Corrective Action Plans

Name: Mainline Health Systems, Inc. Contact Name: Elyse Knobloch Contact Phone Number: 870.538.5414 Auditor/Audit Firm: Forvis Mazars, LLP Audit Period: January 31, 2026 Estimated Completion Date: June 2026 Finding #2026-001 – Statement of Condition Patients did not receive the proper sliding fee adjustments under the Organization’s policy. Response: The Organization concurs with the finding, and management has continued to implement procedures to ensure that eligible patients receive discounts in accordance with the sliding fee scale. Coordination with Revenue Cycle Management has occurred to ensure awareness across teams. Office Managers review all new sliding fee applications on a monthly basis to ensure accuracy, and the Billing Manager conducts quarterly audits of sliding fee claims to ensure adjustments are entered correctly by the billing department. The Organization also continues to provide staff training for all individuals involved in the sliding fee application process. Management has instructed all outsourced billers not to modify sliding fee adjustments; any required changes must be handled by in-house billing staff. Additionally, sliding fee adjustments auto posted in error will be removed. Management is also working with IT to restrict system access for outsourced users to prevent unauthorized adjustments. Additionally, IT will implement a scheduled monthly audit report to identify improper adjustments and monitor user activity.

In Finding 2026-001, it was reported that the Organization did not properly apply the sliding fee discounts to certain patients who visited the Organization during the year ended March 31, 2026. In addition, sliding fee applications were not maintained for all patients who received sliding fee discounts. Management recognizes the importance of complying with sliding fee guidelines and the Organization’s sliding fee policy. In response to Finding 2026-001, proper training will be given to employees and sliding fee applications and discounts will be reviewed by a supervisor on a monthly basis to ensure compliance with the sliding fee policy. The Organization will also establish procedures to ensure that sliding fee applications are maintained in accordance with the Organization’s policies.

Recommendation: To help ensure that sliding fee scale (SFS) discounts are properly calculated and documented, the Center should perform random reviews of its SFS applications to detect and correct errors or incomplete applications on a timely basis. Corrective Action Taken: 1. Immediate Review and Correction Upon determination of the finding, we conducted a full review of the affected patient account. 2. Staff Training All Outreach and Eligibility staff have received refresher training on the proper application of the sliding fee scale, including income verification processes and documentation standards. This training now occurs as part of onboarding and annually thereafter. 3. Policy and Procedure Review We reviewed our internal policies and procedures to ensure clear guidance on income documentation requirements, allowable income sources, and how to properly apply the sliding scale. 4. Double-Verification Process A second-level review has been instituted for all new patient applications and renewals involving sliding fee scale determinations. This ensures that income is correctly assessed, and the appropriate fee level is applied before any charges are finalized. 5. Audit and Monitoring A quarterly internal audit process has been implemented to review a random sample of sliding fee scale determinations for accuracy. Findings from these audits will be tracked, and any trends will be addressed through targeted training or process changes. The corrective actions implemented in the prior year were maintained consistently throughout the current audit period. Based on our evaluation, the processes put in place were operating effectively as designed. The issue identified this year stemmed from front office personnel having access to modify SFS assignments after they had already been appropriately verified and assigned. This access created the opportunity for adjustments outside of the established control process. While the prior corrective actions were effective, we have identified the need for an additional control enhancement. Accordingly, an immediate control has been implemented (see item 6 below) to further restrict access and prevent unauthorized modifications. 6. EMR Restriction As a result of the additional finding identified in 2026, UCHC’s IT Department access to SFS assignments and modifications within the EHR will be restricted exclusively to the Eligibility Team. No other personnel will be permitted to make changes to SFS assignments. All requests for adjustments must be submitted to the Eligibility Team, which will be responsible for thoroughly reviewing and validating each request prior to implementing any changes.

Management agrees with the finding and will put processes and controls in place to verify timely deposits in the future. The required deposit of $4,477 was made in July 2025 to the residual receipts account. The corrective response has already been put into place for this fiscal year.

Supportive Housing for Persons with Disabilities CFDA No. 14.181 U.S. Department of Housing and Urban Development (“HUD”) Criteria or Specific Requirement – Special Tests and Provisions: (24 CFR section 891.400(e)) Condition – The Organization is required to establish a separate project fund interest bearing account in a federally insured depository. During the fiscal year the project fund was not in an interest-bearing account. Questioned Costs - None Context – During the fiscal year the project fund was not included in a interest bearing account. Effect – The Organization did not properly comply with the special test and provisions requirements. Cause – The Organization’s internal controls did not properly identify the project fund was not maintained in an interest-bearing account. Identification as a repeat finding – Not a repeat finding. Recommendation – The Organization should move the project fund into an interest-bearing account. Views of Responsible Officials and Planned Corrective Actions – During the 2027 fiscal year management will move the project fund to an interest-bearing account and implement procedures to periodically review the project fund and other HUD accounts for compliance with HUD requirements. This corrective action plan will be monitored by Nathan Mordica, Controller and Michael Jones, Director of Accounting, and is anticipated to be completed by the end of fiscal year 2027, or March 31, 2027.

Supportive Housing for Persons with Disabilities CFDA No. 14.181 U.S. Department of Housing and Urban Development (“HUD”) Criteria or Specific Requirement – Special Tests and Provisions: (24 CFR section 891.400(e)) Condition – The Organization is required to establish a separate project fund interest bearing account in a federally insured depository. During the fiscal year the project fund was not in an interest-bearing account. Questioned Costs - None Context – During the fiscal year the project fund was not included in a interest bearing account. Effect – The Organization did not properly comply with the special test and provisions requirements. Cause – The Organization’s internal controls did not properly identify the project fund was not maintained in an interest-bearing account. Identification as a repeat finding – Not a repeat finding. Recommendation – The Organization should move the project fund into an interest-bearing account. Views of Responsible Officials and Planned Corrective Actions – During the 2027 fiscal year management will move the project fund to an interest-bearing account and implement procedures to periodically review the project fund and other HUD accounts for compliance with HUD requirements. This corrective action plan will be monitored by Nathan Mordica, Controller and Michael Jones, Director of Accounting, and is anticipated to be completed by the end of fiscal year 2027, or March 31, 2027.

Supportive Housing for Persons with Disabilities CFDA No. 14.181 U.S. Department of Housing and Urban Development (“HUD”) Criteria or Specific Requirement – Special Tests and Provisions: (24 CFR section 891.400(e)) Condition – The Organization is required to establish a separate project fund interest bearing account in a federally insured depository. During the fiscal year the project fund was not in an interest-bearing account. Questioned Costs - None Context – During the fiscal year the project fund was not included in a interest bearing account. Effect – The Organization did not properly comply with the special test and provisions requirements. Cause – The Organization’s internal controls did not properly identify the project fund was not maintained in an interest-bearing account. Identification as a repeat finding – Not a repeat finding. Recommendation – The Organization should move the project fund into an interest-bearing account. Views of Responsible Officials and Planned Corrective Actions – During the 2027 fiscal year management will move the project fund to an interest-bearing account and implement procedures to periodically review the project fund and other HUD accounts for compliance with HUD requirements. This corrective action plan will be monitored by Nathan Mordica, Controller and Michael Jones, Director of Accounting, and is anticipated to be completed by the end of fiscal year 2027, or March 31, 2027.

Finding: 2025-003 Condition Found: During testing of a statistically valid sample of 19 patient accounts that received sliding fee discounts, 2 patient files did not contain eligibility documentation to support that the patients qualified for the sliding fee discount at the time the discount was applied Individual(s) Responsible for Corrective Action: Chief Executive Officer, Fractional CFO, Billing Team Planned Corrective Action: The Organization revised its sliding fee discount policies, implemented centralized documentation tracking, and enhanced staff training related to eligibility determination and documentation requirements. Monitoring procedures, including periodic supervisory review, were established to ensure compliance. Anticipated Completion Date: Implemented and in progress. Due to the timing of the prior year’s audit completion, the Organization did not have time to complete a full monitoring cycle prior to audit testing.

Federal Award Finding 2025-005 - Material Weakness, Material Non-Compliance - Special Tests and Provisions, Surplus Cash and Distributions to Owners or Affiliates Finding: During the fiscal year ended December 31, 2025, project management did not prepare or document a surplus cash calculation in accordance with HUD requirements, nor did management implement controls to review, approve, or retain documentation supporting the required calculation. Recommendation: Management should establish and implement formal policies and procedures to ensure that surplus cash is independently calculated in accordance with HUD requirements and the applicable HUD Regulatory Agreement. Such procedures should include preparation of a documented surplus cash calculation at each required reporting period using HUD-prescribed criteria; Independent review and approval of the surplus cash calculation by appropriate management personnel or, where applicable, the court-appointed receiver; and retention of supporting documentation sufficient to demonstrate compliance with HUD restrictions on the use and distribution of project funds. Management should coordinate with the court-appointed receiver and HUD to ensure that surplus cash determinations are performed consistently and in compliance with program requirements going forward. Action Taken: Management acknowledges the finding related to the absence of an independently prepared and documented surplus cash calculation. During the fiscal year ended December 31, 2025, the Organization operated in an environment of financial distress, limited staffing resources, and evolving oversight responsibilities, which contributed to informal and undocumented procedures related to surplus cash determinations. As disclosed in the financial statements, the Organization became subject to a court-appointed receivership. Following the appointment of the receiver, responsibility for financial oversight, including compliance with HUD cash flow and surplus cash requirements, has transitioned to the receiver in coordination with HUD. The receiver and management are evaluating HUD requirements related to surplus cash calculation. Responsible Person: Paul Valentine, Receiver Target Completion Date: September 30, 2026 Status: Not started

Federal Award Finding 2025-004 - Material Weakness, Material Noncompliance - Special Tests and Provisions, Cash Receipts Finding: The Organization maintained cash balances in excess of federally insured limits in financial institutions that did not meet HUD's minimum GNMA rating requirements. Recommendation: The Organization should transfer excess cash balances to financial institutions that meet HUD's GNMA rating requirements or otherwise structure its cash holdings to ensure compliance with federal insurance limits and HUD custodial requirements. Action Taken: Nevins moved to this financial institution with the first HUD loan in 2015. This is a local bank that actively supports Nevin's mission in the community. Given Nevins’ current financial struggles, the balance in the bank seldom exceeds the $250,000 threshold. In addition, the receiver established its own account with East West Bank and was in the process of fully transitioning the operating account to East West Bank at the end of the fiscal year. Responsible Person: Paul Valentine, Receiver Target Completion Date: September 30, 2026 Status: Not started

Federal Award Finding 2025-003 - Material Weakness, Material Noncompliance - Special Tests and Provisions, Mortgage Reserve Fund, Equipment Replacement Reserve Fund, and Special Escrows Finding: During the audit period, Henry C. Nevins Home, Inc. did not make all required deposits into the reserve for replacement fund in accordance with the terms of the applicable HUD Regulatory Agreement. The required monthly reserve deposits were either not made or were made in amounts less than those required. Recommendation: We recommend that Henry C. Nevins Home, Inc., in coordination with the court-appointed receiver and HUD, establish procedures to ensure that reserve for replacement deposits are made timely and in accordance with the HUD Regulatory Agreement, or that appropriate waivers or modifications are obtained from HUD where compliance is not currently feasible. Action Taken: Management acknowledges the audit finding related to the failure to make required deposits into the reserve for replacement fund in accordance with the HUD Regulatory Agreement. As disclosed in the notes to the financial statements, during the audit period the Organization was subject to a court-appointed receivership effective September 12, 2025 and is in default under its HUD-insured mortgages. As part of the receivership, control over substantially all cash management and financial decision-making activities was assumed by the court-appointed receiver. Management believes that the conditions giving rise to this finding are directly related to liquidity constraints. Given the complexities of the receivership and regulatory environment, a specific timeline for remediation is not able to be determined. As a result of the loan default, the mortgage was assigned to the U.S. Department of Housing and Urban Development. Since the appointment of the Receiver, responsibility for cash management, financial oversight, and debt service planning has transitioned to the Receiver. The Receiver and the Organization are actively evaluating available options to address the loan default which includes marketing the Organization for a sale. Interim corrective actions include enhanced cashflow monitoring, prioritization of expenses required to continue operations, and ongoing communication with HUD regarding the sale process. Management believes that these actions will address the conditions identified and result in the satisfaction of the HUD loan. Responsible Person: Paul Valentine, Receiver Target Completion Date: September 30, 2026 Status: In process

Federal Award Finding 2025-002 - Material Weakness, Material Noncompliance - Special Tests and Provisions, Mortgage Status and Reserve for Replacements Finding: During the fiscal year, the Organization experienced ongoing financial distress and declining liquidity, which adversely affected its ability to meet financial obligations as they became due. As a result, mortgage payments, including required principal, interest, mortgage insurance premiums, and escrow deposits, were not made in accordance with the loan and regulatory agreements. As of December 31, 2025, delinquent amounts totaled approximately $978 thousand. Recommendation: The Receiver and the Organization should work with HUD to develop and implement a formal workout or resolution plan, including enhanced cash-flow monitoring and debt service planning, to address the loan default and restore compliance with HUD debt service requirements. Action Taken: Management acknowledges the finding related to the failure to make required debt service payments under the HUD Section 232 and Section 241(a) insured mortgage loan agreements. The Organization experienced significant financial distress and constrained liquidity during the fiscal year, which limited its ability to remit required principal, interest, mortgage insurance premium, and escrow payments as they became due. As a result of the loan default, the mortgage was assigned to the U.S. Department of Housing and Urban Development. With the appointment of a Receiver over the Organization, responsibility for cash management, financial oversight, and debt service planning has transitioned to the Receiver. The Receiver is marketing the facility towards a sale in order to satisfy the outstanding loan balance with HUD. Interim corrective actions include enhanced cash-flow monitoring, prioritization of operational suppliers, and ongoing communication with HUD regarding the project's financial condition and sale status. Management believes that these actions will support progress towards stabilization and marketability of the Organization. Responsible Person: Paul Valentine, Receiver Target Completion Date: September 30, 2026 Status: In process

Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Medical Assistance Assistance Listing Number: 93.778 Federal Award Identification Number and Year: S2505MN5ADM - 2025 Award Period: 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Recommendation: CLA recommend that the County implement sufficient internal control procedures to ensure LCTS payments are made within 30 days of receipt. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The County will implement the recommendation immediately. Name of the contact person responsible for corrective action plan: Loraine Rupp, Sherburne County Auditor-Treasurer Planned completion date for corrective action plan: Already corrected

EOHHS is in agreement with these findings and is in the process of working with Gainwell and its managed care partners to address these discrepancies. The providers that were not properly subjected to EOHHS’s enrollment processes were out of network providers within one of the managed care plans’ national network provider management system. These providers have been incorrectly included in provider network data as this managed care plan is in the process of end-dating these providers, which will resolve this discrepancy. EOHHS has reorganized Provider Enrollment oversight functions under the Office of Program Integrity (OPI) in alignment with federal standards, and as such will continue to audit and monitor enrollment files to ensure compliance with state and federal requirements. OPI is formalizing a process to swiftly terminate providers who have lost their licensure, as well as randomly auditing enrollment files to ensure proper licensure. Additionally, EOHHS will begin collecting DCYF licensure data as required. Anticipated Completion Date: December 31, 2026 Contact Persons: Nicholas James, Implementation Director of Policy and Programs, Executive Office of Health and Human Services nicholas.james@ohhs.ri.gov Rob Tingle, Chief of Program Analytics, Executive Office of Health and Human Services robert.tingle@ohhs.ri.gov

EOHHS acknowledges the federal reporting requirement specific to the State’s non-emergency medical transportation (NEMT) vendor. The State’s contract with the vendor, more specifically Article I Section 18.13.6, does require the financial reporting necessary to comply with this federal requirement. EOHHS is currently working with vendor and their independent auditor to isolate the necessary financial claims to resolve this deficiency finding for reporting/calendar year 2025. Anticipated Completion Date: EOHHS estimates that the 2025 report will be brought into compliance no later than December 1, 2026. Contact Persons: Storm Lawrence, Chief of Strategic Planning, Monitoring & Evaluation, Executive Office of Health and Human Services storm.lawrence@ohhs.ri.gov Melanie Oxley, Administrator of Medical Services, Division of Healthcare Delivery Contracting, Executive Office of Health and Human Services melanie.j.oxley@ohhs.ri.gov

2025-032a: MMIS system access is controlled via an electronic system called GainwellNow. An MMIS access request form must be completed by the requestor, signed by that individual and their supervisor, and then sent to the Systems Group staff members who are responsible for approving or denying access requests. The Systems Group will sign the request form and approve the request within GainwellNow and the requestor will be granted access. The GainwellNow system also generates and sends email notifications to the Systems Group Administrators notifying them of a pending access request if the requestor enters it into GainwellNow directly. From there, the same approval/denial process occurs. If an individual has not logged into MMIS for 30 days, then they require a password reset in order to regain access. Those password reset requests create system generated emails that are sent to the Systems Group Admins for approval or denial. After 60 days of inactivity, the individual is locked out and cannot access the MMIS without requesting and obtaining approval of the password reset. If someone leaves state employment, then the Systems Group Admins submit an access deletion request into GainwellNow, deleting the account completely. Gainwell Technologies also sends monthly access reports to the Systems Group for review and confirmation that account deletion requests were completed as submitted. Additionally, Gainwell sends monthly “New or Deleted Users” reports to the Systems group for review. For IT security, the Systems Group receives and reviews the following reports: · RI-CDM-ASQC-Security-Report · RI-CSHARP-ASQC-Security-Report · RI-Java-ASQC-Security Report · RI-XIX-DR Exercise Scope · RI-XIX-DR Executive Summary Report 2025-032b: The Arc-Ampe (formerly called MARS-E) third party assessment is underway. Security scanning and testing is complete, and security controls have been evaluated. Final report is due by 6/30/2026. Remediation of legitimate vulnerabilities is underway and defects are tracked on the RIBridges POAM. 2025-032c: EOHHS/Medicaid will work collaboratively with ETSS and their vendors to proactively assess critical risk areas planned for the review year. 2025-032d: For RIBridges, SOC engagements occur every other year. A third-party Attestation of the Arc-Ampe controls occurs annually. The state can evaluate the results of this year’s upcoming SOC audit to determine if an increased frequency of the SOC is needed. Anticipated Completion Dates: 2025-032a: EOHHS believes this item to be complete and will defer to OAG for resolution of this finding. 2025-032b: High findings – 30 days, moderate findings – 90 days, low findings – 365 days. July 31, 2027. 2025-032c: Ongoing 2025-032d: December 31, 2026 Contact Persons: Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov Deb Merrill, Security Officer, ETSS, Department of Administration deb.merrill@doit.ri.gov Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov

Management agrees with the finding regarding health and safety requirements for timely unannounced monitoring visits. While several providers identified in the audit did receive a monitoring visit within 60 days of the annual due date, the Licensing Department experienced delays in completing some monitoring visits due to staff shortages and employee leave. To address the backlog and prioritize oversight activities, The Department has implemented a team-based prioritization approach rather than individual caseload management. This approach allows the unit to prioritize providers with the greatest need for monitoring and ensure that available resources are directed toward the highest-risk areas. The Department is actively working to increase staffing capacity within the unit. The Department is currently onboarding four new staff members to address existing vacancies and has recently received two additional FTE positions to further support monitoring activities. The unit continues to manage the impact of two staff members being out on extended medical leave with undetermined return dates; however, despite these staffing challenges, the unit has completed 423 monitoring visits since January 1, 2026. The Department will continue to monitor progress toward eliminating the backlog, strengthening system processes, and ensuring timely completion and documentation of required unannounced monitoring visits. DHS has also implemented enhanced monitoring capabilities within RISES. The system now generates automated notifications to the Licensing Department at established intervals before monitoring visits are due for both child care centers and family child care programs. These automated reminders strengthen monitoring workflows, improve oversight of upcoming monitoring requirements, and support the timely completion of unannounced visits. In addition, RISES has strengthened the Department's ability to consistently track provider compliance, document corrective actions, and identify providers requiring increased oversight. These enhanced monitoring tools have improved accountability by providing greater visibility into provider compliance and enabling licensing staff to more effectively prioritize regulatory activities based on risk. Management does not concur with the findings related to corrective action plans and inspections but has implemented various enhancements to support streamlined processes in these areas since the audit time period. As discussed during the audit, several factors affect the timing and applicability of required inspections and do not necessarily indicate provider noncompliance. For example, radon testing may only be conducted during specific times of the year. Providers may make timely efforts to schedule testing but be unable to obtain an inspection due to limited inspector availability or because the request falls outside the allowable testing window. In these circumstances, DHS does not consider the provider to be out of compliance. Similarly, fire inspections must be completed by the State Fire Marshal's Office. In recent years, staffing challenges have affected the ability to complete inspections within standard timeframes, despite providers' efforts to obtain them. When a provider has a history of compliant fire inspections, the Licensing Department accepts documentation demonstrating the provider's attempt to schedule the required inspection and may proceed with license renewal while awaiting the inspection. Additionally, lead inspections are not required for facilities constructed after the applicable regulatory date and are not required for school-age programs. During the audit process, DHS identified several providers flagged for inspection concerns that appeared to fall into one or both of these exempt categories. To strengthen compliance monitoring, RISES now generates automated notifications beginning 90 days before inspection expiration dates. DHS has already observed improved provider responsiveness in renewing required inspections and will continue to use RISES to proactively monitor inspection status and work with providers to maintain current inspection documentation. Regarding corrective action plans, under the previous licensing system, providers submitted corrective action plans and supporting documentation directly to the assigned licensor. This is typically through email. As a result, documentation was often maintained outside of the licensing system and may not have been consistently reflected in the inspection record. If the corrective action or follow-up information was not documented within the system or the inspection status was not updated, the report could continue to appear as pending, even when the provider had submitted the required information. To address this limitation, DHS intentionally designed the RISES system to centralize the corrective action process. Following an inspection, the report is issued to the provider through RISES, where the provider is required to submit a corrective action plan directly within the system. The corrective action plan is then routed to DHS for review and approval, creating a documented workflow and improving the consistency and completeness of recordkeeping. If a provider does not submit a corrective action plan, DHS is able to identify the outstanding item within RISES and determine whether a follow-up inspection is warranted to verify that the noncompliance has been addressed. Currently, DHS prioritizes follow-up for high-risk noncompliance, including issues related to facilities, background checks, staff-to-child ratios and supervision, and infant and toddler care. Anticipated Completion Date: This corrective action has since been completed through the implementation of the 2026 requirement that all regulated providers utilize RISES. Contact Person: Nicole Chiello, Associate Director, Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov

The RI Works unit has completed a comprehensive revision of the State's Work Verification Plan. The revised plan is currently undergoing an internal quality review to ensure consistency, appropriate terminology, removal of legacy references, and alignment with current program operations. Upon completion of this review, the Work Verification Plan will be submitted to the Administration for Children and Families (ACF) for review and approval. To strengthen ongoing compliance with the Work Verification Plan, DHS will implement documented supervisory quality assurance reviews to verify work participation documentation, ensure compliance with established verification procedures, and confirm the accuracy of work participation data reported to ACF. In addition, the Multi-Program Eligibility Review Tool referenced in Finding 2025-046 will be incorporated into the Department's supervisory monitoring process. Supervisors will utilize the tool to conduct routine case reviews to verify eligibility accuracy, work verification documentation, and compliance with federal and State requirements. Review results will be used to identify trends, provide targeted coaching, and strengthen ongoing quality assurance activities. Anticipated Completion Date: October 1, 2026 Contact Person: Donna Rook, Administrator, Family & Adult Services, Department of Human Services donna.m.rook@dhs.ri.gov

The Department updated Policy (218-RICR-20-002) to reflect 45 CFR 205.55, including procedures for using IEVS interfaces and incorporating the resulting information into eligibility determinations. The updated policy will be sent to OMB 7/1/26. Additionally, the updated policy will be discussed at meetings (Office Hours, Training consultations, and Quarterlies). System interfaces will run on a quarterly basis consistent with the language in 45 CFR §205.55 regarding all applicants. This process is being tracked and prioritized in BRR-141767 which is the ticket number used to communicate with the vendor. In addition, DHS is strengthening operational controls to ensure required IEVS interfaces are executed, reviewed, and acted upon within required federal timeframes. Supervisors will monitor outstanding interface matches and timeliness of case actions as part of routine quality assurance activities to ensure interface information is appropriately evaluated, documented within the electronic case record, and incorporated into eligibility determinations. These actions will be supported by the Department's broader supervisory quality assurance and pre-authorization review initiatives to improve verification accuracy, ensure timely processing of electronic data matches, and reduce future eligibility errors. The Department also notes that a portion of the untimely processing identified during the audit occurred during the RIBridges cybersecurity incident, when staff were operating under documented Business Continuity Plan (BCP) procedures to restore critical operations and address processing backlogs. While these circumstances contributed to delays during the audit period, the Department recognizes the need to strengthen routine controls and has implemented the corrective actions described above. Information security enhancements are further addressed in response to Finding 2025-032. Anticipated Completion Date: Ongoing – The process of posting updated policy and then the public comment period historically takes about 6 months. Disseminating information to staff regarding the policy updates will begin July 2026 and continue until saturation. Contact Person: Donna Rook, Administrator, Family & Adult Services, Department of Human Services donna.m.rook@dhs.ri.gov

2025-037a: Members of the Income Support team will meet regularly with the WDS team to identify areas of concern and to evaluate alternative ways to strengthen the overall program effectiveness including subsequent RESEA activities will be among the topics discussed. These activities, among others, have been limited due to inadequate funding. 2025-037b: The DLT Data and Performance Unit prepared recommendations for an amended RESEA algorithm. The resolution team (comprised of members from the Data and Performance Unit, Income Support, Workforce Development Services, and the Office of Planning, Integrity, and Compliance) endorsed the recommendation. During Quarter 3 the proposal was brought before Department Executive Leadership. Leadership endorsed and approved the final draft. Anticipated Completion Date: November 30, 2026 Contact Person: Philip D’Ambra, Deputy Director (Income Support) UI Director, Department of Labor and Training philip.l.dambra@dlt.ri.gov

We concur with the recommendation. Regarding (1) – RIDLT UI Administrative staff meet weekly with ETSS to review and prioritize pending projects. The programming changes required to calculate and apply the 15% fraud penalty are included in these priorities. Currently, RIDLT has one dedicated IT resource, who is fully engaged with the Online Employer Form Modernization project (see #2). Following the completion of these initiatives, RIDLT will begin development for the 15% fraud penalty programming. Regarding (2) – RIDLT is currently engaged in the Online Employer Form Modernization project. This system enhancement is necessary to: • Eliminate unnecessary employer forms that do not require adjudication. • Use conditional logic to display only relevant questions. • Automatically identify and flag responses that may affect eligibility. • Reduce staff time spent on non-actionable forms. • Enable staff to focus limited resources on claims that require review. • Make an adequacy determination (RIGL 28- 43-3(2)(viii)). Anticipated Completion Date: November 30, 2026 Contact Person: Philip D’Ambra, Deputy Director (Income Support) UI Director, Department of Labor and Training Philip.l.dambra@dlt.ri.gov

2025-034a: We appreciate the work performed by OAG and understand the importance of the SAR. While the noted exception, was an isolated incident, our internal control was lacking. We do have compensating controls in place to identify potential noncompliance with the registration requirement, this isolated transaction did not appear on the daily error report. ETSS is investigating how this occurred and will ensure that similar exception do not occur in the future. We will also use your recommendation as an opportunity to review and modify any control deficiencies related to the current legacy limitations. For example, not having a field on the AS400 to capture the dependent SS#, after initial application is filed. 2025-034b: DLT’s 2024 Systems Modernization Strategic Plan outlines long-term efforts to enhance system integration, automation, and data monitoring capabilities. RI DLT Modernization Strategic Plan - 2024.pdf. The Department is actively evaluating the feasibility of financing this effort. 2025-034c: UI Administration will consult with DLT legal office to update applicable regulations. Anticipated Completion Dates: 2025-034a: October 31, 2026 2025-034b: Ongoing 2025-034c: October 31, 2026 Contact Person: Sarah Fresch, Deputy Director, COO, Department of Labor and Training sarah.fresch@dlt.ri.gov Philip D’Ambra, Deputy Director (Income Support) UI Director, Department of Labor and Training Philip.l.dambra@dlt.ri.gov

The Department has reviewed and updated its SNAP EBT reconciliation procedures to strengthen internal controls over the reconciliation process. Written procedures document the reconciliation process, required calculations, roles and responsibilities, supervisory review requirements, and timelines for completing and resolving outstanding reconciliation items. The Department will perform reconciliations in accordance with established procedures and promptly investigate and resolve any unreconciled balances in coordination with the EBT Coordinator and SNAP Administrator. In addition, supervisory review and approval of each reconciliation will be documented to verify the accuracy and completeness of reconciliations and ensure that any discrepancies are appropriately researched and resolved in a timely manner. These actions are intended to strengthen internal controls over SNAP EBT reconciliations, improve management oversight, and ensure compliance with federal reconciliation requirements. Anticipated Completion Date: October 31, 2026 Contact Person: Jenna Simeone, Administrator, Family & Adult Services – SNAP, Department of Human Services jenna.simeone@dhs.ri.gov

Finding 2025-004: Material Weakness and Noncompliance: Special Tests and Provisions (Revenue Diversion) Finding: The City’s Airport Improvement Program has special tests and provisions requirements applicable to revenue diversion requirements of the grant. The City did not have processes and controls in place to ensure compliance with federal requirements related to the prevention of revenue diversion, along with other regulatory matters identified by the FAA. The City did not also have sufficient processes and controls in place for monitoring the execution and performance of agreements and lessees and FBO. Corrective Actions Taken or Planned: The City has and continues to perform a legal and management review of the FAA’s concerns associated with the Airport Improvement Program requirements. After consultation with the City’s legal counsel, our analysis shows that corrections are necessary and revenue diversion may not have occurred, or not to the extent originally asserted. This ongoing matter will be addressed with additional consultation with the FAA and City airport managers. The issues identified pertain to compliance with grant assurance obligations, specifically the need for strengthened processes to ensure ongoing adherence to federal program requirements. The City’s review is ongoing with assistance from counsel specializing in airport operations and federal regulatory compliance. As this work advances, the City will collaborate closely with the Airport Manager and Executive Leadership to design, formalize, and implement the necessary internal controls to ensure compliance with FAA grant assurances. This could include and is not limited to procedures for: 1. Monitoring and documenting compliance with grant assurance requirements; 2. Strengthening oversight of agreements, leases, and FBO operations; 3. Establishing systematic controls for revenue diversion monitoring and periodic testing; 4. Ensuring timely reporting and documentation to detect and prevent noncompliance. Contact Person: Melissa Sieben, Toni Wheeler, Rachelle Mathews Anticipated Completion Date: December 31, 2026

Management’s Response/Corrective Action Plan: MSAD 15 will update its federal procurement checklist to ensure that all future federally funded construction, alteration, or repair contracts in excess of $2,000 explicitly incorporate Davis-Bacon Act wage rate requirement clauses.