Corrective Action Plans

Finding Number 2024-094 Subject Heading (Financial) or AL no. and program name (Federal) 97.036 – Disaster Grants – Public Assistance Planned Corrective Action To address this finding, OEM will strengthen its review procedures for the SEFA by implementing a documented review process to verify the accuracy and completeness of information provided by ABS. OEM will coordinate with ABS to obtain and retain sufficient supporting documentation for amounts reported on the SEFA and will work with ABS to resolve any discrepancies identified during the review process. In addition, OEM will ensure staff responsible for reviewing the SEFA receive additional guidance and training on SEFA reporting requirements. These actions are intended to improve the accuracy and reliability of future SEFA reporting and strengthen compliance with applicable federal requirements. Anticipated Completion Date SFY26 Reporting Period Responsible Contact Person Brianna Thomas

Finding Number 2024-093 Subject Heading (Financial) or AL no. and program name (Federal) 97.036 – Disaster Grants – Public Assistance Planned Corrective Action Management acknowledges risk assessments were not performed in SFY24. Going forward, OEM will conduct risk assessments that are an annual review for all open projects and a monthly review for any new applicants. They will involve feedback from both the subrecipient and OEM’s data and is completed in EMGrants. Anyone has the ability to see the applicant risk rating on the applicant homepage in the system. While there was a grant wide extension for period of performance, management acknowledges the applicants identified by SAI did not request time extensions for their specific project and therefore, did not meet period of performance requirements. OEM will implement procedures to ensure applicants meet period of performance deadlines and have proper time extensions documented when required. Anticipated Completion Date 6/30/2025 9/27/2026 Responsible Contact Person Abby Anderson Sofia Checketts

Finding Number 2024-084 Subject Heading (Financial) or AL no. and program name (Federal) 93.778 Medicaid Cluster Planned Corrective Action OKDHS agrees with the finding and recommendation. The agency recognizes that the volume of GI DX discrepancy messages, combined with limited automated triage capabilities, contributed to delays in resolving exceptions within the required 45-calendar-day timeframe. As noted by the auditors, the existing process relied heavily on manual review and did not provide sufficient management oversight tools to effectively monitor aging discrepancies and ensure timely resolution. Corrective Action Planned: OKDHS has initiated a multi-faceted corrective action plan designed to improve the timeliness, consistency, and accountability of GI DX exception resolution. As part of this effort, OKDHS is developing an automated prescreening process for National New Hire (NNH), State New Hire (SNH), and Oklahoma Wage (OWG) discrepancy messages. The automated process is intended to evaluate discrepancies against established policy criteria and reduce the number of non-actionable matches requiring manual review. Discrepancies identified as requiring staff review will be routed to eligibility staff with standardized documentation and processing guida nee. Additionally, OKDHS is developing formal procedures governing the review, monitoring, and resolution of GIDX discrepancies. These procedures will def me staff responsibilities, supervisory oversight expectations, escalation requirements, and management use of exception monitoring reports to support timely resolution of discrepancies. Management reporting and monitoring controls are also being enhanced to improve visibility into outstanding discrepancies and aging trends. Supervisors and program management will utilize exception reporting to monitor workloads, identify training opportunities, and promote accountability for timely processing. OKDHS will also provide training and implementation guidance to staff and supervisors regarding revised workflows, discrepancy resolution requirements, documentation standards, and management monitoring expectations. The agency anticipates implementation of the planned enhancements beginning in October 2026, with continued monitoring and refinement following deployment to ensure the corrective actions effectively address the underlying control deficiencies identified in the finding. OHCA MEMBER AUDIT Auditor Response: Member Audit began receiving Medicaid files monthly in September of 2023. Files are continuing to be received from DHS each month. Audits are completed monthly and will continue indefinitely. Any discrepancies are discussed with OKDHS to determine the cause and remedy put in place to ensure any failed jobs were resolved. Anticipated Completion Date October 2026 Responsible Contact Person OKDHS Contact: Kayla Urtz, Director of Internal Audit OHCA Contact: Tana Parrott, Director of Member Audits

Finding Number 2024-084 Subject Heading (Financial) or AL no. and program name (Federal) 93.778 - Medicaid Planned Corrective Action OKDHS agrees with the finding and recommendation. The agency recognizes that the volume of GI DX discrepancy messages, combined with limited automated triage capabilities, contributed to delays in resolving exceptions within the required 45-calendar-day timeframe. As noted by the auditors, the existing process relied heavily on manual review and did not provide sufficient management oversight tools to effectively monitor aging discrepancies and ensure timely resolution. OKDHS has initiated a muti-faceted corrective action plan designed to improve the timeliness, consistency, and accountability of G1DX exception resolution. As part of this effort, OKDHS is developing an automated pre-screening process for National New Hire (NNH), State New Hire (SNH), and Oklahoma Wage (OWG) discrepancy messages. The automated process is intended to evaluate discrepancies against established policy criteria and reduce the number of non-actionable matches requiring manual review. Discrepancies identified as requiring staff review will be routed to eligibility staff with standardized documentation and processing guidance. Additionally, OKDHS is developing formal procedures governing the review, monitoring, and resolution of GIDX discrepancies. These procedures will define staff responsibilities, supervisory oversight expectations, escalation requirements, and management use of exception monitoring reports to support the timely resolution of discrepancies. Management reporting and monitoring controls are also being enhanced to improve visibility into outstanding discrepancies and aging trends. Supervisors and program management will utilize exception reporting to monitor workloads, identify training opportunities, and promote accountability for timely processing. OKDHS will also provide training and implementation guidance to staff and supervisors regarding revised workflows, discrepancy resolution requirements, documentation standards, and management monitoring expectations. The agency anticipates implementation of the planned enhancements beginning in October 2026, with continued monitoring and refinement following deployment to ensure the corrective actions effectively address the underlying control deficiencies identified in the finding. Anticipated Completion Date 10/5/26 and OHCA will continue monitoring through SFY2025 Responsible Contact Person Kayla Urtz and Tana Parrott, OHCA

Finding Number 2024-006 Subject Heading (Financial) or AL no. and program name (Federal) 93.778 Medicaid Cluster Planned Corrective Action Per recommendation from the State Auditor & Inspector listed above. The Oklahoma Health Care Authority (OHCA) will continue to implement the Corrective Action Plan processes which include collaborating with the Medicaid Fraud Control Unit at the Oklahoma Attorney General’s office quarterly to track the status of closed cases, obtaining sufficient supporting documentation, and timely report and refund identified overpayments on the CMS-64. Anticipated Completion Date Review at end of State Fiscal Year (SFY) 2025 Responsible Contact Person Kristin Edwards OHCA Senior Director of Program and Integrity

Finding Number 2024-025 Subject Heading (Financial) or AL no. and program name (Federal) 93.658 – Foster Care Planned Corrective Action Oklahoma Human Services (OKDHS) concurs with the recommendation. OKDHS has been working to centralize and strengthen its contract and subrecipient monitoring processes to improve consistency in the identification, documentation, risk assessment, and monitoring of subrecipient relationships across the agency. As part of this effort, OKDHS is updating its procedures and standardized documentation to better ensure that subawards include required federal award information, program responsibilities and deliverables are sufficiently defined, required documentation is obtained and retained, and subrecipient risk assessments and monitoring activities are completed and documented consistently. OKDHS will implement updated, centralized contract and subrecipient monitoring procedures, including standardized tools and documentation requirements designed to address the conditions identified in the finding. The updated process will clarify responsibilities for documenting subrecipient risk assessments, required federal award information, contractual requirements, deliverables, and ongoing monitoring activities. Anticipated Completion Date 9/30/2026 Responsible Contact Person Kayla Urtz

Finding Number 2024-081 Subject Heading (Financial) or AL no. and program name (Federal) 93.575 – CCDF Cluster Planned Corrective Action OKDHS agrees with the finding and recommendation. The agency recognizes that the volume of GI DX discrepancy messages, combined with limited automated triage capabilities, contributed to delays in resolving exceptions within the required 45-calendar-day timeframe. As noted by the auditors, the existing process relied heavily on manual review and did not provide sufficient management oversight tools to effectively monitor aging discrepancies and ensure timely resolution. OKDHS has initiated a muti-faceted corrective action plan designed to improve the timeliness, consistency, and accountability of G1DX exception resolution. As part of this effort, OKDHS is developing an automated pre-screening process for National New Hire (NNH), State New Hire (SNH), and Oklahoma Wage (OWG) discrepancy messages. The automated process is intended to evaluate discrepancies against established policy criteria and reduce the number of non-actionable matches requiring manual review. Discrepancies identified as requiring staff review will be routed to eligibility staff with standardized documentation and processing guidance. Additionally, OKDHS is developing formal procedures governing the review, monitoring, and resolution of GIDX discrepancies. These procedures will define staff responsibilities, supervisory oversight expectations, escalation requirements, and management use of exception monitoring reports to support the timely resolution of discrepancies. Management reporting and monitoring controls are also being enhanced to improve visibility into outstanding discrepancies and aging trends. Supervisors and program management will utilize exception reporting to monitor workloads, identify training opportunities, and promote accountability for timely processing. OKDHS will also provide training and implementation guidance to staff and supervisors regarding revised workflows, discrepancy resolution requirements, documentation standards, and management monitoring expectations. The agency anticipates implementation of the planned enhancements beginning in October 2026, with continued monitoring and refinement following deployment to ensure the corrective actions effectively address the underlying control deficiencies identified in the finding. Anticipated Completion Date 10/5/26 Responsible Contact Person Kayla Urtz

Finding Number 2024-033 Subject Heading (Financial) or AL no. and program name (Federal) 93.575 – CCDF Cluster Planned Corrective Action The Agency agrees that additional oversight activities could have provided greater visibility into provider use of Stabilization Payments and has incorporated lessons learned into subsequent provider assistance initiatives through enhanced monitoring, documentation expectations, and recovery procedures for confirmed noncompliance. However, OKDHS respectfully disagrees with several conclusions contained within the finding, including the characterization of questioned costs and the extrapolation of provider-specific exceptions across the broader population of Stabilization Payment recipients. The Child Care Stabilization Payment Program was established under the American Rescue Plan Act to provide emergency financial assistance intended to stabilize the child care industry during the COVID-19 public health emergency. Stabilization Payments were awarded using an approved payment methodology based upon provider eligibility, licensed capacity, and applicable STAR level. As previously communicated to the Administration for Children and Families (ACF), OKDHS does not concur with the assertion that the monitoring activities identified by SAI were required under the Stabilization Payment Program. The applicable Notice of Award specifically excluded significant portions of the traditional federal post-award administrative requirements, including most post-award requirements and the federal cost principles. Accordingly, OKDHS does not believe the Stabilization Payment Program should be evaluated using the same oversight framework applicable to traditional reimbursement or discretionary grant programs. Providers receiving Stabilization Payments were required to certify that funds would be used only for allowable purposes established by the American Rescue Plan Act and applicable program guidance and were responsible for maintaining supporting documentation for those expenditures. When information indicating potential misuse of funds is identified, OKDHS reviews the circumstances and pursues recovery actions as appropriate. While documentation obtained from providers may assist in evaluating provider compliance, the absence of documentation during the audit does not, by itself, establish that Stabilization Payments were improperly awarded or expended for unallowable purposes. OKDHS also respectfully disagrees with the treatment of unsupported expenditures as equivalent to known unallowable expenditures. Unsupported expenditures reflect circumstances in which documentation was unavailable for audit review and do not establish that funds were expended for unallowable purposes. As a result, the Agency believes the questioned costs materially overstate actual federal exposure. Finally, OKDHS does not concur that provider-specific exceptions may be extrapolated across the broader provider population. The exceptions identified by SAI reflect individual provider documentation and spending practices rather than a common agency-level eligibility, payment methodology, or processing error. Accordingly, the Agency does not believe the audit evidence supports extrapolating these exceptions to estimate program-wide questioned costs. Although the Stabilization Payment Program has concluded, OKDHS has strengthened oversight of subsequent provider assistance initiatives by enhancing monitoring procedures, documentation expectations, and recovery processes for confirmed provider noncompliance. The Agency will continue reviewing cases identified through audit activities and pursue recovery of confirmed unallowable expenditures in accordance with applicable federal requirements. Anticipated Completion Date N/A Responsible Contact Person Kayla Urtz

Finding Number 2024-082 Subject Heading (Financial) or AL no. and program name (Federal) 93.568 – LIHEAP Planned Corrective Action OKDHS agrees with the finding and recommendation. The agency recognizes that the volume of GI DX discrepancy messages, combined with limited automated triage capabilities, contributed to delays in resolving exceptions within the required 45-calendar-day timeframe. As noted by the auditors, the existing process relied heavily on manual review and did not provide sufficient management oversight tools to effectively monitor aging discrepancies and ensure timely resolution. OKDHS has initiated a muti-faceted corrective action plan designed to improve the timeliness, consistency, and accountability of G1DX exception resolution. As part of this effort, OKDHS is developing an automated pre-screening process for National New Hire (NNH), State New Hire (SNH), and Oklahoma Wage (OWG) discrepancy messages. The automated process is intended to evaluate discrepancies against established policy criteria and reduce the number of non-actionable matches requiring manual review. Discrepancies identified as requiring staff review will be routed to eligibility staff with standardized documentation and processing guidance. Additionally, OKDHS is developing formal procedures governing the review, monitoring, and resolution of GIDX discrepancies. These procedures will define staff responsibilities, supervisory oversight expectations, escalation requirements, and management use of exception monitoring reports to support the timely resolution of discrepancies. Management reporting and monitoring controls are also being enhanced to improve visibility into outstanding discrepancies and aging trends. Supervisors and program management will utilize exception reporting to monitor workloads, identify training opportunities, and promote accountability for timely processing. OKDHS will also provide training and implementation guidance to staff and supervisors regarding revised workflows, discrepancy resolution requirements, documentation standards, and management monitoring expectations. The agency anticipates implementation of the planned enhancements beginning in October 2026, with continued monitoring and refinement following deployment to ensure the corrective actions effectively address the underlying control deficiencies identified in the finding. Anticipated Completion Date 10/5/26 Responsible Contact Person Kayla Urtz

Finding Number 2024-060 Subject Heading (Financial) or AL no. and program name (Federal) 93.658 - LIHEAP Planned Corrective Action OKDHS concurs that the control environment in place during the period reviewed did not provide adequate segregation of duties and allowed incompatible responsibilities to be concentrated within the program area. OKDHS takes the identified fraudulent activity and associated control weaknesses seriously. The fraudulent activity involved intentional actions by a former employee who was able to exploit excessive access and insufficient segregation between program administration, vendor maintenance, and payment-related processes. Upon identification of the suspected activity, OKDHS took action to remove the employee's access, terminate employment, and refer the matter for investigation and appropriate legal action. OKDHS continues to cooperate with investigative authorities regarding the full scope of the activity. In response, OKDHS is not limiting corrective action to additional review within the existing LIHEAP process. The Agency is redesigning the underlying business processes to separate program administration from vendor registration, vendor maintenance, contracting, financial reporting, and payment processing. The corrective actions described below are intended to establish independent controls across multiple organizational functions and reduce reliance on information prepared and controlled solely within the program area. Enhanced Financial Reporting and Oversight OKDHS Finance is working to obtain more detailed, transaction-level LIHEAP information to support independent financial oversight and reconciliation. Historically, Finance relied substantially on summarized information provided by the program area. The enhanced reporting structure is intended to provide Finance with greater visibility into underlying LIHEAP transactions and improve its ability to independently reconcile, review, and analyze program expenditures. This increased access to detailed information will also support the development of exception reporting and other analytical procedures designed to identify unusual payment activity, vendor activity, or other anomalies requiring additional review. Transition of LIHEAP Payments to PeopleSoft OKDHS is working with its technical teams to transition LIHEAP payment processing to PeopleSoft. This change will integrate LIHEAP payments into the Agency's established financial system and associated financial controls rather than maintaining a separate program controlled vendor and payment process. Under the redesigned process, LIHEAP providers will be required to complete the applicable statewide vendor registration process before receiving payment. Vendor establishment and maintenance, including changes to vendor information, will therefore be subject to controls outside of the LIHEAP program area. The transition will eliminate the program area's ability to independently maintain the vendor information used to facilitate LIHEAP payments and will provide greater segregation between program eligibility and benefit authorization responsibilities and the vendor establishment and payment functions. Centralized Vendor Registration and Maintenance As part of the transition to PeopleSoft, the existing AFS vendor-maintenance process will be replaced by the statewide vendor registration and maintenance process. LIHEAP program staff will no longer independently control the establishment or maintenance of the vendor records used for payment. This change is intended to ensure that vendor creation and modification are performed through an independent process and are appropriately separated from program functions responsible for determining eligibility and authorizing benefits. Formal Provider Contracting OKDHS Procurement is working to establish contracts with LIHEAP providers. Formalizing provider relationships through the procurement and contracting process will establish additional independent review and documentation before providers participate in the program and receive payments. The contracting process will also provide a defined mechanism for establishing provider responsibilities, maintaining provider information, and addressing compliance or performance concerns. Strengthened Segregation of Duties Collectively, these changes are designed to establish segregation across the major components of the LIHEAP process: • AFS/LIHEAP program staff will remain responsible for program administration and applicable eligibility and benefit determinations; • Statewide vendor registration and financial system processes will control vendor establishment and maintenance; • Procurement will oversee the formal contracting process with participating providers; and • Finance will have increased access to detailed transaction information to support independent financial oversight, reconciliation, and analysis. This structure is intended to prevent a single employee or organizational unit from controlling the program, vendor, and payment functions necessary to initiate and conceal improper transactions. System Controls and Monitoring As the redesigned processes are implemented, OKDHS will continue to evaluate system controls, access permissions, exception reporting, and data analytics to identify unusual vendor or payment activity. The transition to centralized vendor registration, PeopleSoft payment processing, formal provider contracting, and enhanced financial reporting will provide additional opportunities for independent review and monitoring. OKDHS will also continue to cooperate with OIG and other appropriate investigative and legal authorities regarding the identified fraudulent activity and will pursue appropriate recovery and corrective actions based on the results of those proceedings. These actions represent a significant redesign of the LIHEAP control environment and are intended to address the underlying conditions that allowed the fraudulent activity to occur and remain undetected. By distributing responsibility for program administration, vendor registration and maintenance, contracting, financial oversight, and payment processing across independent functions, OKDHS is establishing a more sustainable control structure designed to reduce the risk of similar fraudulent activity in the future. Anticipated Completion Date In Progress Responsible Contact Person Kayla Urtz

Finding Number 2024-051 Subject Heading (Financial) or AL no. and program name (Federal) 93.658 - LIHEAP Planned Corrective Action The Oklahoma Department of Human Services (OKDHS) concurs that improvements were needed to strengthen certain automated payment processing controls, system edits, and supervisory review procedures within the LIHEAP program. The Agency agrees with the specific payment processing errors identified during audit testing related to cooling overpayments, ECAP payment limits, duplicate payments, and preauthorization system logic. Corrective actions, including system modifications, policy clarification, staff coaching, enhanced supervisory oversight, and improvements to payment validation processes, have been implemented or are in progress to reduce the risk of recurrence. The Agency notes, however, that this finding combines several distinct issues—including isolated payment processing errors, temporary administration of LIHWAP and LIHEAP supplemental benefits, reporting limitations associated with legacy system functionality, and recommendations regarding future system design—into a single conclusion regarding the adequacy of internal controls. While each of these issues warrants evaluation and appropriate corrective action, they represent different types of control considerations and should not be viewed as resulting from a single underlying control deficiency. During implementation of LIHWAP and subsequent LIHEAP supplemental payments, OKDHS utilized its existing eligibility infrastructure to administer multiple federally authorized funding streams. This approach was consistent with congressional direction encouraging states, to the extent practicable, to utilize existing systems, processes, and procedures when implementing the temporary LIHWAP program. While this approach allowed the Agency to efficiently deliver emergency assistance, the Agency acknowledges that utilizing common payment coding across multiple temporary funding streams reduced reporting clarity and complicated downstream financial reporting and audit analytics. The Agency further notes that the majority of the questioned costs identified in this finding resulted from payment processing logic, temporary system configuration changes, or automated system edits rather than deficiencies in the underlying eligibility determination process. Accordingly, corrective actions have appropriately focused on strengthening payment validation, automated system edits, duplicate payment prevention, and preauthorization controls while continuing to reinforce supervisory review of eligibility determinations. The Agency agrees that improvements to payment coding, reporting architecture, and reconciliation capabilities would strengthen the overall control environment and has already initiated broader modernization efforts in these areas. These efforts extend beyond the recommendations contained in this finding and are intended to improve financial reporting, reconciliation, program transparency, and overall governance while supporting long-term administration of LIHEAP and other assistance programs. The Agency respectfully disagrees that the reporting limitations identified by the auditors, standing alone, demonstrate an overall failure of eligibility or payment authorization controls. While the Agency acknowledges the payment processing errors identified elsewhere in this finding, the lack of distinct payment identifiers primarily affected reporting, reconciliation, and audit analytics rather than the Agency's ability to accurately determine eligibility for the vast majority of transactions reviewed. The finding itself demonstrates that both the Agency and the auditors were ultimately able to distinguish between LIHEAP, LIHWAP, and supplemental payments through available program documentation when evaluating the sampled transactions. Accordingly, the Agency believes the identified system limitation is more appropriately characterized as a reporting and system design issue than evidence that the underlying eligibility control framework was ineffective. The Agency also respectfully disagrees that creation of additional payment identifiers is the only means of achieving compliance with federal internal control requirements. Federal internal control standards require reasonable assurance that federal funds are properly administered, but they do not prescribe a specific system architecture or require a particular reporting structure. While distinct payment identifiers would improve reporting efficiency and facilitate financial reconciliation and audit analytics, the Agency does not believe the absence of those identifiers, by itself, constitutes a compliance deficiency. Since the audit period, the Agency has undertaken broader improvements extending beyond the specific recommendations contained in this finding. These efforts include strengthening automated payment processing controls, restoring and enhancing system edits, improving reporting architecture, expanding financial reconciliation capabilities, reinforcing supervisory oversight, and improving overall program governance. Collectively, these initiatives are intended to establish a stronger and more sustainable internal control framework while improving the Agency's ability to administer multiple funding streams and provide more transparent financial reporting. Accordingly, the Agency concurs that certain payment processing controls, automated system edits, and related supervisory controls required strengthening and has implemented corrective actions addressing those issues. However, the Agency respectfully disagrees that the reporting limitations identified in this finding, standing alone, demonstrate an overall failure of LIHEAP eligibility controls or establish that implementation of distinct payment identifiers is the only means of achieving reasonable assurance over program administration. Anticipated Completion Date In progress Responsible Contact Person Kayla Urtz

Finding Number 2024-027 Subject Heading (Financial) or AL no. and program name (Federal) 93.568 - LIHEAP Planned Corrective Action Due to the age and sophistication of updating our current systems, many of our LIHEAP processes and reporting have become outdated. AFS, Finance, and DTO have several projects in the pipeline to improve system and program reporting and to improve the reconciliation of eligibility and payment data. Anticipated Completion Date 10/31/2026 Responsible Contact Person Kayla Urtz

Finding Number 2024-012 Subject Heading (Financial) or AL no. and program name (Federal) 93.568 – LIHEAP Planned Corrective Action OKDHS's vendor currently utilizes a live database to source the data needed for the Quarterly Report. OKDHS will require those pulling the data to provide a snapshot of the database that supports the data used and store these snapshots for our records to better support point in time federal reports. OKDHS program staff will continue to review data submissions and monitor for inconsistencies. OKDHS will add instructions to the Standard Operating Procedures that detail the Program Field Representative and Program Manager reviews. Anticipated Completion Date 10/31/2026 Responsible Contact Person Kayla Urtz

Finding Number 2024-064 Subject Heading (Financial) or AL no. and program name (Federal) 93.558 – TANF Planned Corrective Action OKDHS concurs and will ensure that staff are refreshed on the importance of including all verifications in the case file at certification. Anticipated Completion Date N/A Responsible Contact Person Kayla Urtz

Finding Number 2024-063 Subject Heading (Financial) or AL no. and program name (Federal) 93.558 – TANF Planned Corrective Action OKDHS agrees that controls related to the timely completion and documentation of TANF eligibility redeterminations can be strengthened. During the period reviewed, eligibility operations were impacted by the Public Health Emergency (PHE) and associated continuous coverage requirements. As the agency worked through the post-PHE unwinding process, efforts were focused on reviewing and updating affected cases. During this period, some staff incorrectly believed TANF reviews were subject to the same review flexibilities that applied to medical programs, resulting in untimely completion of certain TANF eligibility redeterminations. To strengthen controls, OKDHS has implemented the Current system, which automatically assigns cases requiring review and provides enhanced workload management and monitoring capabilities. Current includes tracking and reporting functionality that identifies untimely reviews, places overdue items on management reports, and alerts staff and supervisors when action is needed. In addition, supervisory staff conduct monitoring activities, including spot checks and review of workload reports, to ensure eligibility reviews are completed and documented within required timeframes. OKDHS believes these system enhancements and monitoring activities strengthen oversight of T ANF eligibility redeterminations and provide greater assurance that reviews are completed timely and appropriately documented. Anticipated Completion Date In progress Responsible Contact Person Kayla Urtz

Finding Number 2024-041 Subject Heading (Financial) or AL no. and program name (Federal) 93.558 – TANF Planned Corrective Action OKDHS agrees with the finding and recommendation. The agency recognizes that the volume of GI DX discrepancy messages, combined with limited automated triage capabilities, contributed to delays in resolving exceptions within the required 45-calendar-day timeframe. As noted by the auditors, the existing process relied heavily on manual review and did not provide sufficient management oversight tools to effectively monitor aging discrepancies and ensure timely resolution. OKDHS has initiated a muti-faceted corrective action plan designed to improve the timeliness, consistency, and accountability of G1DX exception resolution. As part of this effort, OKDHS is developing an automated pre-screening process for National New Hire (NNH), State New Hire (SNH), and Oklahoma Wage (OWG) discrepancy messages. The automated process is intended to evaluate discrepancies against established policy criteria and reduce the number of non-actionable matches requiring manual review. Discrepancies identified as requiring staff review will be routed to eligibility staff with standardized documentation and processing guidance. Additionally, OKDHS is developing formal procedures governing the review, monitoring, and resolution of GIDX discrepancies. These procedures will define staff responsibilities, supervisory oversight expectations, escalation requirements, and management use of exception monitoring reports to support the timely resolution of discrepancies. Management reporting and monitoring controls are also being enhanced to improve visibility into outstanding discrepancies and aging trends. Supervisors and program management will utilize exception reporting to monitor workloads, identify training opportunities, and promote accountability for timely processing. OKDHS will also provide training and implementation guidance to staff and supervisors regarding revised workflows, discrepancy resolution requirements, documentation standards, and management monitoring expectations. The agency anticipates implementation of the planned enhancements beginning in October 2026, with continued monitoring and refinement following deployment to ensure the corrective actions effectively address the underlying control deficiencies identified in the finding. Anticipated Completion Date 10/5/26 Responsible Contact Person Kayla Urtz

Finding Number 2024-109 Subject Heading (Financial) or AL no. and program name (Federal) 93.323: Epidemiology and Laboratory Capacity for Infectious Diseases Planned Corrective Action OSDH management agrees with this finding and will work with OMES to ensure Workday payroll expenditures are accurately reflected in PeopleSoft’s general ledger based on actual project time worked rather than budgeted position setup allocations. We are actively exploring reconciliation steps within PeopleSoft to accurately record project time worked in accordance with approved timecards to the appropriate funding within the general ledger. Anticipated Completion Date 06/30/27 Responsible Contact Person Ryon Fields, Interim CFO

Finding Number 2024-108 Subject Heading (Financial) or AL no. and program name (Federal) 93.268: Immunizations Cooperative Agreements Planned Corrective Action OSDH management agrees with this finding and will work with OMES to ensure Workday payroll expenditures are accurately reflected in PeopleSoft’s general ledger based on actual project time worked rather than budgeted position setup allocations. We are actively exploring reconciliation steps within PeopleSoft to accurately record project time worked in accordance with approved timecards to the appropriate funding within the general ledger. Anticipated Completion Date 06/30/27 Responsible Contact Person Ryon Fields, Interim CFO

Finding Number 2024-026 Subject Heading (Financial) or AL no. and program name (Federal) AL #84.425 – EDUCATION STABILIZATION FUND (ESF - AL #84.425D; 84.425U) Planned Corrective Action The Office of Title Services (OTS) staff will ensure that at a minimum a district’s inventory procedures meet the following requirements. • For materials and supply items, the Office of Title Services (OTS) staff will review the district’s inventory procedures for compliance with 2 C.F.R. 200.302(b)(4). • For equipment items ($10,000 or greater unit cost) OTS staff will review the district’s inventory procedures for compliance with the requirements of 2 C.F. R. 200.313 (d)(1) • Additionally, training will be provided to staff during our annual internal training. Anticipated Completion Date Aug-25 Responsible Contact Person Tammy Smith

Finding Number 2024-023 Subject Heading (Financial) or AL no. and program name (Federal) AL #84.425 – EDUCATION STABILIZATION FUND (ESF - AL #84.425D; 84.425U) Planned Corrective Action OSDE will follow the OTS internal policies and procedures for the retention of records. In addition, OTS will continue to develop and implement policies and procedures, along with providing adequate training, to ensure that allocations and expenditures reported on annual reports are accurate and properly supported. Anticipated Completion Date Aug-26 Responsible Contact Person Tammy Smith

Finding Number 2024-019 Subject Heading (Financial) or AL no. and program name (Federal) AL #84.425 – EDUCATION STABILIZATION FUND (ESF - AL #84.425U) Planned Corrective Action OSDE maintains that these procedures are adequate to ensure compliance with 34 CFR §§ 75.600–75.618. Leadership in the Office of Title Services determined that OTS did not have the staff capacity to require review of payroll certifications during the application review process; therefore, this monitoring was conducted during onsite visits. Given the limited number of project managers available to perform onsite reviews during the ESSER period, OSDE believes the sampling completed onsite was reasonable and sufficient to assess compliance. Guidance and tools were provided to LEAs to support proper implementation of prevailing wage requirements. Monitoring results are reviewed and approved by OTS leadership, and corrective actions are required when non-compliance is identified. Anticipated Completion Date Sept-25 Responsible Contact Person Tammy Smith

Finding Number 2024-016 Subject Heading (Financial) or AL no. and program name (Federal) AL #84.425 – EDUCATION STABILIZATION FUND (ESF - AL #84.425D; #84.425U) Planned Corrective Action The agency acknowledges that certain ESSER II and ARP ESSER III claims were approved without adequate review of supporting documentation by authorized claims reviewers. To address this finding, the agency has strengthened its claims review procedures and internal controls related to reimbursement processing. Additional training will be provided for all claims reviewers regarding: • allowable use of funds requirements, • supporting documentation standards, • verification of invoice documentation, • program coding requirements, and • review and approval expectations for federal claims. The agency will also implement enhanced supervisory review and monitoring procedures to help ensure claims are consistently reviewed in accordance with federal requirements prior to approval. The agency acknowledges that allocation notices were not consistently generated and provided to certain LEAs in accordance with the requirements of 2 CFR § 200.332(a)(1). Additionally, one allocation notice did not contain all required elements, including the Federal Award Identification Number (FAIN) and Federal award date. Although the audit confirmed that allocation amounts and approved budgets within the grants management system were accurate, the agency recognizes the need to strengthen procedures related to issuance and documentation of subrecipient award notifications. To address this finding, the agency will revise and strengthen internal procedures to ensure all required allocation notices are generated, maintained, and distributed timely and consistently to subrecipients. The agency will also coordinate with our third party vendor to implement additional quality control measures and staff training to ensure all required federal award information, including the FAIN and Federal award date, is included in future allocation notices in accordance with 2 CFR § 200.332 requirements. Anticipated Completion Date Sept-26 Responsible Contact Person Tammy Smith

Finding Number 2024-001 Subject Heading (Financial) or AL no. and program name (Federal) AL #84.010 TITLE I, PART A – GRANTS TO LOCAL EDUCATIONAL AGENCIES AL #84.425 – EDUCATION STABILIZATION FUND (ESF - AL #84.425D; 84.425U) Planned Corrective Action OSDE agrees with the recommendation and will strengthen its subrecipient risk assessment and monitoring processes to ensure LEAs are consistently and accurately evaluated. Specifically, OSDE will: • Revise and formalize written policies and procedures governing the Risk Assessment Ranking Tool, including detailed guidance for assigning and documenting risk scores. • Implement a standardized review process requiring supervisory review and approval of all annual risk assessments prior to finalizing LEA risk classifications. • Develop a risk assessment checklist to ensure all required risk factors are evaluated consistently and supporting documentation is maintained. • Provide annual training to staff responsible for completing and reviewing risk assessments to ensure consistent application of scoring criteria. • Perform periodic quality assurance reviews of completed risk assessments to verify scoring accuracy, identify trends or errors, and implement corrective measures when needed. Anticipated Completion Date Aug -26 Responsible Contact Person Tammy Smith

Finding Number 2024-013 Subject Heading (Financial) or AL no. and program name (Federal) AL #84.010 TITLE I, PART A – GRANTS TO LOCAL EDUCATIONAL AGENCIES Planned Corrective Action OSDE acknowledges the audit finding. During the FY24 audit period, monitoring procedures for LEA Supplement Not Supplant (SNS) methodologies were identified as lacking adequate documentation and verification measures. On July 25, 2024, OSDE submitted corrective action plans to USDE, which included revisions to the ESEA Resource Toolkit, Title I Handbook, and GMS review protocols. As of April 11, 2025, USDE determined that the SNS requirements have been satisfied and confirmed that OSDE’s revised resources are consistent with federal guidance. OSDE has subsequently strengthened internal controls and improved monitoring procedures to ensure ongoing compliance of LEA SNS methodologies and supporting documentation. Anticipated Completion Date Apr-25 Responsible Contact Person Tammy Smith

Finding Number 2024-075 Subject Heading (Financial) or AL no. and program name (Federal) ALN: 21.027 Federal Program name: Coronavirus State And Local Fiscal Recovery Funds (CSLFRF) Planned Corrective Action Office of Management and Enterprise Services – Grants Management Office Response: OMES-GMO respectfully disagrees with several conclusions contained in this finding. The finding concludes that the transfer of CSLFRF funds to the twenty-two (22) state agencies does not create a subrecipient relationship because OMES and the agencies are part of the same State of Oklahoma Single Audit. OMESGMO respectfully disagrees with this conclusion. Pursuant to 62 O.S. § 255.1, “The Legislature authorizes the Office of Management and Enterprise Services to manage federal APRA funds by requiring all receiving entities known as subrecipients to sign a grant agreement. Any entity, without exception, including state agencies receiving an appropriation from the Statewide Recovery Fund or a similar fund with federal requirement attached to its use shall have a fully executed grant agreement in place within sixty (60) days after enactment of any legislation that appropriates funding from the Statewide Recovery Fund of the State Treasury created in Section 1, Chapter 319, O.S.L. 2022, and be in compliance with such agreement before a disbursement can be made.” Under this statutory framework, each agency enters into a Grant Agreement with OMES and is subject to grant-specific terms and conditions, reporting requirements, monitoring, and ongoing oversight. Accordingly, OMES has administered the CSLFRF grant in accordance with state law and consistent with its responsibilities as the State's designated pass-through entity since the inception of the program. The authorization from the Oklahoma State Legislature has provided for a much more extensive oversight of the state entity subrecipients than would exist if OMES followed the model suggested by SAI, as OMES would not be subject to the subrecipient monitoring Federal regulation under 2 CFR § 200.332, for these state entities. By following the state law passed by the Legislature, OMES monitors each state entity subrecipient, and in turn, has signed a grant agreement with these state entity subrecipients that requires them to do the same for any of their subrecipients that are administering projects set out specifically by the State Legislature through appropriation bills. OMES requests SAI to revisit the position that these state entities are not OMES’ subrecipients and consider the implications that if OMES were to treat the state entities as non-subrecipients, OMES would be in direct defiance of state law. OMES-GMO also disagrees with the conclusion that sufficient supporting documentation was unavailable for several of the transactions identified in this finding. OMESGMO is committed to strong documentation standards, reimbursement review procedures, and project oversight to ensure continued compliance with applicable federal and state requirements. Despite OMES-GMO’s request to be included in audit communication with the state entities, SAI’s documentation requests for the sampled expenditures were directed primarily to the individual agencies. Several agencies experienced staffing changes during the audit period, resulting in inconsistencies in responding to documentation requests and, in some instances, uncertainty regarding the specific information being requested by the auditors. In multiple cases, the supporting documentation ultimately existed and was available but was either maintained by OMES-GMO or inadvertently omitted from the agency's initial submission. If OMES-GMO was afforded the opportunity to submit or explain documentation maintained by its office before the finding was finalized, both the administering agency and OMES-GMO would have been able to provide a more complete record for evaluation and may have altered the conclusions reached for certain transactions. OMES-GMO has had recent conversations with SAI regarding this issue, and are encouraged by the willingness of SAI to be open to working with OMES-GMO to facilitate a different process for future audits that involves a coordinated with both the administering agency and OMES-GMO so that auditors have access to the complete record before audit conclusions are finalized. Agency Responses: Agency 025 – Oklahoma Military Department (OMD) OMD partially concurs with the finding regarding the level of supporting documentation submitted with the vendor's invoices for payment. However, the construction contracts in question were executed using Guaranteed Maximum Price (GMP) contract structures. Under these contracts, the contractor is responsible for maintaining all subcontractor invoices, material invoices, and supporting financial records associated with each progress payment. The contracts require these records to be retained for the applicable record retention period and made available for review by the agency, State, or federal government upon request. Agency 085 – Oklahoma Broadband Office (OBO) Broadband Mapping / Cross-Grant Expenditures The Oklahoma Broadband Office (OBO) requests the transactional detail associated with these findings to allow the agency to fully evaluate the questioned transactions. While OBO agrees that expenditures must be charged to the appropriate federal funding source and class fund, the office respectfully disagrees that the questioned expenditures represented unallowable supplementation of other federal awards. The contracts included shared deliverables necessary to complete the CSLFRF Broadband Mapping project. During contract administration, OBO identified billing discrepancies involving work performed under multiple grant programs. Following approximately eleven months of negotiations, OBO entered into a settlement agreement with the contractor that limited payment to services actually received and excluded services that were not performed. The resulting payments represented services provided under multiple funding sources and were processed together to accurately reflect work completed during FY2024. Procurement Finding – Lee Consulting Contract OBO concurs with the finding that services began prior to the execution of a purchase order for the April 2023 services. Upon identifying the issue, OBO completed the required ABS Form 009 Ratification Agreement to formally document the procurement exception and properly authorize payment. To prevent future occurrences, OBO has: • Hired a full-time General Counsel to oversee contract administration and procurement compliance. • Implemented a policy prohibiting execution of contracts or commencement of work until a purchase order has been fully approved and funds have been encumbered. • Provided procurement training to management and staff regarding Oklahoma encumbrance requirements. Agency 400 – Office of Juvenile Affairs (OJA) OJA partially concurs with the finding. The agency believes the purchase of a Keurig coffee maker and heater towers by Western Plains falls within the approved project scope for the purchase and installation of furniture, fixtures, and equipment. However, OJA acknowledges that decorative wall art purchased by Youth and Family Services of Hughes and Seminole Counties does not appear to fall within the approved project scope. Agency 452 – Oklahoma Department of Mental Health and Substance Abuse Services (ODMHSAS) ODMHSAS acknowledges the documentation and procurement concerns identified in the finding. Specifically, the agency recognizes that certain invoices lacked sufficient detail describing services performed and that one expenditure required ratification because services were obligated prior to encumbering funds. ODMHSAS agrees that federally funded expenditures should be supported by documentation demonstrating the services performed, the project purpose, and the relationship to the approved scope of work. ODMHSAS also agrees that obligations should not be incurred before a valid purchase order and encumbrance have been established. Agency 619 – Oklahoma Health Care Workers Training Commission (HWTC) During the period associated with the questioned expenditure, the Care Providers program submitted a significant volume of supporting documentation with each reimbursement request, often consisting of 500 to 1,000 pages transmitted through multiple emails over several days. In some instances, the documentation was not organized sequentially, making it difficult to efficiently compile and review the complete reimbursement package. As staff assembled documentation received through multiple transmissions, a portion of the supporting documentation was inadvertently omitted from the reimbursement file maintained by the agency. Consequently, the complete documentation package was not included in the materials submitted to OMES-GMO with the reimbursement request. To address this issue, management revised its documentation review procedures. Rather than requiring agency staff to reorganize incomplete or disorganized submissions, staff are now instructed to return reimbursement packages that are incomplete or not properly organized and require the submitting entity to provide a revised, complete documentation package. This change places responsibility for maintaining complete supporting documentation with the originating entity and has resulted in more organized reimbursement submissions while reducing the risk of incomplete supporting records. Agency 830 – Oklahoma Department of Human Services (DHS) DHS disagrees that the questioned incentive gift cards were outside the approved project scope. The PCCT Fatherhood Today program is designed to strengthen father-parent-child relationships by engaging fathers through education, support services, and community resources. The program targets fathers residing in underserved communities who often face barriers to participation, including transportation, childcare, financial hardship, and food insecurity. The $100 gift cards are provided only after participants successfully complete the twelve-week 24/7 Dad curriculum. The gift cards serve as an incentive to recruit and retain participants and support the program's objective of increasing father engagement. DHS believes the incentives directly support successful program participation and allow participants to obtain essential household items for their families. DHS further noted that participant outcomes are measured through pre- and post-program assessments demonstrating increased knowledge and engagement among participating fathers. Gift cards are purchased using agency purchasing procedures, maintained in secured storage, and distributed only upon successful completion of all program requirements with appropriate documentation maintained for each recipient Anticipated Completion Date OMES: December 31, 2026 025: Completed 085: Completed 400: Completed 452: December 31, 2026 619: December 31, 2026 830: Completed Responsible Contact Person OMES: Elizabeth Base 025: Angela Tackett 085: Beverlee Harbuck 400: Kevin Haddock 452: Chad Carden 619: Kami Fullingim 830: Lindsey Kanaly