ri.gov

EOHHS: The EOHHS Finance team created a Medicaid Administrative Claiming Reporting training presentation and trained all sister agencies with expectations for administrative claiming. The training included the following topics: administrative claiming background; completing required CMS-64 quarterly reporting for EOHHS which include timelines and supporting documentation; and frequently asked questions. The team also created a draft manual and shared this manual with the Medicaid admin claiming agencies. Additionally, EOHHS hired an additional FTE in the Medicaid Finance team during Autumn 2024 to support Medicaid Administrative Claiming of all agencies; however, this FTE was unable to commence work due to being placed in a three-day rule as acting Medicaid CFO. The FTE will resume full-time work in the new position in mid-May 2025. The goal of this position will be to work with the EOHHS Medicaid and Central Management teams to develop processes to address the audit findings. The Medicaid Finance team also has worked closely with the Medicaid program’s Division of Executive Administrative and Support Services to develop cross-training and draft SOPs related to the CMS-64. BHDDH: BHDDH concurs with this finding. Since the finding, BHDDH has refined their internal processes related to administrative claiming adding an additional staff member to doublecheck the Medicaid administrative claiming reporting to reduce the likelihood of future errors. The team members also conduct a reconciliation after the Medicaid cost allocation plan is processed. As of SFY 25 Q2 all time tracking is done internally for increased accuracy and more timely journal entries. Anticipated Completion Date: Ongoing Contact Persons: Dezeree Hodish, Associate Director (Financial Management), Executive Office of Health and Human Services dezeree.hodish@ohhs.ri.gov Deborah Mazzone, Deputy Finance Director, Department of Behavioral Healthcare, Developmental Disabilities and Hospitals deborah.l.mazzone@bhddh.ri.gov

Management agrees with the findings, with some concerns noted in the corrective actions below. These corrective action steps are separated by specific health and safety finding. Background Checks: DHS will prioritize an emergency reopening of the regulations for both family and child care center regulations to require all providers and staff who work with children to enroll in the workforce registry no later than one month after promulgation. This will allow DHS staff to access employee files in real time to ensure that all staff have appropriate and current comprehensive background checks in their digital files. Until this regulation goes into effect, DHS will implement an immediate policy that all staff who work with children have their staff files audited as part of on-site monitoring visits. Previously, DHS looked only at those staff who were new since this last visit. However, this led to expired background checks being found during the audit. These expired checks also counted as not being able to demonstrate completion of the background check. DHS does want to acknowledge that during this audit, all staff were required to show evidence of a comprehensive background check. This included staff who did not have access to children and/or were not in the building when children were present. This does not align with regulation 218-RICR-70-00-1.12.A.1 which states, “All individuals working or engaging directly with children who are employed or act as a volunteer in the program, must complete all requirements of a comprehensive background check as outlined here: https://dhs.ri.gov/programs-and-services/child-care/child-care-providers/background-checks.” While the auditing team was informed of this, those staff not working with children who were on a payroll sheet were included as a finding against the Department. DHS will send out communication to the field alerting them that the lack of background checks is not tolerated. Staff who do not have these checks on file will be sent home until a background check is received (a practice that already exists, but typically the licensor is not looking at all files for every visit). For center providers, any staff or provider who is found to not have this information will be told to leave the program until this evidence is found. This may result in programs needing to temporarily close due to staff ratio issues. For family child care providers, this will involve a file audit of all received background checks, as well as a visit to ensure that there are no additional or new household members who have not completed this check. Any provider who has not submitted or completed an updated background check will be required to close until received. Any provider who is found to have household members who have not been listed and/or completed appropriate background checks will be closed due to failure to adhere to regulations. Immunizations: DHS recognizes and supports the importance of ensuring children are receiving timely vaccinations. However, DHS also recognizes that providers are only able to gather this data directly from families. Families who do not provide updated immunizations may be excluded from care if they do not provide these records. DHS will communicate with providers that no child should be enrolled without this documentation and that failure to provide updates to this documentation can result in dismissal from the program. DHS does not know if any of the children identified in this finding had medical or religious exemptions for their immunizations but would challenge that this finding could be skewed if this additional information was not ascertained by the auditing team. DHS will continue to partner with the Rhode Island Department of Health to ensure that programs are actively monitored and surveyed regarding immunization documentation. Emergency Preparedness Plan: DHS has been working with providers to ensure they have documented the required components of an emergency preparedness plan as required by federal funding agencies. DHS is requiring providers to include the DHS emergency plan form as part of renewal (for already existing providers) or as part of initial licensure. Absence of this form does not mean that the criteria is not being met. DHS did not train the auditors on what these required areas were and cannot speak to how this was monitored. However, DHS will continue to work with our providers to ensure that these criteria are met as part of the requirements in RISES. DHS has also created a training with The Center for Early Learning Professionals that reviews how to complete this plan and implement through practice. Unallowable Items In Cribs: This audit found that 30% of providers were found to have unallowable items in cribs. For the purposes of this audit, this finding included cribs that did not have children sleeping in them. Per the regulations for both Family and Child Care Centers, “No items are placed in the crib with an Infant except for a pacifier.” (218-RICR-70-00-2.3.3.C.1.k and 218-RICR-70-00-1.10.C.i respectively) DHS requests that only those providers who were found to have children in cribs with items be included in the finding. DHS has worked with The Center for Early Learning Professionals to develop individual trainings related to safe sleep. Providers who are found to be noncompliant regarding safe sleep practices are referred to those trainings with additional monitoring visits occurring to ensure changes have been made. As a result of this audit, DHS will inform providers that any safe sleep violations may result in a probationary status with additional licensing action possible if the continued noncompliance with safe sleep is observed. Toxic Substances unlabeled and accessible: DHS continues to monitor for this in both Family Child Care and Center-based programs. Typically, these are addressed and corrected onsite. Repeated noncompliance in this area can lead to probationary status. DHS will be reviewing the probationary process and use Technical Assistance with our federal funders to evaluate how other states address probation and other licensing actions. The goal is to solidify the current processes to ensure that there is an appropriate escalation review for repeated noncompliance that starts with probation and possibly lead to suspension of license. This will be communicated regularly to all providers. Developmental history: Per regulations, developmental histories are required only for programs serving infants and toddlers. Per Family Child Care regulation (218-RICR-70-00-2.3.6.F.7.a) and Child Care Center regulation (218-RICR-70-00-1.13.F.8.a), only files for infants and toddlers must contain developmental histories. DHS is unable to confirm whether or not this finding is related to this age group or if this finding occurred because age groups beyond that were assessed for compliance. Without this clarification, DHS would contest that this finding is accurate. DHS continues to support the provider community - both Family Child Care and Center providers - ensuring that they have gathered as much information as possible on the children they are enrolling in care. DHS will continue to audit files while on site to ensure that infants and toddlers have these documents completed. In the new RISES system, new providers who identify the desire to be licensed for either age group are required to submit examples of these forms as part of the initial application. For current providers, those serving these age groups will not be able to submit their first renewal in the system without uploading examples of these completed forms. Anticipated Completion Date: Background Checks: DHS will meet with policy staff immediately to discuss the emergency promulgation of new regulations. DHS will also immediately send out an email to the provider community regarding the outcomes of this audit and the responses that DHS intends to implement. Monitoring of programs, including for compliance of this regulation, will be ongoing. All other findings will be addressed in an ongoing fashion. Contact Person: Nicole Chiello, Assistant Director, Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov

DHS has a policy for subrecipient monitoring, which includes documentation required to be submitted by a subrecipient. The documentation is based on assessing the risk of each subrecipient. There is no requirement in the Uniform Grant Guidance in regard to supporting documentation requirements. The invoice needs to be certified by an authorized agent and the expense needs to have been reasonably incurred. DHS ensures compliance in numerous ways, including monthly programmatic meetings, site visits, review of single audits and past performance. Additionally, DHS contracts include a budget narrative and allows for DHS to require additional documentation for audit purposes. If requested, DHS would have been able to produce more documentation to satisfy the allowability of costs. Anticipated Completion Date: Not Applicable Contact Person: Ben Quattrucci, Associate Director Financial Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov

RIDOH agrees with the finding and recommendation. Corrective action plan: • In gathering time sheets for the requested audit samples, RIDOH found that some Master Time Sheet Coordinators (staff responsible for receiving signed time sheets, populating the Master Time Sheet spreadsheets sent weekly from/to HR/Payroll, and saving time sheets to the Time Sheet Repository in Teams) were saving documents locally instead of in the central Teams site. RIDOH is providing training and increased oversight of the non-compliant Time Sheet Coordinators and is conducting ongoing checks of the time sheets uploaded to Teams weekly to assure the time sheets are saved properly. • Instructions have been provided and will be reiterated Department-wide that all time sheets must be signed and dated by both the employee and supervisors, and signatures without dates are not acceptable. • RIDOH will adjust the questioned costs for ELC and DWSRF to appropriate non-federal funds. • RIDOH has been working to move staff that use the general category codes (i.e., EH Management & Leadership) to non-federal funding sources as much as possible and will begin requiring staff on federal funds to record their hours for each federal grant separately. This is a complicated process and will be fully implemented once Time and Effort reporting is transferred to Workday (the ERP). Anticipated Completion Date: The first three bullets above will be completed by June 30, 2025. Transition of Time and Effort reporting to Workday has been delayed, and the new target implementation date has not been announced. Contact Persons: Alisha Colella, Chief Financial Officer, Department of Health alisha.colella@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Department of Health carla.lundquist@health.ri.gov

RIDOH agrees with the finding and recommendations and will develop and implement enhanced internal controls over Uniform Grant Spreadsheets (UGSs) to assure that all indirect cost billings and drawdowns of federal funds are appropriate and accurate. The UGS internal controls will include (but are not limited to): • Mandatory refresher training for all staff that complete and/or review UGSs, with focus on areas of potential errors and correct entry of UGS data in the Monthly Federal Grants Tracking spreadsheet used for drawdowns and indirect billing. • Providing a crosswalk of expenditure categories and natural accounts to grants management staff to assure appropriate and consistent assignment of transactions to categories subject to/not subject to indirect costs. • A rotating schedule of monthly in-depth reviews of UGSs to assure that data entry aligns with RIFANS transaction reports, transactions are recorded so natural accounts align with correct expenditure categories, the appropriate indirect cost rate is entered, and formulas for computation of indirect costs are not corrupted. Reviews will be conducted by supervisors of staff completing UGSs, and results will be reported to the Deputy CFO/Federal Grants Manager. • Review of the Monthly Federal Grants Tracking spreadsheets each month before indirect cost billing and federal drawdowns are completed, to assure that expenditures reported align with RIFANS reports and indirect billings and drawdown requests are appropriate. RIDOH credited the ELC Enhancing Detection federal award for the unallowable indirect costs on 3/14/2025 (J25075GMC530). The credit was calculated using RIFANS transaction data from 7/1/2020 through 3/13/2025, not from the UGSs. The UGSs for this award and others are being re-built from the start of the award using RIFANS data in new, less complicated templates to assure correct charging and reporting going forward. Anticipated Completion Date: July 31, 2025 Contact Persons: Alisha Colella, Chief Financial Officer, Department of Health alisha.colella@health.ri.gov Carla Lundquist, Deputy CFO / Federal Grants Manager, Department of Health carla.lundquist@health.ri.gov

2024-044a: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044b: Management agrees with this finding and will communicate the requirements for subrecipient monitoring and specifically the review of single audit reports to our agency partners for implementation. 2024-044c: Management agrees with this finding and will communicate the requirements for subrecipient monitoring; specifically, the documentation of expenses, and meeting notes. Anticipated Completion Date: Completed April 23, 2025 Contact Persons: Paul L. Dion, Director, Pandemic Recovery Office, Department of Administration paul.l.dion@doa.ri.gov Brianna Ruggiero, Chief of Staff, Pandemic Recovery Office, Department of Administration brianna.ruggiero@doa.ri.gov

Quonset Development Corporation (QDC) disputes the finding, asserting that since the MARAD grant funding was provided on a reimbursement basis, QDC did not have custody of Federal funds at any point. QDC was required to meet rigorous documentation standards for reimbursement prior to the release of any funds. QDC has created written policies and procedures specifically referencing Uniform Guidance in the case we receive Federal funding in the future. These policies will be implemented after the Board of Directors approves such policies at the April 2025 meeting. Anticipated Completion Date: Ongoing Contact Person: Patricia Testa, Chief Financial Officer, Quonset Development Corporation ptesta@quonset.com

Pursuant to federal SNAP regulations at 7 CFR 272.4(g) and corresponding state regulations, the Department is required to establish and operate a fraud detection unit, which is responsible for the detection and investigation of SNAP fraud. The Office of Internal Audit (OIA) at the Department of Administration, Office of Management and Budget, through a Memorandum of Understanding (MOU), provides DHS with fraud detection, investigation and prevention services across DHS’s public assistance programs, including SNAP. DHS staff refer to OIA SNAP cases in which staff suspect fraud. OIA, in turn, investigates the allegation. If OIA determines that the household has committed an intentional program violation of SNAP, they pursue disqualification of the individual(s) from the program, either through an administrative disqualification hearing (ADH), a waiver of ADH, or refer the case to the state police for criminal prosecution. If the individual is found to have committed the IPV, and received SNAP benefits they were not entitled to, DHS establishes an overpayment claim against the household’s liable individuals. The liable individuals are required to make payment agreements to return to DHS, the benefits they received, but were not entitled to. If the fraud is referred for criminal prosecution, the amount of overpaid benefits is determined by the Court through an Order for Restitution. DHS followed the established and required protocols in the case cited in this finding. DHS referred a case to OIA in which identity fraud was suspected. OIA, with DHS assistance, and collaboration from the USDA Office of Inspector General (OIG), conducted the investigation, which revealed, not only fraudulent actions, but also criminal behavior and a significant estimate of overpaid SNAP benefits. The case was referred to the U.S. Attorney’s Office for prosecution. The criminal case is currently pending. Once a disposition is issued, DHS will take the appropriate sanction actions(s), including any disqualification from the SNAP, as well establishing an overpayment claim for any restitution ordered. Pursuant to federal regulations, any collection by DHS of any overpaid SNAP benefits will be returned to the Food and Nutrition Service (FNS), with DHS retaining 30% as provided for in the regulations. Should the liable individual not pay the ordered restitution in a timely manner and the claim becomes delinquent, DHS will pursue all other available collection actions to recoup the overpaid benefits. OIA and DHS also engage in fraud prevention activities, mainly by utilizing data analytics and identifying case issues that are indicative of fraudulent activities. Once an issue is identified, OIA, in conjunction with DHS, review the impacted case population and determine actions that should be taken to mitigate the issue as well as educate customers on actions they can take to safeguard their benefits, including changing EBT card PINs, freezing cards or limiting access to out-of-state or internet transactions. Other prevention actions that may be taken include changes to the card security through vendor options, as well as widespread communication to customers and the public on new fraud trends, etc. OIA and DHS also provide training to DHS staff to spot fraud in cases, including identifying fraudulent/altered documents, use of invalid identification cards, and identity fraud trends, etc. Approximately 60% of DHS staff have completed or are in the process of completing the fraud training. Anticipated Completion Date: The criminal case is ongoing. Contact Person: Iwona Ramian, Deputy Chief Legal Counsel, Department of Human Services iwona.ramian@dhs.ri.gov