Corrective Action Plans

Finding: The Housing Finance Commission did not have adequate internal controls over and did not comply with reporting requirements for the Homeowner Assistance Fund program. Questioned Costs: Assistance Listing # 21.026 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: To address the deficiencies identified by the auditors in completing quarterly performance reports, the Commission has taken the following corrective actions to strengthen controls over reporting for the Homeowner Assistance Fund (HAF) program: • Updated procedures to require: o Homeownership Division and Finance Division staff to perform regular reconciliation of records to identify any discrepancies and to ensure all records are complete and accurate. o Supporting data obtained for reporting be vetted by the contractor and the Homeownership Division staff. o Leadership (division manager or above) to perform final review of data as well as the quarterly or annual report prior to submission to the grantor. • Designated the records maintained by the Finance Division, specifically the general ledgers, as the source of financial data for the quarterly and annual reports for the Washington HAF program. • Required third parties to develop or update a program manual regarding data used for reporting purposes. The manual incorporated recommendations of the audit finding. As of June 30, 2024, the Commission consulted with the U.S. Department of the Treasury to determine if revision and resubmission of the reports are necessary to correct amounts reported. No corrective action was required. The conditions noted in this finding were previously reported in finding 2023-024. Completion Date: June 2024 Agency Contact: Lucas Loranger Senior Finance Director 1000 Second Ave, Suite 2700 Seattle, WA 98104-3601 (206) 464-7139 Lucas.Loranger@wshfc.org

Finding: The Housing Finance Commission did not have adequate internal controls over reporting requirements for the Homeowner Assistance Fund program. Questioned Costs: Assistance Listing # 21.026 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: To address the deficiencies identified by the auditors in completing annual performance reports, the Commission has taken the following corrective actions to strengthen controls over reporting for the Homeowner Assistance Fund (HAF) program: • Updated procedures to require: o Homeownership Division and Finance Division staff to perform regular reconciliation of records to identify any discrepancies and to ensure all records are complete and accurate. o Supporting data obtained for reporting be vetted by the contractor and the Homeownership Division staff. o Leadership (division manager or above) to perform final review of data as well as the quarterly or annual report prior to submission to the grantor. • Designated the records maintained by the Finance Division, specifically the general ledgers, as the source of financial data for the quarterly and annual reports for the Washington HAF program. • Required third parties to develop or update a program manual regarding data used for reporting purposes. The manual incorporated recommendations of the audit finding. As of June 30, 2024, the Commission consulted with the U.S. Department of the Treasury to determine if revision and resubmission of the reports are necessary to correct amounts reported. No corrective action was required. The conditions noted in this finding were previously reported in finding 2023-025. Completion Date: June 2024 Agency Contact: Lucas Loranger Senior Finance Director 1000 Second Ave, Suite 2700 Seattle, WA 98104-3601 (206) 464-7139 Lucas.Loranger@wshfc.org

Finding: The Housing Finance Commission did not have adequate internal controls over earmarking requirements for the Homeowner Assistance Fund program. Questioned Costs: Assistance Listing # 21.026 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Commission has taken the following corrective actions to strengthen controls over earmarking requirements for the Homeowner Assistance Fund (HAF) program: • Developed a system to track and monitor expenditures in relation to overall program expenditures to ensure earmarking requirements are within allowable parameters. • Selected an increased percentage of approved, denied, and withdrawn HAF applications that have previously been reviewed by the contractor, as part of the Quality Control process, for a secondary review by program staff. • Reviewed a selection of HAF applications independent of the Quality Control process performed by the contractor. • Reviewed a selection of approved HAF applications prior to disbursing funds to confirm eligibility determinations are proper. The conditions noted in this finding were previously reported in finding 2023-023. Completion Date: October 2024 Agency Contact: Lucas Loranger Senior Finance Director 1000 Second Ave, Suite 2700 Seattle, WA 98104-3601 (206) 464-7139 Lucas.Loranger@wshfc.org

Finding: The Housing Finance Commission did not have adequate internal controls over eligibility requirements for the Homeowner Assistance Fund program. Questioned Costs: Assistance Listing # 21.026 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Commission has taken the following corrective actions to strengthen controls over eligibility requirements for the Homeowner Assistance Fund (HAF) program: • Selected an increased percentage of approved, denied, and withdrawn HAF applications that have previously been reviewed by the contractor, as part of the Quality Control process, for a secondary review by program staff. • Reviewed a selection of HAF applications independent of the Quality Control process performed by the contractor. • Reviewed 100% of approved HAF applications prior to disbursing funds to confirm eligibility determinations are proper. The conditions noted in this finding were previously reported in finding 2023-022. Completion Date: June 2024 Agency Contact: Lucas Loranger Senior Finance Director 1000 Second Ave, Suite 2700 Seattle, WA 98104-3601 (206) 464-7139 Lucas.Loranger@wshfc.org

Finding: The Washington State Department of Transportation did not have adequate internal controls over and did not comply with quality assurance program requirements to ensure materials conformed to approved plans and specifications, and that only qualified personnel performed testing for projects funded by the Highway Planning and Construction program. Questioned Costs: Assistance Listing # 20.205 Amount $0 Status: Corrective action in progress Corrective Action: The Department is committed to ensuring that our grant programs comply with federal regulations related to quality assurance (QA) requirements and safeguarding that materials and workmanship conform to approved plans and specifications through testing, inspections, or certifications. The Department has worked closely with the Federal Highway Administration (FHWA) on our QA program and continues to receive feedback on the strength of our program. As indicated in the prior year’s corrective action plan concerning a similar issue, the Department has been working towards replacing the Record of Materials (ROM) legacy system. Therefore, it was not practical to modify the system to help correct issues previously reported in the fiscal year (FY) 2022 and 2023 audits. During FY 2023, the Department eliminated the practice requiring updates to the ROM within 30 days of payment and instead relied on the required documentation as evidence of proper materials acceptance. The FY 2024 audit identified only two out of 58 materials tests that were either not documented properly or the required test was not performed. In January 2023, as a result of recommendations from the FY 2022 audit, the Department modified its practice related to how tester data is reviewed and entered into the tester certification tracking system. All offices now funnel tester data to the Headquarters Quality Systems Section for review and entry. These procedure changes were communicated to appropriate staff and are reflected in the Construction Manual, which was reviewed and approved by FHWA. The Department is assessing the replacement of additional software legacy programs associated with the QA program. Due to the timing of the implementation, these changes were not fully reflected in the current year’s audit for the auditors to perform control testing. Nevertheless, only four out of 57 testers were found to have certification issues during the FY 2024 audit. The Department will continue to improve the QA program while waiting for the new software programs to be fully developed. To address the audit recommendations, the Department’s Construction Division will examine current policies and procedures/practices related to the audit issues. The Department will: • Communicate with the FHWA to discuss the audit’s recommendations and any changes required to be compliant with federal requirements. • Provide training to Project Engineering Office staff to emphasize QA program requirements, the FY 2024 finding, and audit exceptions. • Update policies and procedures as needed from discussions and training above. • Obtain approval of updates to the Construction Manual from the FHWA, if needed. • Communicate changes in policies and procedures to division staff and stakeholders. The conditions noted in this finding were previously reported in findings 2023-014, 2022-011, 2021-011, 2020-017, and 2019-019. Completion Date: Estimated June 2025 Agency Contact: Jesse Daniels External Audit Liaison PO Box 47320 Olympia, WA 98504-7320 (360) 705-7035 danielje@wsdot.wa.gov

Finding: The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to collect certified payrolls from contractors on projects funded by the Highway Planning and Construction program. Questioned Costs: Assistance Listing # 20.205 Amount $0 Status: Corrective action in progress Corrective Action: In July 2020 and November 2024, the Department received management decision letters from the Federal Highway Administration (FHWA) in response to similar findings for the fiscal years 2018, 2019, and 2023, respectively, which stated: • FHWA approved the Department’s Construction Manual and Standard Specifications and confirmed that documented procedures contain the necessary controls to ensure reasonable compliance with 29 CFR 5.5 and the Davis-Bacon and Related Acts. • FHWA agreed that current processes in place are reasonable and satisfy the intent of the Department of Labor’s certified payroll requirements. • Ensuring all certified payrolls are collected, and considering sanctions or other appropriate actions for missing payrolls using the methods outlined in WSDOT’s procedures provide sufficient internal control and reasonable compliance, notwithstanding the collection of the payrolls within a seven-day period. • FHWA considers this finding to be resolved. The Department continues to strive for improvements in this area. To further address the prior year’s audit recommendations, the Department took actions to update the Construction Manual, which was approved by FHWA and released in February 2025. This includes: • Updated language for certified payroll collection requirements when no work is performed on federal projects. • Clarified the authority to withhold payments regarding federal wage administration. • Standardized the required frequency of checking for certified payroll collection and the methods to document tracking. • Defined “timely,” given the circumstances surrounding weekly collection of certified payrolls and sanctions on a monthly pay estimate, including: o The timeline when the Department must communicate overdue certified payroll to the contractor and the allowable methods of that communication. o The timeline for determining when the Department must consider imposing sanctions on the contractor after a certified payroll is overdue. o The minimum required documentation that sanctions (e.g., partial deferral of payment) were considered against the contractor regarding an overdue certified payroll. The Department discussed the updates to the Construction Manual and the audit findings at the statewide Documentation Engineering meeting, which was held in February 2025. Additionally, the Department will: • Release the Construction Bulletin to include highlights on the updates in the Construction Manual. • Share the details of the audit testing and exceptions with the Regional Documentation Engineers. The conditions noted in this finding were previously reported in finding 2023-013. Estimated June 2025 Jesse Daniels External Audit Liaison PO Box 47320 Olympia, WA 98504-7320 (360) 705-7035 danielje@wsdot.wa.gov

Finding: The Washington State Department of Transportation did not have adequate internal controls over and did not comply with requirements to perform risk assessments for subrecipients of the Highway Planning and Construction program. Questioned Costs: Assistance Listing # 20.205 Amount $0 Status: Corrective action in progress Corrective Action: The Washington State Department of Transportation (WSDOT) is committed to ensuring our grant programs comply with federal regulations regarding required risk assessments. Risk assessments for subrecipients under the Federal Highway Administration grant programs are the responsibility of WSDOT’s Regional Local Programs Engineers, located in the six WSDOT regions. The Department has attempted to complete a risk assessment at each phase of a project, however, staff turnover contributed to the lack of consistency and timeliness in completing these assessments. To help ensure consistency, the Department has updated position descriptions for Local Programs Engineers to reflect this requirement. The Department will: • Ensure audit findings and exceptions are shared with responsible staff and regional management. • Communicate with Regional Local Programs Engineers to ensure risk assessments are performed and properly documented in accordance with the risk assessment program guidelines. • Communicate with regional management to ensure required monitoring activities by staff are tracked, and the status of these activities are reported as part of annual performance evaluations. Communication with Regional Local Programs Engineers and regional management will continue to be on-going. The conditions noted in this finding were previously reported in finding 2023-012. Completion Date: Estimated June 2025 Agency Contact: Jesse Daniels External Audit Liaison PO Box 47320 Olympia, WA 98504-7320 (360) 705-7035 danielje@wsdot.wa.gov

Finding: The Washington State Department of Transportation did not have adequate internal controls over and did not comply with federal requirements for suspension and debarment and wage rate notification. Questioned Costs: Assistance Listing # 20.205 Amount $0 Status: Corrective action complete Corrective Action: The Department is committed to ensuring our programs comply with federal regulations related to procurement, suspension, and debarment. The Department has policies and procedures in place, approved by the Federal Highway Administration (FHWA), to ensure all federally funded construction contracts have the necessary elements to meet both state and federal requirements. The Department provided clear guidance to teams to ensure Form FHWA-1273 Required Contract Provisions Federal-Aid Construction Contracts is included in all contracts. It was simply a mistake that Form 1273 was left out of the contract in question. In this case, the contract documents were some 1,200 pages and the inclusion of this form in an appendix was overlooked by the project team. As a result of various other checks and balances in place, the Department subsequently discovered the oversight and a change order was executed on July 18, 2024, to include the form. This was completed before any contract work commenced and prior to audit work beginning for the program. For added assurance, all contracts include language that requires the contractor to meet the various requirements associated with Form FHWA-1273, whether the form is included in the contract or not. The Department had follow-up conversations with appropriate staff to ensure all contracts awarded contain the required elements. Completion Date: February 2025 Agency Contact: Jesse Daniels External Audit Liaison PO Box 47320 Olympia, WA 98504-7320 (360) 705-7035 danielje@wsdot.wa.gov

Finding: The Employment Security Department did not have adequate internal controls over and did not comply with requirements to ensure it profiled all claimants under the Unemployment Insurance program to identify people likely to need reemployment services and ensure staff providing those services received required training. Questioned Costs: Assistance Listing # 17.225 17.225 COVID-19 Amount $0 Status: Corrective action in progress Corrective Action: The Department concurs with the audit recommendation to review the Worker Profiling and Reemployment Services calculation of the profile score within the Unemployment Tax and Benefit (UTAB) system. In response to the prior year’s finding, the Department began investigating the process of the score calculation in October 2024. The Department is also examining resource allocation to more effectively validate the profile score and ensure that coefficient values are correctly determined and assigned by the UTAB system. The Department partially concurs with the recommendation to reconcile the UTAB and Reemployment Appointment Scheduler (RAS) interface. There is currently a process in place to notify the RAS team if a record fails at the time of data transmission between UTAB and RAS. The Department will review its processes to verify the complete UTAB exit file was successfully received by RAS. The Department partially concurs with the recommendation to ensure staff have completed the required training before providing services to claimants. The Department currently monitors local offices to ensure staff have taken the required training to be able to provide reemployment screening services to claimants. The exception cited in the finding was due to one staff out of 277 who missed the refresher training during fiscal year 2024. The Department will continue to monitor local staff training to ensure compliance. The conditions noted in this finding were previously reported in finding 2023-010. Completion Date: Estimated May 2025 Agency Contact: Jay Summers  External Audit Manager   PO Box 9046   Olympia, WA 98507-9046  (360) 529-6718  Joshua.Summers@esd.wa.gov

Finding: The Employment Security Department did not have adequate internal controls to ensure compliance with federal requirements to annually certify that employer tax credits reported under the Federal Unemployment Tax Act are matched against employer contributions paid under the Unemployment Insurance program. Questioned Costs: Assistance Listing # 17.225 17.225 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Department is committed to ensuring that the required reports for the Federal Unemployment Tax Act are properly reviewed and in compliance with federal requirements. The Department has a process in place for a secondary review of the employer tax credit reports prior to certification. The two exceptions identified in the audit were isolated incidents where both the preparer and reviewer missed one of the 50 lines on the two reports being reviewed. The Department will ensure management adequately reviews employer account reconciliations performed by staff to ensure the required number of accounts are reviewed for all reports prior to submission. Completion Date: February 2025 Agency Contact: Jay Summers External Audit Manager PO Box 9046 Olympia, WA 98507-9046 (360) 529-6718 Joshua.Summers@esd.wa.gov

Finding: The Employment Security Department did not have adequate internal controls over and did not comply with federal requirements to conduct case reviews for the Benefit Accuracy Measurement program of the Unemployment Insurance program in a timely manner. Questioned Costs: Assistance Listing # 17.225 17.225 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Department is committed to ensuring our Benefit Accuracy Measurement (BAM) program complies with federal regulations. Historically, the BAM unit has been challenged to maintain full levels of staffing. Staff turnover, lengthy training requirements, and unique skill sets make these positions difficult to maintain. The Department has implemented changes to position descriptions which have resulted in the hiring and retention of qualified staff. As a result, the unit has improved its case sampling timelines by implementing regular case reviews to ensure the 60-day, 90-day, and 120-day timelines are met. Additionally, the Department, in collaboration with the U.S. Department of Labor (USDOL), developed a State Quality Service Plan (SQSP) which includes metrics to improve program outcomes. The team has implemented additional internal communication to follow up on cases which are approaching the 120-day timeline. Although the 120-day timeline is not an improvement measure listed on the SQSP, the Department will continue to work with USDOL to implement guidance and processes to meet the 120-day requirement. The conditions noted in this finding were previously reported in findings 2023-009, 2022-006, 2021-005, and 2020-011. Completion Date: January 2025 Agency Contact: Jay Summers External Audit Manager PO Box 9046 Olympia, WA 98507-9046 (360) 529-6718 Joshua.Summers@esd.wa.gov

Finding: The Office of Superintendent of Public Instruction did not have internal controls over and did not comply with requirements to verify single audits were completed for all subrecipients of the Child and Adult Care Program. Questioned Costs: Assistance Listing # 10.558 Amount $0 Status: Corrective action in progress Corrective Action: The Office has implemented internal controls to ensure all subrecipients requiring a single audit are identified and to follow up on any program-related findings that require a management decision. Procedures are also updated to maintain the subrecipient audit tracking log. The Office will implement a training plan for the Child Nutrition Services fiscal team, which includes cross training and completing the State Auditor’s Office subrecipient monitoring training. The Office will follow up with the subrecipient identified in the audit to ensure it obtains its required single audit. The conditions noted in this finding were previously reported in finding 2023-004. Completion Date: Estimated June 2025 Agency Contact: Debbie Libra Fiscal & Claims Supervisor PO Box 47200 Olympia, WA 98504-7200 (564) 233-8620 Debbie.libra@k12.wa.us

Finding: The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with the required monitoring of subrecipients of the Child and Adult Care Food Program. Questioned Costs: Assistance Listing # 10.558 Amount $0 Status: Corrective action in progress Corrective Action: The Office has established and implemented a procedure for tracking subrecipient monitoring activities assigned to staff. The procedure includes expectations of program specialists to complete a minimum number of administrative reviews each month. Progress is regularly reviewed to address workload issues. The Office also identified the need for additional staff resources to provide coverage during absences. However, we were not able to secure funding to move forward with recruitment until fiscal year 2025. The Office is planning on hiring new staff by April 30, 2025. Meanwhile, a temporary position was filled to assist with completing the 23 administrative reviews that were not completed for fiscal year 2024. The Office expects these reviews will be completed by September 1, 2025. The conditions noted in this finding were previously reported in finding 2023-002. Completion Date: Estimated September 2025 Agency Contact: Chaundi Barbosa CACFP Director PO Box 47200 Olympia, WA 98504-7200 (360) 764-0411 Chaundra.Barboza@k12.wa.us

Finding: The Office of Superintendent of Public Instruction did not have adequate internal controls over and did not comply with requirements to ensure it communicated federal award identification elements to subrecipients of the Child and Adult Care Food Program. Questioned Costs: Assistance Listing # 10.558 Amount $0 Status: Corrective action complete Corrective Action: During fiscal year 2025, the Office amended its procedure of sending grant requirements to all subrecipients bi-annually. The current procedures require the program specialist to distribute federal award information and requirements to all subrecipients upon approval of the renewal application. The updated procedure will go into effect for all subrecipients during the fiscal year 2026 renewal cycle. The conditions noted in this finding were previously reported in finding 2023-003. Completion Date: March 2025 Agency Contact: Chaundi Barbosa Director, CACFP PO Box 47200 Olympia, WA 98504-7200 (360) 725-0411 Chaundra.Barbza@k12.wa.us

DEBARMENT- INTERNAL CONTROL OVER VERIFICATION AGAINST THE SYSTEM FOR AWARD MANAGEMENT (“SAM”) Description of Finding: 2 CFR Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, (Uniform Guidance) requires compliance with provisions of procurement, suspension, and debarment. Non-federal entities are required to ensure that they do not award contracts or make subawards to any parties that are suspended or debarred from receiving federal funds. This verification may be accomplished by checking the System for Award Management (SAM). The Town does not have a process in place to check that vendors are not suspended or debarred by checking the System for Award Management (SAM). Statement of Concurrence or Nonconcurrence: The Town agrees with the audit finding. Corrective Action: The Town will establish policies and procedures to ensure vendors are not suspended or debarred by checking the System for Award Management (SAM) and maintain documentation showing that verification. Name of Contact Person: William J. Steglitz, Finance Director, (860) 923-3593. Projected Completion Date: June 30, 2025.

Finding 2024-001: Special Tests and Provisions – CFDA# 94.006 (AmeriCorps State and National): Living Allowance Maximum Threshold Exceeded Audit Finding: Colorado Youth For A Change can only pay AmeriCorps member a living allowance that does not exceed the maximum living allowance threshold per the Uniform Guidance and grant guidelines. In our audit, we found that twenty AmeriCorps members were paid a living allowance that exceeded the maximum threshold by $1,255 individually, and $25,100 in aggregate. This constitutes a violation of federal grant guidelines and is considered an unallowable cost, requiring corrective action and potential reimbursement to the funding agency. Audit Recommendation: We recommend Colorado Youth For A Change to compare their living allowance calculations to the annual maximum threshold amount to ensure no AmeriCorps members are paid a living allowance in excess of the annual maximum threshold amount. Management’s Response and Corrective Action Plan: Colorado Youth For A Change acknowledges the finding and recommendation. Living allowances for the 25-26 program year have been double-checked against the current NOFA and have been confirmed to be under maximum requirements. An annual process for this action will be instituted. Contact and Completion Date: Mary Zanotti (maryz@youthforachange.org) is the primary contact, and the Executive Director at Colorado Youth For A Change. The correction action is expected to be resolved before the end of the next fiscal year-end of December 31, 2025.

2024-004 – 10.558 – Child and Adult Care Food Program –Subrecipient Monitoring Condition Two providers who began Program operations during the period did not undergo a site visit during each new facility’s four weeks of operations. Recommendation Controls should be reviewed and updated to ensure that all new providers undergo a site visit within the first four weeks of operations. Comments on the Finding The Organization is aware of the oversight and will strive to improve the process. Action Taken The Director has added a column to her spreadsheet that tracks site visits. For any new participants to the program, this column will note the first date that they began participating, to better track when their first follow up visit must occur.

RIEMA acknowledges the audit finding regarding incomplete reporting of certain subawards to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) for fiscal year 2024. The reporting gap occurred due to the departure of the staff member previously responsible for FFATA reporting. Unfortunately, this position remained vacant until February of the current year, which contributed to delays and omissions in subaward reporting during that period. To prevent recurrence, RIEMA has filled the vacated position and will ensure the new staff member receives comprehensive training on FFATA requirements and FSRS procedures. Moving forward, we are also reviewing our internal processes to ensure continuity and compliance, even during periods of staffing transitions. RIEMA remains committed to full compliance with federal reporting requirements and transparency in the use of grant funds. Anticipated Completion Date: September 2025 Contact Person: Brian Riggs, Chief Financial Officer, Rhode Island Emergency Management Agency brian.j.riggs@ema.ri.gov

The RIEMA Recovery staff will revise the Federal Audit Clearinghouse tracking form to include the recommended items. We will not only include findings directly related to our program, FEMA 97.036, but all FEMA findings. We will also add any findings that were noted on any program on the tracking form. We are also creating an additional form, Verification of Compliance – FAC.Gov, which will be submitted to the RIEMA fiscal department. This form identifies any findings and requests their recommendation on proceeding with reimbursement to the sub-recipient in our payment package. Also, we will be incorporating our review of the Single Audit Report in both the tracking form and the verification form. Anticipated Completion Date: RIEMA is implementing this for all project reviews. Contact Person: Lawrence Macedo, Recovery Branch Chief, Rhode Island Emergency Management Agency lawrence.macedo@ema.ri.gov

EOHHS amended and updated its guidelines and standard operating procedures leveraging the CMS ‘Delivering Service in School-Based Settings: A Comprehensive Guide to Medicaid Services and Administrative Claiming’ as a source document. In addition to ensuring alignment with CMS requirements, the updated guidelines include a uniform schedule of quarterly submission dates and details the billing responsibilities of participating LEAs. These responsibilities include meeting all Medicaid documentation requirements; submitting the Certification of Local Funds on a quarterly basis; and signing provider agreements and maintaining all other records used to support claims submitted for Medicaid reimbursement. Upon receipt of these submissions a new audit tool will be utilized to ensure each submissions contains the required documentation. Beginning June 2025, EOHHS will initiate on-site reviews of twenty (20) LEAs using a tiered, randomized sample of claims from State Fiscal Year 2023 (SFY23). The sample will include claims with at least 20 claims per LEA, selected to ensure wide geographic representation. If documentation is missing, incomplete, or found to be in error, the LEA and their billing contractor will be notified and corrective action will be implemented. Lastly, EOHHS is also working in partnership with the CMS School-Based Services Technical Assistance Center to ensure continued alignment with federal expectations and the implementation of national best practices in school-based Medicaid claiming and update guidance. Anticipated Completion Date: Administrative Claiming Materials – June 1, 2024; On-site Audit – June 30, 2025 Contact Persons: Tyler McFeeters, Health Program Administrator, Executive Office of Health and Human Services tyler.mcfeeters@ohhs.ri.gov Mark Kraics, Deputy Medicaid Director, Executive Office of Health and Human Services mark.kraics@ohhs.ri.gov

Each health plan reports TPL recoveries to EOHHS in its quarterly financial report (FDCR). These recoveries are used as a direct offset to medical expenses. As such, claims paid by the plans on behalf of a member with TPL will remain in the EOHHS encounter data warehouse. Health plans do not void claims that have previously been paid to account for any TPL liability. Rather, they seek to recover from the third party any amount owed and report that amount to the state. In each of the last two fiscal years, this reduced medical expenditures by just under $8 million. 2025 Update: Following the process from 2023 and 2024, we are requesting a new TPL files from Gainwell that will be shared to each MCO. Anticipated Completion Date: Ongoing Contact Person: Jeffrey Schmeltz, Chief, Family Health Systems, Executive Office of Health and Human Services jeffrey.schmeltz@ohhs.ri.gov

The findings can be grouped into several areas as shown below. The responses are included below each grouping. Each response is included in each category. 1. Licensing a. “Licensing for providers of behavioral healthcare services and home and community-based services to members with developmental disabilities are, by statute, the responsibility of the Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH). BHDDH, in conjunction with evaluations of provider health and safety standards, relicenses providers biennially. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from BHDDH resulting in a weakness in control for this segment of providers.” b. “Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from DCYF resulting in a weakness in control for this segment of providers. c. 4 out of 60 providers sampled noted instances where providers remained active during fiscal 2024 after provider licenses had expired, evidencing a deficiency in internal control relating to timely provider deactivation if provider licensure is not evidenced. No claims were paid to these providers thus noncompliance was not noted.” EOHHS’ Division of Medicaid Compliance is actively working with BHDDH, DCYF, and RIDOH to address the licensing concerns by strengthening the communication of end dates between each agency’s licensing division and Medicaid’s Division of Medicaid Compliance. Anticipated Completion Date: Ongoing. Anticipated June 2025. Contact Persons: Emily Tumber, Implementation Director of Policy and Programs, Executive Office of Health and Human Services emily.tumber@ohhs.ri.gov Nicholas James, Implementation Director of Policy and Programs, Executive Office of Health and Human Services nicholas.james@ohhs.ri.gov 2. Systems a. “Encounter data submitted by managed care organizations is not currently validated for provider enrollment upon acceptance. This deficiency in internal controls over provider eligibility prevents the detection of claiming submitted by unenrolled providers. Our testing noted 4 managed care providers that were not enrolled in the Medicaid Program as required by federal regulations resulting in noncompliance with provider eligibility requirements (questioned costs - $3,371). All 4 providers were out-of-state providers required to be enrolled under federal regulations based on the volume of services billed to RI Medicaid. Implementing this additional edit when processing encounter data would improve controls over compliance. b. For claims representing care furnished to a beneficiary by an out-of-state furnishing provider, the SMA may pay a claim, in limited circumstances, to a furnishing provider that is not enrolled in the reimbursing state’s Medicaid plan. In these circumstances, the State is required to meet several requirements including verification that the provider is enrolled in good standing in Medicare or another state’s Medicaid program. The State is not currently performing such validation for out-of-state providers with limited claiming. c. The State did not have documentation supporting review of the SSA Death Master file for 19 out of the 60 providers we tested. a. EOHHS conducted research on these cases and completed a system upgrade to remedy the issue on 5/1/2024. b. EOHHS conducted research on these cases and completed a system upgrade to remedy the issue on 5/1/2024. c. EOHHS implemented new Provider Screening Tool in February 2025 which will provide dated documentation following the automated search for various screening requirements, including Death Master File. This documentation will be uploaded to the provider file. This will eliminate the manual process of searching for providers individually through the Death Master File and relying on an individual recording the date. Anticipated Completion Date: Ongoing Contact Person: Kimberly Tebow, Senior Medical Care Specialist, Executive Office of Health and Human Services kimberly.tebow@ohhs.ri.gov 3. Provider Surveys a. Federal regulations require the Medicaid agency to execute provider agreements with nursing facility providers and intermediate care facilities for individuals with intellectual disabilities (ICF/IID) upon receiving notification from the State survey and certification unit that the provider has been certified in substantial compliance with federal health and safety regulations. The State Medicaid agency lacked documentation of a finalized provider agreements and approval letters to providers in 6 out of 18 providers reviewed. In respect to the State’s only ICF/IID facility, the State Medicaid agency was not monitoring the RI Department of Health’s (RIDOH) certification process and had no documentation from RIDOH regarding the facility’s health and safety certification. All providers were recertified by RIDOH and compliant with program health and safety requirements. EOHHS/Medicaid implemented tracking protocol for all surveys received by the RIDOH to ensure completeness and timely response. Revisions to the internal standard operating procedure for the review and approval of these surveys are under review. This was completed on February 1, 2024. Regarding the monitoring of RIDOH’s certification process, EOHHS will collaboratively work with RIDOH to implement a monitoring program. Anticipated Completion Date: June 2026 for the monitoring program. Contact Person: Patricia Arruda, Chief of Strategic Planning, Monitoring & Evaluation, Executive Office of Health and Human Services patricia.arruda@ohhs.ri.gov

Management agrees with the findings, with some concerns noted in the corrective actions below. These corrective action steps are separated by specific health and safety finding. Background Checks: DHS will prioritize an emergency reopening of the regulations for both family and child care center regulations to require all providers and staff who work with children to enroll in the workforce registry no later than one month after promulgation. This will allow DHS staff to access employee files in real time to ensure that all staff have appropriate and current comprehensive background checks in their digital files. Until this regulation goes into effect, DHS will implement an immediate policy that all staff who work with children have their staff files audited as part of on-site monitoring visits. Previously, DHS looked only at those staff who were new since this last visit. However, this led to expired background checks being found during the audit. These expired checks also counted as not being able to demonstrate completion of the background check. DHS does want to acknowledge that during this audit, all staff were required to show evidence of a comprehensive background check. This included staff who did not have access to children and/or were not in the building when children were present. This does not align with regulation 218-RICR-70-00-1.12.A.1 which states, “All individuals working or engaging directly with children who are employed or act as a volunteer in the program, must complete all requirements of a comprehensive background check as outlined here: https://dhs.ri.gov/programs-and-services/child-care/child-care-providers/background-checks.” While the auditing team was informed of this, those staff not working with children who were on a payroll sheet were included as a finding against the Department. DHS will send out communication to the field alerting them that the lack of background checks is not tolerated. Staff who do not have these checks on file will be sent home until a background check is received (a practice that already exists, but typically the licensor is not looking at all files for every visit). For center providers, any staff or provider who is found to not have this information will be told to leave the program until this evidence is found. This may result in programs needing to temporarily close due to staff ratio issues. For family child care providers, this will involve a file audit of all received background checks, as well as a visit to ensure that there are no additional or new household members who have not completed this check. Any provider who has not submitted or completed an updated background check will be required to close until received. Any provider who is found to have household members who have not been listed and/or completed appropriate background checks will be closed due to failure to adhere to regulations. Immunizations: DHS recognizes and supports the importance of ensuring children are receiving timely vaccinations. However, DHS also recognizes that providers are only able to gather this data directly from families. Families who do not provide updated immunizations may be excluded from care if they do not provide these records. DHS will communicate with providers that no child should be enrolled without this documentation and that failure to provide updates to this documentation can result in dismissal from the program. DHS does not know if any of the children identified in this finding had medical or religious exemptions for their immunizations but would challenge that this finding could be skewed if this additional information was not ascertained by the auditing team. DHS will continue to partner with the Rhode Island Department of Health to ensure that programs are actively monitored and surveyed regarding immunization documentation. Emergency Preparedness Plan: DHS has been working with providers to ensure they have documented the required components of an emergency preparedness plan as required by federal funding agencies. DHS is requiring providers to include the DHS emergency plan form as part of renewal (for already existing providers) or as part of initial licensure. Absence of this form does not mean that the criteria is not being met. DHS did not train the auditors on what these required areas were and cannot speak to how this was monitored. However, DHS will continue to work with our providers to ensure that these criteria are met as part of the requirements in RISES. DHS has also created a training with The Center for Early Learning Professionals that reviews how to complete this plan and implement through practice. Unallowable Items In Cribs: This audit found that 30% of providers were found to have unallowable items in cribs. For the purposes of this audit, this finding included cribs that did not have children sleeping in them. Per the regulations for both Family and Child Care Centers, “No items are placed in the crib with an Infant except for a pacifier.” (218-RICR-70-00-2.3.3.C.1.k and 218-RICR-70-00-1.10.C.i respectively) DHS requests that only those providers who were found to have children in cribs with items be included in the finding. DHS has worked with The Center for Early Learning Professionals to develop individual trainings related to safe sleep. Providers who are found to be noncompliant regarding safe sleep practices are referred to those trainings with additional monitoring visits occurring to ensure changes have been made. As a result of this audit, DHS will inform providers that any safe sleep violations may result in a probationary status with additional licensing action possible if the continued noncompliance with safe sleep is observed. Toxic Substances unlabeled and accessible: DHS continues to monitor for this in both Family Child Care and Center-based programs. Typically, these are addressed and corrected onsite. Repeated noncompliance in this area can lead to probationary status. DHS will be reviewing the probationary process and use Technical Assistance with our federal funders to evaluate how other states address probation and other licensing actions. The goal is to solidify the current processes to ensure that there is an appropriate escalation review for repeated noncompliance that starts with probation and possibly lead to suspension of license. This will be communicated regularly to all providers. Developmental history: Per regulations, developmental histories are required only for programs serving infants and toddlers. Per Family Child Care regulation (218-RICR-70-00-2.3.6.F.7.a) and Child Care Center regulation (218-RICR-70-00-1.13.F.8.a), only files for infants and toddlers must contain developmental histories. DHS is unable to confirm whether or not this finding is related to this age group or if this finding occurred because age groups beyond that were assessed for compliance. Without this clarification, DHS would contest that this finding is accurate. DHS continues to support the provider community - both Family Child Care and Center providers - ensuring that they have gathered as much information as possible on the children they are enrolling in care. DHS will continue to audit files while on site to ensure that infants and toddlers have these documents completed. In the new RISES system, new providers who identify the desire to be licensed for either age group are required to submit examples of these forms as part of the initial application. For current providers, those serving these age groups will not be able to submit their first renewal in the system without uploading examples of these completed forms. Anticipated Completion Date: Background Checks: DHS will meet with policy staff immediately to discuss the emergency promulgation of new regulations. DHS will also immediately send out an email to the provider community regarding the outcomes of this audit and the responses that DHS intends to implement. Monitoring of programs, including for compliance of this regulation, will be ongoing. All other findings will be addressed in an ongoing fashion. Contact Person: Nicole Chiello, Assistant Director, Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov

2024-053a: The State (EOHHS) receives quarterly user access reports from the MMIS fiscal agent. Anyone identified on the reports that have not logged in for a period of 60 days will have their access terminated. Terminating the users access locks them out and prevents access the system without first requesting a password reset, which is reviewed and approved/denied by EOHHS systems group. In addition, when a user leaves state service or moves to another agency, their access is terminated immediately. An SOP will be implemented with offboarding procedures to assist in timely removal of access. Access is maintained and controlled within the GainwellNow system. Email notifications of pending requests for access are sent to Hector Rivera and Kim Tebow (both EOHHS), who must then review the request and attached form and either grant or deny access. An FTE will be added to the EOHHS/Medicaid Systems team to standardize all user access policies and procedures. Oversight of all IT security activities performed by the MMIS contractor is the responsibility of the EOHHS/Medicaid Project/Contract Manager assigned to the vendor. This individual is supported by the ETSS AIM assigned to support EOHHS/Medicaid. A SOC audit is completed yearly and provides documentation for penetration and vulnerability testing. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov Kimberly Tebow, Senior Medical Care Specialist, Executive Office of Health and Human Services kimberly.tebow@ohhs.ri.gov 2024-053b: The 2025 MARS-E Assessment is underway and will be completed by 4/30/2025. The results will be reviewed to assure the items in the previous MARS-E assessment have been addressed as expected by the state. Documentation lacking to evaluate security controls; Complete pending MARS-E Assessment Continued use of unsupported applications in need of update or patching; major upgrade of the end of life frameworks is planned for SFY2026 start. This expensive upgrade structurally supports most of the modernization platforms that the state is considering. Start SFY 2026; Completion SFY 2027 Lack of contractor tracking of exceptions and risk assessments; Exceptions for vulnerabilities are tracked in JIRA. Risk assessments are performed in all security tests and periodically on security controls. CISO approves all vulnerability exceptions. Complete pending MARS-E Assessment Contractor only sharing partial vulnerability scanning results; Raw report results are provided in Sharepoint in support of the risk assessment process. Complete pending MARS-E Assessment Lack of a robust triage process for security vulnerabilities; Complete pending MARS-E Assessment Inadequate consideration of IT security vulnerabilities with industry best practices. Security vulnerability assessments are performed using the CMS method of impact X probability. The method has been reviewed by state and MARS-E assessor. Complete pending MARS-E Assessment Anticipated Completion Dates: See above Contact Person: Deb Merrill, Security Officer, Enterprise Technology System Services, Department of Administration deb.merrill@doit.ri.gov 2024-053c: The State (EOHHS) collaborates with system vendors (MMIS/Gainwell and Deloitte/RI Bridges) Maintenance & Operations (M&O) and Security teams to ensure annual risk assessment/vulnerability best practices and lessons learned are integrated into annual planning and scope of work for future FYs. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov 2024-053d: Our controls for User Access are in place. Depending on the access requested by the type of user and the program being administered, access are provided accordingly. Anticipated Completion Date: Current and Ongoing Contact Persons: Saurabh Gosai, Director – Technology, Strategy and Innovation, Department Human Services saurabh.u.gosai@dhs.ri.gov Sherri Kennedy, Chief - Human Services Policy and Systems Specialist, Department of Human Services sherri.kennedy@dhs.ri.gov

DHS management has implemented new procedures in SFY25 and anticipates this will not be a finding for the next Single Audit. Preparers of reports have been instructed to do a lookback for any additional entries from prior quarters not previously reported. Each report is now saved with the supporting documentation on a shared drive. Additionally, DHS will document the process of quarterly federal financial reporting. Regarding Federal Funding Accountability and Transparency Act (FFATA) reporting, DHS has started to track reporting by capturing contract execution dates to ensure timeliness. Anticipated Completion Date: June 30, 2025 Contact Person: Ben Quattrucci, Associate Director Financial Contract Management, Department of Human Services benjamin.a.quattrucci@dhs.ri.gov