Findings Citing § 200.303

(2025-065) Title: Internal control over Medicaid procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a noncompetitively bid contract. Condition: The Medicaid program is administered by the Office of MaineCare Services (OMS). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 calendar days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. The Office of the State Auditor (OSA) tested 26 contracts, 6 procured competitively and 20 procured noncompetitively, that accounted for $42.8 million of the $91.3 million in Medicaid procurement-related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OMS were accurate. • For 18 contracts, DCM provided the PJF to OSPS for their review after the contract had commenced, between 5 and 152 days after the contract start date. For 18 contracts, OSPS approved the PJF after the contract commenced, between 7 and 182 days after the contract start date. For 2 contracts, documentary evidence of PJF approval by OSPS could not be provided. • For 9 noncompetitive contracts, OSPS posted the NOI after contract performance had commenced, between 7 and 169 days after the contract start date. For 7 of these contracts, services had been initiated and financial obligations incurred prior to the NOI. OSA utilized a risk-based approach to select 6 contracts issued by OMS and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $91.3 million in procurement-related transactions from Medicaid funds of $3.4 billion. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OMS develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by OMS for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-32 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1106-06)

(2025-062) Title: Internal control over Medicaid drug rebates needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; Section 1927 of the Social Security Act (42 USC 1396r-8) The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Section 1927 of the Social Security Act requires manufacturers that wish to have their outpatient drugs covered by Medicaid to enter into an agreement with the Centers for Medicare & Medicaid Services (CMS), under which the manufacturers agree to pay rebates for drugs dispensed and paid for by the State Medicaid agencies under the State plan. Drug rebates are shared between the State and Federal government. Condition: Drug manufacturers are required to submit a list of all covered outpatient drugs, along with each drug’s average manufacturer price and “best price” to CMS. Utilizing this information, CMS calculates a unit rebate amount (URA) for each covered outpatient drug and provides the amounts to the State on a quarterly basis. The Department is required to maintain drug utilization data that identifies, by National Drug Code (NDC), the number of units of each covered outpatient drug for which the Department has paid pharmacy providers. The utilization data is provided to CMS and the manufacturers. The number of dispensed units is applied to the URA to determine the rebate amount due from each manufacturer. The State contracts with a vendor to calculate the drug rebate amounts and invoice manufacturers for drug rebates. The Office of the State Auditor (OSA) identified that the Department does not have adequate procedures in place to ensure the accuracy and completeness of the drug rebate amounts invoiced by the vendor. Audit procedures identified that: • prior to issuing invoices, the Department reviews a sample of 10 invoices to ensure the drugs are rebatable and accurately calculated; however, the invoices are judgmentally selected and not based on risk. • though the Department reviews invoiced drug rebates for reasonableness, this review is performed at a summary level and after the invoicing cycle. Context: In fiscal year 2025, the State invoiced approximately $300 million for rebatable drugs. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Inaccurate or incomplete invoicing of drug rebates would result in overpayments or underpayments to the State and Federal government. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement procedures to confirm the drug rebate amounts calculated and invoiced by the vendor are accurate and complete. These procedures should occur prior to issuing invoices and provide adequate coverage of the drug rebates invoiced, including: • validating that only rebatable drugs are invoiced; • verifying that all rebatable drugs are included for invoicing; • comparing drug utilization data to the number of dispensed units invoiced; and • corroborating the correct URA is applied to each NDC. This will ensure that correct drug rebate amounts are returned to the State and Federal government. Corrective Action Plan: See F-30 Management’s Response: The Department disagrees with this finding. Drug Rebate pre-invoicing and post-invoicing is completed quarterly. As demonstrated during walkthroughs and during our meetings Maine completes specific tasks to ensure accuracy of the invoicing process. The pre-invoicing and post-invoicing procedures are documented in the Pharmacy Rebate Information Management System (PRIMS) Desk Level Procedure (DLP). The pre-invoicing work is performed by the State that compares drug utilization data to the number of dispensed units invoiced. Upon the completion of the pre-invoicing review approval is provided to the vendor allowing them to continue with the invoicing process. There is no requirement on how we select our sample of invoices to review. Based on OSA noting no exceptions to the drug rebate amounts, our system in place to review invoiced drug rebates is functioning as intended. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 Auditor’s Concluding Remarks: The procedures mentioned in Management’s Response only address whether the drug rebate information presented by the vendor for invoicing by the Department is reasonable. The Department’s procedures do not independently substantiate that all rebatable drugs are included for invoicing. Furthermore, the existing invoice review procedures address only a limited number of invoices and dispensed units, are performed at a summary level and do not consider risk factors. As a result, the Department does not have adequate assurance that all rebatable drugs are invoiced accurately and completely. The finding remains as stated. (State Number: 25-1106-05)

(2025-063) Title: Internal control over Medicaid SEFA reporting needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must include the total amount provided to subrecipients from each Federal program. Condition: The Department of Health and Human Services’ Service Center must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State’s SEFA. OSC is responsible for compiling this information on behalf of the State. The Office of the State Auditor reviewed amounts reported on the SEFA and identified $11.8 million of Federal expenditures incorrectly reported as amounts provided to subrecipients that should have been reported as direct expenditures. OSC subsequently corrected the SEFA. Context: In fiscal year 2025, Federal Medicaid expenditures totaled $3.4 billion. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department implement policies and procedures to ensure expenditures are appropriately classified and reported on the SEFA. Corrective Action Plan: See F-31 Management’s Response: The DHHS and the DHHS Financial Service Center agree with this finding. The DHHS Financial Service Center will update policies and procedures to ensure expenditures are appropriately classified and reported on the SEFA by February 2026. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 25-1106-03)

(2025-064) Title: Internal control over Medicaid utilization control needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 456.3 and .23 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Utilization control requirements are applicable to all services provided under a State plan. The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that provides for the oversight and monitoring of all services provided under the State plan, including procedures for ongoing post-payment review of all Medicaid services. The post-payment review must identify exceptions so that the SMA can correct misutilization practices of beneficiaries and providers on a timely basis. Condition: The Department’s Office of MaineCare Services’ Program Integrity Unit (PIU) is responsible for implementing and monitoring the State’s Medicaid utilization control (UC) program. A Medicaid UC program is a State-mandated, Federally-required system that monitors and manages the appropriateness, quality, and necessity of all medical services, and includes a sampling plan and post-payment review process designed to provide an ongoing evaluation of Medicaid beneficiaries and providers. PIU’s UC program includes a monthly sampling plan that relies on various data analytics. The results of the data analytics are reviewed to determine the extent of beneficiary or provider post-payment reviews. The Office of the State Auditor (OSA) reviewed PIU’s policies and procedures, the monthly sampling plan, and a selection of post-payment review files, and performed data analytics to determine the appropriateness of the design and implementation of the UC program. PIU could not provide documentation of the methodology used to identify projects and post-payment reviews performed in relation to surveillance of all Medicaid services provided under the State plan. Additionally, a sampling plan relying on data analytics as a source of post-payment review limits the scope of the UC program to only what can be identified through data anomalies. PIU’s sampling plan does not document consideration of misutilization practices of beneficiaries or providers. As a result, OSA could not determine the completeness of the UC program. Context: In fiscal year 2025, the State paid $3.2 billion to approximately 10,600 providers, including $2.5 billion in Federal funds. Cause: Lack of adequate policies and procedures Effect: PIU’s UC program may not provide adequate monitoring of all Medicaid services, resulting in potential noncompliance with Federal regulations. Recommendation: We recommend that the Department document policies and procedures to ensure that PIU’s UC program is designed to provide ongoing monitoring and evaluation of all Medicaid services provided under the State plan, and that documentation to support the extent of such monitoring is properly maintained. Corrective Action Plan: See F-31 Management’s Response: The Department disagrees with this finding. This finding represents a misunderstanding of the applicable federal regulations and the state entity responsible for compliance. A Utilization Control (UC) program is the responsibility of the State Medicaid Agency as a whole, not the Program Integrity Unit (PIU). Additionally, there are many more federal regulations governing UC programs than cited by the Office of State Auditor (OSA) in the finding and touch on a host of controls that were not reviewed or considered in this audit. Moreover, the OSA appears to be basing findings on interpretations that are unsupported by the regulatory text cited. Second, the OSA confuses PIU's annual review plan (a yearly plan of focused program integrity areas of focus and review) with an agency-wide UC program: these are not the same, nor are they required to be. The Department's current processes for PIU's annual review plan were implemented in response to OSA findings in 2015 relating to an OSA finding that the Department was not fully utilizing available data analytics. In the intervening years, the OSA has not found Program Integrity's annual review plan, or the process of developing the plan, to be deficient. There has been no change in the Department's process or the regulation to justify the OSA's newly found position here. The OSA's criticism of PIU's use of data analytics contradicts a prior OSA findings on data analytics use, is contrary to accepted Department adjustments made in response, and represents a significant departure from federal guidance and industry standards around best practices for leveraging data analytics to prevent and detect improper payments and/or utilization. The PIU's annual review plan supplements post-payment reviews that PIU conducts based upon complaints and referrals. Finally, this finding’s singular focus on PIU's annual review plan fails to account for a myriad of other systems and processes the Department has in place to monitor utilization, including, but not limited to: 1. A contracted vendor (HMS) performing post-payment reviews of hospitals, nursing facilities, and other long-term care facilities; 2. MaineCare's Case Mix unit - performing look back reviews of documentation and services in nursing facilities and other long-term care units; 3. A contracted vendor (Acentra) reviewing authorization requests for behavioral health services and continuing stay reviews of services at designated intervals; 4. A contracted vendor (Maximus) that performs assessments and authorizations for nursing and personal care services; 5. A contracted vendor (Optum) that performs prior authorization reviews for pharmacy services and produces a variety of reports on drug utilization; 6. Fiscal intermediaries performing oversight and administrative support for self-directed services; 7. State staff who review and approve plans of care for Home and Community Based Waiver Services and conduct quality reviews of providers; 8. State staff performing quality assurance reviews of providers of mental and behavioral health services; 9. State staff monitoring and addressing inappropriate emergency department usage by beneficiaries; and 10. State staff with oversight and performing qualitative and quantitative reviews of a variety of programs operated under delivery service reform, including: Accountable Communities, Behavioral Health Homes, Certified Community Behavioral Health Clinics, Community Care Teams, MaineMOM, Opioid Health Homes, and Primary Care Plus. 11. State and contracted vendor (Gainwell) staff reviewing medical necessity and other allowability for medical services requiring prior authorization for initial requests and renewals. 12. A CMS-compliant Electronic Visit Verification (EVV) system, in accordance with Section 12006 of the 21st Century Cures Act, that ensures payment for applicable services is tied to an EVV record demonstrating that the service occurred; data from the system also contributes to post-payment reviews for applicable services. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 Auditor’s Concluding Remarks: PIU’s Policy and Procedure Handbook identifies PIU as the office responsible for ensuring the Medicaid program is in compliance with 42 CFR 456.3 and .23; these Federal requirements reference procedures that directly correlate to the data analysis and post-payment review processes performed by PIU. In response to the Department’s criticism of OSA’s approach, OSA develops an audit plan annually, independent of prior year audit procedures or results, in response to risks affecting each audit. In fiscal year 2025, OSA’s procedures performed over UC requirements were tailored in response to identified risks and should not be designed to support audit results from prior years; those procedures identified a population of Medicaid providers that PIU could not provide documentation to support monitoring had been performed. These providers and services do not appear to be included in the “other systems and processes” listed in Management’s Response. The finding remains as stated. (State Number: 25-1106-04)

(2025-069) Title: Internal control over DG – PA program special reporting needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) System for Award Management (SAM). Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient of the Disaster Grants – Public Assistance (DG – PA) program, Maine Emergency Management Agency (MEMA) must collect and enter data into SAM. The Office of the State Auditor (OSA) tested 60 DG – PA program subawards totaling $16,759,534 that exceeded the first-tier subaward threshold. Federal regulations require the following information for identified noncompliance to be included in FFATA findings: • 11 subawards totaling $4,106,246 were not reported; • 60 subawards totaling $16,759,534 were not reported timely; • 10 subaward amounts were reported incorrectly; and • 49 subawards reported incorrect key data elements. OSA selected a non-statistical random sample. Context: In fiscal year 2025, MEMA was required to report 574 first-tier subawards totaling $135.6 million under the DG – PA program. First-tier subawards account for 84 percent of the program’s fiscal year 2025 expenditures. Cause: Lack of resources Effect: • Noncompliance with Federal regulations • Accurate first-tier subaward information for the DG – PA program was not reported to the Federal government timely and included inaccurate or incomplete information. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department allocate resources to ensure that first-tier subawards are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. Corrective action was implemented beginning in November of 2025. Untimely or missing reports were primarily due to staff turnover in the agency, which has been remedied by successful recruitment efforts. Incorrect data elements were attributed to an ineffective element of the prior reporting process, which increased the reporting burden by tasking staff with creating ad-hoc unique identifiers rather than using existing unique identifiers. In the monthly reporting process since November 2025, federally assigned project numbers are used to distinctly identify each subaward, and reporting personnel retrieve obligation reports directly from the relevant federal system, minimizing the overall staff burden in reporting. Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-03)

(2025-070) Title: Internal control over DG – PA program financial reporting needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with reporting requirements. Condition: The Maine Emergency Management Agency (MEMA) administers the Disaster Grants – Public Assistance (DG – PA) program for the State. MEMA is required to submit quarterly DG – PA program Federal Financial Reports (FFRs) to the Federal Emergency Management Agency (FEMA) Regional Office. FFRs provide FEMA with the status of funds for the award, Federal expenditures, and cost-sharing requirements. The Office of the State Auditor (OSA) tested 7 FFRs due in fiscal year 2025 and found deficiencies in 6, as follows: • 1 FFR inaccurately reported total Federal funds authorized as $442,026,321 when the correct total was $442,015,638, and the recipient share of expenditures as $19,499,834 when the correct share was $7,338,371; • 1 FFR inaccurately reported total Federal funds authorized as $16,582,190 when the correct total was $16,560,302, and the recipient share of expenditures as $13,249,493 when the correct share was $5,367,072; • 1 FFR inaccurately reported total Federal funds authorized as $17,805,320 when the correct total was $17,142,335; • 1 FFR inaccurately reported the recipient share of expenditures as $13,077,332 when the correct share was $13,081,295; • 1 FFR inaccurately reported the recipient share of expenditures as $4,698,599 when the correct share was $3,893,046; and • 1 FFR inaccurately reported the recipient share of expenditures as $778,776 when the correct share was $199,157. OSA selected a non-statistical random sample. Context: During fiscal year 2025, 45 FFRs were required to be filed by MEMA for the DG – PA program. Cause: • Lack of adequate policies and procedures to ensure data used for financial reporting is complete and accurate • Lack of supervisory oversight Effect: • Noncompliance with Federal reporting requirements • Inaccurate tracking of subawards may result in noncompliance with Federal matching requirements. Recommendation: We recommend that MEMA enhance policies and procedures to ensure that FFRs are accurate and include all required information for compliance with Federal reporting requirements. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. The Department will publish and implement a revised Federal Financial Reporting procedure to fully preserve reporting/validation source material and clearly document the justification for any variances from the source material. Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-04)

(2025-071) Title: Internal control over DG – PA program subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 2 CFR 200.521 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow up and ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. The Department must issue a management decision for audit findings that relate to Federal awards provided to the subrecipient within 6 months of acceptance of the audit report by the Federal Audit Clearinghouse (FAC). Condition: The Maine Emergency Management Agency (MEMA) administers the Disaster Grants – Public Assistance (DG – PA) program for the State. MEMA is required to verify and document that Single Audits have been completed in the FAC and issue a management decision for audit findings related to awards to subrecipients. The Office of the State Auditor (OSA) tested 4 DG – PA program subrecipients subject to Single Audit requirements and found that documentation of review for 2 subrecipients could not be provided. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department expended $160.5 million in DG – PA program funds, of which $154.6 million was provided to 27 subrecipients. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients not complying with Federal statutes, regulations, or the terms and conditions of subawards may not be implementing appropriate corrective action in response to audit findings. Recommendation: We recommend that the Department enhance policies and procedures to ensure that adequate documentation is maintained and that subrecipient audits are received, reviewed, and appropriate action is taken in response to audit findings. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. The Department will publish and implement an updated subrecipient monitoring procedure to require more extensive and narrative documentation of the single audit review process, including: - a list of subrecipients required to file a single audit report for a given audit year - whether or not an audit had been filed as of the review date - analysis of audit findings as relevant - summary of required actions per the subrecipient monitoring procedure, and/or updates on actions/communications since the prior review period as relevant Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-05)

Finding Reference 2025-006 Federal Agency: U.S. Department of Health and Human Services Federal Program Title and ALN: Child Care and Development Block Grant (CCDF Cluster) (ALN 93.575) Compliance Requirement: Reporting – Financial Reporting (L) (MW) Type of finding: Material Weakness in Internal Control (MW), Instance of Noncompliance (NC) Statement of Condition During our audit procedures, we noted that the Program did not maintain an adequate set of accounting records that present the financial position and results of its operations of the program. In addition, required financial reports were not submitted within the established reporting deadlines. CriteriaTitle 2 U.S. Code of Federal Regulations (CFR) 200.328 and 200.329 require subrecipients to submit accurate, complete, and timely performance and financial reports in accordance with the terms and conditions of the Federal award. Additionally, 2 CFR 200.303 requires non-Federal entities to establish and maintain effective internal control over Federal programs to provide reasonable assurance that Federal awards are managed in compliance with Federal statutes, regulations, and the terms and conditions of the award. Additionally, the subaward agreement and reporting guidelines issued by the pass-through entity (ACUDEN) also establish specific reporting deadlines and require that reported financial information be supported by the subrecipient’s accounting records. Cause of Condition The program staff faced performance challenges due to a lack of staff which caused the accounting records to be delayed. Effect of Condition As a result of the inadequate maintenance of accounting records and untimely preparation of financial reports, the Municipality failed to submit the required report within the 30 calendar days required by the regulation, which leads to the noncompliance of the reporting requirement. Recommendation We recommend that management strengthen internal controls over financial reporting by: • Ensuring accounting records are maintained current and reconciled on a monthly basis; • Establishing formal written reporting procedures with clear timelines; • Assigning personnel responsible for report preparation and review; and • Implementing supervisory review procedures to verify that reports agree with underlying accounting records prior to submission. Questioned Costs None Prior-Year Finding This is a new finding. View of Responsible Official and Planned Corrective Action Plan The Municipality agrees with the finding and stated that it will implement corrective actions to improve compliance with reporting requirements. Management plans to formalize reporting procedures, assign responsible personnel, and require reconciliations between reported amounts and accounting records prior to submission of reports to ACUDEN, along with enhanced supervisory review. Implementation Date: July 1, 2026 Responsible Person: Mr. Luis A. Velez Rivera, Finance Director

FEDERAL PROGRAM (ALN 93.356) HEAD START DISASTER RECOVERY FROM HURRICANES HARVEY, IRMA, AND MARIA U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES AWARD NUMBER 02td000223 (Federal Award Year June 1, 2021 – December 31, 2025) COMPLIANCE REQUIREMENT REPORTING TYPE OF FINDING NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY CRITERIA 2 CFR Section 200.302 (a) establishes that each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State's funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. See § 200.450. In addition, the SF-425 Federal Financial Report requires the reporting of financial activities related to Federal awards. The accounting basis used for reporting expenditures (whether cash or accrual) must align with the accounting system employed by the recipient organization. In addition, 2 CFR §200.303 (a) establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). STATEMENT OF CONDITION As part of our audit procedures for evaluating internal controls and compliance with reporting requirements, we selected three (3) reports that were submitted during our fiscal year audit. During our review of the data related to Grant Award 02TD000223, we noted the following deficiency: the total Federal expenditure reported on line (e) of the report does not match the data provided by the client in the database, with a difference of $250,000. QUESTIONED COSTS None PERSPECTIVE INFORMATION This deficiency represents a systemic issue attributable to inadequate review procedures, which has resulted in the inaccurate reporting of Federal expenditures. STATEMENT OF CAUSE The discrepancy may be due to an error in the data collection process or a failure to properly transfer data between the database and the Federal expenditure report, or a lack of proper reconciliation between the two. POSSIBLE ASSERTED EFFECT This discrepancy could affect the accuracy of the financial reports, compromising transparency and the Municipality's compliance with Federal reporting requirements. It could also lead to misunderstandings regarding the proper use of the Federal funds awarded. IDENTIFICATION OF REPEAT FINDING This is not a repeat finding. RECOMMENDATIONS We recommend that the Municipality reviews their processes for reporting and recording Federal expenditure to ensure that the data reported on the system matches the database used during the audit. Additionally, we suggest implementing a regular reconciliation process between the reporting system and the database to prevent future errors and ensure compliance with Federal reporting requirements.

Equipment Property Management Federal Program: Congressional Directives (ALN 93.493) Federal Agency: Department of Health and Human Services Federal Award Number: 1CE1HS52890-01-00 Federal Award Year: September 30, 2023 through June 30, 2026 Criteria or Requirement Per 2 CFR section 200.313, property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the federal award identification number), who holds title, the acquisition date, cost of the property, percentage of federal participation in the project costs for the federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sales price of the property. Per 2 CFR 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition and Context For 2 out of 9 purchase transactions, equipment exceeding the capitalization threshold per 2 CFR section 200.1 was not capitalized. Therefore, a property record did not exist for federally funded equipment purchased in the amount of $937,768. The total program expenditures were $2,112,657 for which $1,640,656 were capital equipment purchases and $472,001 were non-capital purchases. Further, $67,919 of the $702,888 that was capitalized, the property record did not properly identify the asset’s federal award program. Cause and Potential Effect The University's internal controls for determining and documenting whether an equipment acquisition was a capital asset for which a property record should be created in the system with the required information was not operating effectively. Accordingly, the University acquired federally funded equipment, and a property record was not created. Questioned Cost There were no questioned costs associated with the finding. Statistically Valid Sample The sample was not intended to be, and was not, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit Yes – prior year finding 2024-003. Recommendation We recommend the University enhances the precision of the controls over equipment purchases to ensure that a property record is created within the system containing the required information, inclusive of the federal award, for all federally funded equipment. View of Responsible Officials Management of the University takes no exception to this reported finding. We have implemented the remedial actions as outlined in our Corrective Action Plan.

Finding: 2025-002: Significant Deficiency in Internal Control Over Compliance and Non-Material Noncompliance Federal Awarding Agency: Department of Housing and Urban Development (HUD) State Awarding Agency: Not applicable (Direct Award) Program Name: Housing Voucher Cluster ALN: 14.871 and 14.879 Compliance Requirement: Special Test-Housing Quality Standards (HQS) Inspection and Enforcement Prior Year Finding Number: 2024-003 Criteria: Per 24 CFR 982.404 “The public housing authority (“PHA”) must not make any housing assistance payments (HAP) for a dwelling unit that fails to meet the HQS, unless the owner corrects the defect within the period specified by the PHA and the PHA verifies the correction. If a defect is life threatening, the owner must correct the defect within no more than 24 hours. For other defects, the owner must correct the defect within no more than 30 calendar days (or any PHA-approved extension).” Per 2 CFR Section 200.303, non-Federal entities receiving federal awards must establish and maintain internal control designed to reasonably ensure compliance with federal statutes, regulations, and terms and conditions of the federal award. Per 24 CFR 982.405, “The PHA must inspect the unit leased to a family prior to the initial term of the lease, at least biennially during assisted occupancy, and at other times as needed, to determine if the unit meets the Housing Quality Standards (HQS).” Condition: During our testing of sixty (60) inspections, we noted three (3) instances where a unit was notinspected on the required biennial basis. Additionally, we noted that the County failed to maintain appropriate logs or records of failed HQS inspectionsduring the year. However, during our testing of the six (6) units that failed HQS, the County appropriatelydocumented the enforcement of the HQS, properly notified the unit owners of the reported deficiencies, andperformed timely follow-up inspections. Cause: The County does not appear to have adequate policies and procedures in place to ensure inspections are performed on a timely basis. The County converted to a new HQS tracking system during current fiscal year which caused challenges with maintaining appropriate logs or records of failed HQS inspections. Effect: The County’s control environment over HQS enforcements did not ensure inspections were timely performed. As a result, the County was not in compliance with the HQS enforcement requirements as of June 30, 2025. Non-compliance with these requirements creates a risk that the County may provide federal funds to tenants of ineligible units. Recommendation: The recommendation is for the County to review their client management software system’s functionality to determine whether an electronic process for scheduling and follow-up or comprehensive reporting can be identified to improve efficiency and eliminate the potential for human error. If an electronic process or comprehensive reporting is not available, or cannot fully cover the deficiency, the recommendation is for the County to identify measures that streamline their current process and to eliminate non-compliance. Potential examples include having the Housing Choice Voucher (HCV) Program Manager review and schedule upcoming inspections in advance, checking in with the Inspector on a monthly basis to review inspections that are due and inspections that are scheduled, and having the HCV Program Manager ensure that each scheduled inspection is documented timely in the system. Questioned costs: None. Context: This is a condition based on testing of the County’s compliance with specified requirements. The prevalence of the finding is detailed in the condition section above. The samples were selected using a non-statistical method. Views of Responsible Officials: The County concurs with the auditor’s finding and recommendation.

Condition: For FAL 10.185, all 40 vendor disbursements tested lacked evidence of supervisory approval, as the payment request forms were not signed by the designated approver prior to payment. For FAL 10.558, 27 of thirty-two vendor disbursements tested lacked documented supervisory approval prior to payment. Finally for FAL 84.010A, two of the ten vendor disbursements tested lacked documented supervisory approval prior to payment. In each noted instance, payments were processed without evidence that the School performed and documented a review in accordance with established internal control procedures. Criteria: According to 2 CFR §200.303, Internal Controls, non-Federal entities must establish and maintain effective internal control over federal awards that provides reasonable assurance the entity is managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. Further, under 2 CFR §§200.403, Factors Affecting Allowability of Costs, and 200.405, Allocable Costs, costs charged to federal awards must be necessary, reasonable, allocable, and conform to any limitations or exclusions set forth in federal regulations or award terms. Cause: The School did not consistently enforce established approval procedures, and monitoring controls were not operating effectively to ensure payment request forms were reviewed and signed prior to disbursement. Effect: Failure to document supervisory approval increases the risk that unallowable, inaccurate, or unsupported expenditures could be processed and charged to federal programs without detection. Recommendation: We recommend that the School enforce existing policies requiring documented supervisory approval prior to processing payments and implement monitoring procedures to ensure approval documentation is completed and retained. In addition, the School should strengthen pre-payment review procedures to ensure expenditures are evaluated for allowability, necessity, reasonableness, and proper allocation in accordance with 2 CFR Part 200 and applicable program requirements. Training should be provided to personnel responsible for processing and approving federal program expenditures to reinforce compliance responsibilities. Management’s Response: The School’s responsible officials’ views and planned corrective action are in its corrective action plan at the end of the report.

Condition: Expenditures for the Child and Adult Care Food Program were incorrectly reported as expenditures to other nutrition programs. Criteria: According to 2 CFR §200.303, Internal Controls, non-Federal entities must establish and maintain effective internal control over federal awards that provides reasonable assurance the entity is managing the award in compliance with federal statutes, regulations, and the terms and conditions of the award. Further, under 2 CFR §§200.400, Policy Guide, and 200.405, Allocable Costs, costs are to be adequately supported as charged to the Federal award and must be necessary, reasonable, allocable, and conform to any limitations or exclusions set forth in federal regulations or award terms. Cause: The School did not understand the need to properly identify expenditures to the appropriate formula grant nutrition program. Effect: Although expenditures were properly reported collectively over all the nutrition programs, expenditures for specific nutrition programs were incorrectly reported for various separately funded nutrition programs. Recommendation: We recommend that the School properly identify and report nutrition program expenditures by program. Management’s Response: The School’s responsible officials’ views and planned corrective action are in its corrective action plan at the end of the report.

2025-003: U.S. Department of the Interior Direct and Pass-through Tahoe Resource Conservation District Southern Nevada Public Land Management, 15.235 Allowable Costs/Cost Principles Significant Deficiency in Internal Control over Compliance Grant Award Number: Affects all grant awards included under assistance listing 15.235 on the Schedule of Expenditures of Federal Awards. Criteria: Title 2 of U.S. Code of Federal Regulation (CFR) Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) provides that a non-federal entity may charge only allowable costs that are adequately documented and are necessary and reasonable for performance of the federal award under the principles of 2 CFR Part 200, Subpart E. Uniform Guidance section 200.303 provides that non-federal entities must establish and maintain effective internal control that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Expenditures for equipment usage were charged to the grant using an incorrect billing rate and billing rates for burn mix were not originally documented and supported. Cause: North Lake Tahoe Fire Protection District (the District) did not have adequate internal controls to ensure accurate billing rates for equipment charges were used and to ensure that internally generated fees, such as burn mix, were documented to support the amount billed to the grant. Effect: Unallowable costs were charged to the program. Questioned Costs: None reported as known and projected questioned costs were less than $25,000. Context/Sampling: A nonstatistical sample of 60 ($15,434) out of a population of 708 ($112,987) equipment usage expenditures was selected for testing. Two transactions were for burn mix, which was billed at an internally generated rate. The documentation for developing the rate was not originally maintained. However, it was generated during the audit to assist in determining the reasonableness of what was charged. In addition, 11 transactions were for a Chipper Trailer, which were charged to the program at $72.38 per hour of usage rather than the published rate of $72.28 per hour. Repeat Finding from Prior Year: No Recommendation: We recommend the District enhance internal controls to ensure accurate billing rates for equipment charges are used and that charges for internally generated fees, such as burn mix, are documented prior to charging the fees to the program. Views of Responsible Officials: North Lake Tahoe Fire Protection District agrees with this finding.

Finding 2025-002: NSLDS Reporting Federal Agency U.S. Department of Education Federal Program Student Financial Assistance Cluster (ALN # 84.268, 84.063) Federal Award Year July 1, 2024 through June 30, 2025 Federal Award Numbers P063P241963; P268K251963; P268K256998; P268K256953; P268K258670; P268K256952 Criteria or Requirement Per Sections 34 CFR 690.83(b)(2) and 34 CFR 685.309, a school shall update the student status confirmation report for changes in student status, report the date the enrollment status was effective and return the student status confirmation report to the Secretary within 30 days unless it plans to submit an enrollment report within the next 60 days of receipt. Per Sections 4.4.2 through 4.4.4 of the NSLDS enrollment reporting guide, institutions are responsible for accurately reporting all Campus-Level Record data elements and considers certain data elements to be high risk including OPEID Number, Enrollment Effective Date, Enrollment Status, and Certification Date. Per Section 4.4.8 of the NSLDS enrollment reporting guide, institutions are responsible for accurately reporting all Program-Level Record data elements and considers certain data elements to be high risk including OPEID Number, CIP Code, CIP Year, Credential Level, Published Program Length Measurement, Published Program Length, Program Begin Date, Program Enrollment Status, and Program Enrollment Effective Date. Per 2 CFR 200.303, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition Found For 22 out of the 520 data elements tested across a sample of 40 students, the data element was not reported accurately. The data elements not reported accurately included the student's enrollment status, OPEID number, program-level effective date, and the published program length. There were no exceptions related to the timeliness of NSLDS reporting identified. • For 1 out of 40 students, the student’s status was inaccurately reported as Withdrawn while studying abroad rather than Full-time at both the Campus-Level Record and the Program-Level Record. • For 8 out of 40 students, the incorrect OPEID Number was reported. • For 2 out of 40 students who had a status change from Withdrawn to Full-time, the effective date of the status change was not reported accurately within the Program-Level Record. The effective date was reported as 7/5/2022 rather than 2/10/2025. • For 7 out of 40 students, the effective date for the Graduated status reported to NSLDS at the Program-Level Record did not match the Campus-Level Record by 1-9 days. • For 2 out of 40 students, the effective date for the Half-time status reported to NSLDS at the Program- Level Record did not match the Campus-Level Record by 23-49 days. • For 1 out of 40 students, the Published Program Length was reported at 1.5 years rather than 1.1 years. Possible Cause and Asserted Effect The control that management reviews all reports for the accuracy of all data elements prior to submission was not operating at a level to ensure that enrollment status, enrollment effective date, published program length, and OPEID number were accurately and consistently reported to NSLDS. Questioned Costs None identified. Sampling The sample was not intended to be, and was not, a statistically valid sample. Identification of Whether the Audit Finding is a Repeat of a Finding in the Immediately Prior Audit No. Recommendation We recommend the University enhance the precision of the control around the review of accuracy of the enrollment statuses, program level data records, and campus level data records within the NSLDS reporting submissions. Views of Responsible Officials The University agrees with the finding and recommendation to enhance the precision of the control around the review of accuracy of the enrollment statuses, program level data records, and campus level data records within the NSLDS reporting submissions. To further strengthen oversight and prevent recurrence, the Office of Student Financial Aid will implement documented post-submission reconciliation procedures following National Student Clearinghouse reporting cycles. These reviews will focus on high-risk enrollment reporting elements, including campus changes, program status changes, and other updates affecting NSLDS reporting, and will validate the accuracy of OPEID assignments and program-level effective dates against institutional records.

Finding 2025-001 Cash Management Identification of the federal program: U.S. Department of Health and Human Services National Institutes of Health Research and Development Cluster Assistance Listing No. Federal Program Title 43.014 Congressionally Directed Programs 47.049 Mathematical and Physical Sciences 93.172 Human Genome Research 93.393 Cancer Cause and Prevention Research 93.396 Cancer Biology Research 93.837 Cardiovascular Diseases Research 93.847 Diabetes, Digestive, and Kidney Diseases Extramural Research 93.853 Extramural Research Programs in the Neurosciences and Neurological Disorders 93.865 Child Health and Human Development Extramural Research Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303(a) requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 2 CFR 200.305(b)(3) requires that when the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper. Condition: The College did not provide evidence of effectively designed internal controls to ensure subrecipients are paid by the College within 30 days of requests for reimbursements received by the College. Cause: The College did not ensure that its established internal control processes were operating effectively to verify that invoices from subrecipients were paid within the required 30‑day period from the date the payment request was received. Effect or potential effect: The College did not comply with the cash management requirements of Uniform Guidance to pay subrecipients within 30 days of their requests for reimbursements. Questioned costs: None. Context: EY selected and tested a sample of 44 payments to subrecipients with expenditures totaling $5,843,778 from a population of $56,294,523 during the year ended June 30, 2025. Of the 44 samples selected for testing, 12 payments to subrecipients totaling $3,490,135 were made outside the required 30‑day payment window. Identification as a repeat finding, if applicable: Not a repeat finding. Recommendation: The College should strengthen its disbursement controls by ensuring that invoices received from subrecipients are promptly identified, logged, and tracked against the 30‑day payment requirement. Views of responsible officials: Management agrees with the finding and has developed a plan to ensure subrecipients are paid within 30 days of their requests for reimbursement.

Reference Number: 2025-002 Prior Year Finding: No Federal Agency: U.S. Department Agriculture State Department Name: Department of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 202424N109941 (10/1/2023 – 1/30/2025) 202424L160341 (10/1/2023 – 1/30/2025) 202525N109941 (10/1/2024 – 1/28/2026) 202522L160341 (10/1/2024 – 1/28/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Department of Education (Department) did not report subaward information in accordance with FFATA requirements. Context Five of five subawards selected for testing were not reported per FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause The Department’s policies and procedures were not sufficient to ensure that required subaward information was reported accurately to FSRS no later than the end of the month following the date the subaward was issued. Internal controls did not prevent or detect the errors. Effect Subawards were not reported in accordance with FFATA requirements. Questioned costs None noted. Recommendation We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately no later than the end of the month following the month of issuance of each subaward. Views of Responsible Officials The Department will revise and strengthen our policies and procedures to ensure full compliance with FFATA reporting requirements. Updated procedures will require that all applicable child nutrition subawards of $30,000 or more are reported in SAM.gov no later than the end of the month following the month in which the subaward is made, in accordance with Uniform Grant Guidance.

Reference Number: 2025-003 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Public Health Federal Program: WIC Special Supplemental Nutrition Program for Women, Infants, and Children Assistance Listing Number: 10.557 Award Number and Year: 241DE701W1003 (10/1/2023 – 9/30/2024) 251DE701W1003 (10/1/2024 – 9/30/2025) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Public Health (Division) did not have evidence of timely supervisory review and approval of employee timesheets. Context One of forty timesheets selected for testing was not certified timely by a program supervisor. The timesheet was certified several months after the end of the pay period. Questioned Costs None noted. Cause The Division’s controls are not sufficient to ensure that time and effort reporting is performed and documented in a timely manner, in accordance with federal requirements. Effect There is an increased risk of charging unallowed payroll costs to the program. Recommendation The Division should enhance procedures, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials On March 12, 2026, an email to all WIC supervisors was issued notifying the dates that all T&E reports are due to the Administration Office. The policy was reiterated during the March 17,2026 Supervisors meeting held via Zoom.

Reference Number: 2025-004 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Public Health Federal Program: WIC Special Supplemental Nutrition Program for Women, Infants, and Children Assistance Listing Number: 10.557 Award Number and Year: 241DE701W1003 (10/1/2023 – 9/30/2024) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or Specific Requirement Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Public Health (Division) did not have evidence of supervisory review and approval of a drawdown request. Context One of seventeen drawdown requests selected for testing did not have evidence of review and approval prior to submission. Questioned Costs None noted. Cause The Division’s controls are not sufficient to ensure that drawdown requests are reviewed and approved prior to submission in accordance with federal requirements. Effect There is an increased risk of an undetected error in a drawdown request to occur. The Division could be out of compliance with CMIA requirements. Recommendation The Division should enhance procedures and controls to ensure that drawdown requests are reviewed and approved prior to submission. Views of Responsible Officials The Division confirmed the drawdown transaction was accurate and appropriate. The Division reiterated the Cash Management procedure to all staff and confirmed their understanding. In addition, the Division has in place a review process for new staff regarding procedures with confirmation of completion. There is an established training manual which has been reviewed to ensure it contains the most update to date process. Manuals and procedures will be reviewed regularly and updated, as needed.

Reference Number: 2025-005 Prior Year Finding: 2024-005 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70% of cases must be completed within 60 days of the week ending date of the batch; • 95% of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98% of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) did not conduct weekly BAM investigations nor complete case investigations within the requirements established in the ET Handbook No. 395. Context Nine weekly batches were selected for testing BAM investigations. For seven of nine weeks selected, the Division did not perform the required number of investigations. Eighty-five paid cases were selected for testing case review timeliness. The Division did not meet the required time limits for closing cases within 60, 90, or 120 days. Specifically, we noted the following exceptions: • 1% of cases tested were closed within 60 days which is less than the required 70%. • 13% of cases tested were closed within 90 days which is less than the required 95%. • 86% of cases tested were closed within 120 days which is less than the required 98%. • The remaining 14% of cases tested were closed in greater than 120 days. Fifty-four denied cases were selected for testing case review timeliness. The Division did not meet the required time limits for closing cases within 60, 90, or 120 days. Specifically, we noted the following exceptions: • 6% of cases tested were closed within 60 days which is less than the required 70%. • 11% of cases tested were closed within 90 days which is less than the required 95%. • 83% of cases tested were closed within 120 days which is less than the required 98%. • The remaining 17% of cases tested were closed in greater than 120 days. Thirty-three separation cases were selected for testing case review timeliness. The Division did not meet the required time limits for closing cases within 60, 90, or 120 days. Specifically, we noted the following exceptions: • 0% of cases tested were closed within 60 days which is less than the required 70%. • 15% of cases tested were closed within 90 days which is less than the required 95%. • 85% of cases tested were closed within 120 days which is less than the required 98%. • The remaining 15% of cases tested were closed in greater than 120 days. Twenty-eight nonseparation cases were selected for testing case review timeliness. The Division did not meet the required time limits for closing cases within 60, 90, or 120 days. Specifically, we noted the following exceptions: • 4% of cases tested were closed within 60 days which is less than the required 70%. • 21% of cases tested were closed within 90 days which is less than the required 95%. • 75% of cases 2ested were closed within 120 days which is less than the required 98%. • The remaining 15% of cases tested were closed in greater than 120 days. Questioned Costs Undetermined. Cause The Division experienced staffing shortages and other pressures which impacted its ability to meet BAM requirements for weekly claim investigations and time limits for closing cases. Effect Noncompliance with BAM weekly claim investigations and time limits for closing cases could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation We recommend the Division review and enhance procedures and controls to ensure that it performs weekly claim investigations and that case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395. Views of Responsible Officials The Division of Unemployment Insurance (Division) acknowledges the finding and agrees that improvements are necessary to ensure full compliance with Benefits Accuracy Measurement (BAM) program requirements. The Division recognizes the importance of conducting weekly investigations and adhering to established timeliness standards to maintain the integrity and accuracy of unemployment insurance benefit payments and denied claims. The Division notes that the identified deficiencies were primarily due to significant staffing shortages and competing operational demands, which were further exacerbated by the sustained workload associated with pandemic-related programs. These challenges affected the Division’s capacity to complete the required number of weekly investigations and to meet prescribed case completion timeframes. To address these issues, the Division has taken and will continue to take corrective actions, including: · Actively recruiting and onboarding additional staff dedicated to BAM operations. · Providing enhanced training to ensure staff are equipped to conduct timely and thorough investigations. · Implementing improved case management and tracking mechanisms to monitor timeliness and workload distribution. · Evaluating internal processes to identify efficiencies and reduce delays in case completion. The Division is committed to strengthening internal controls and ensuring compliance with federal requirements. Management will continue to monitor progress and take additional corrective actions as necessary to meet BAM performance standards moving forward.

Reference Number: 2025-006 Prior Year Finding: 2024-007 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Reporting – ETA 2208A, Quarterly UI Above-Base Report Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: ETA 2208A, Quarterly UI Above-Base Report (OMB No. 1205-0132) – Quarterly report of staff years worked and paid by program category. Reports are due no later than 30 days after the end of each quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) was unable to provide supporting documentation for expenditures reported in the ETA 2208A – Quarterly UI Above-Base Report. Context The September 30, 2024 and March 31, 2025 quarterly ETA 2208A reports were selected for testing and the Division was unable to provide supporting documentation for the September 30, 2024 ETA 2208A report. Questioned Costs Undetermined. Cause The Division’s internal controls were not sufficient to ensure that it maintained supporting documentation for quarterly ETA 2208A reports. Effect Auditors were unable to verify that the ETA 2208A reports submitted by the Division were accurate and agreed to supporting documentation. Recommendation The Division should review and update its reporting internal controls to ensure that ETA 2208A – Quarterly UI Above-Base Reports tie to supporting documentation and that supporting documentation is retained and readily available for audit. Views of Responsible Officials We acknowledge the audit finding that the Division was unable to provide supporting documentation for QE 09/30/2024 ETA 2208A report. Procedures have been implemented to ensure documentation used to complete the ETA 2208A is saved in clearly marked folders on our Fiscal drive for ease of retrieval. Procedures will be documented and saved for ease of retrieval and use.

Reference Number: 2025-007 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Reporting – ETA 2112, UI Financial Transaction Summary Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement Compliance: ETA 2112, UI Financial Transaction Summary (OMB No. 1205-0154) – A monthly summary of transactions, which account for all funds received in, passed through, or paid out of the state unemployment fund. Form ETA 2112 provides a summary of data pertaining to state unemployment insurance (UI) tax collections, regular benefits paid, Federal and state shares of extended benefits paid, Federal temporary program benefits paid, and other transactions affecting the Unemployment Trust Fund. In addition, it reflects specific areas where adjustments are indicated to determine the adequacy of resources available for regular unemployment benefit payments. Data from this form is also used with data from other statistical reports to study trends in financial aspects of the UI program and as a basis for solvency studies. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) was unable to provide supporting documentation that ETA 2112 reports were reviewed and approved prior to submission. Context For three of three ETA 2112 reports selected for testing, the Division was unable to provide documentation that the reports had been reviewed and approved prior to submission. Questioned Costs Undetermined. Cause The Division does not have a control in place to ensure that reports are reviewed and approved prior to submission. Effect There is an increased risk of charging unallowed costs to the program if reports are not reviewed and approved prior to submission. Recommendation We recommend the Division review and enhance internal controls to ensure that ETA 2112 reports are reviewed and approved prior to submission. Views of Responsible Officials There is already a signature on the report we will now have that is signed and dated and will also add an additional line for preparer signature and date.

Reference Number: 2025-008 Prior Year Finding: 2024-010 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Allowable Cost/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) was unable to provide support to validate that payroll expenses charged to the federal program were reviewed. Timesheets did not have evidence of supervisory approval. Context For 2 of 60 timesheets selected for testing, the Division was unable to provide documentation that the timesheets were reviewed and approved by a supervisor. Questioned Costs Undetermined. Cause Controls were not operating effectively to ensure that time and effort reporting was performed and documented in a timely manner, in accordance with federal requirements. Effect There is an increased risk of charging unallowed payroll costs to the program. Recommendation The Division should reevaluate its current process, implement proper controls, and perform additional training for time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials We agree that the division was unable to provide documentation supporting the timesheet approval as asserted. However, we respectfully disagree that the lack of timesheet approval translates into charging the program with unallowed costs. It’s important that the auditors understand that the division’s responsibility to ensure that payroll charges to the program are appropriate begins with ensuring that each employee tasked with performing program functions are hired into the correct division internal program unit (“IPU”). And then further within that IPU, instruct employees to use a specific activity code that is assigned to various federal programs. In the samples reviewed, employees properly used the correct activity code to record time for the work performed. Auditor Rejoinder In its response, the Division acknowledges that it was unable to provide documentation to auditors that timesheets were reviewed and approved. Auditors recognize that an allowable activity code was used by the employees, but without review and approval, the actual time recorded and the validity of the activity code could not be verified. However, auditors recognize that the payroll costs would be allowable if they were reviewed by a supervisor and it was determined that appropriate activity codes were used for those employees in the given time periods. Therefore, auditors did not identify questioned costs for this finding due to a lack of documentation but reiterate that there is a possibility that questioned costs may exist if the employee time charged to the program was inappropriate.

Reference Number: 2025-009 Prior Year Finding: 2024-011 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (10/1/2024 – 12/31/2027) Compliance Requirement: Allowable Cost/Cost Principles – General Disbursements Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition Documentation to support General Disbursement transactions was not readily available for review. States are required to develop and implement internal controls to ensure proper supporting documentation is maintained and readily available for audit, but the Division of Unemployment Insurance (Division) was unable to provide supporting documentation to auditors on a timely basis. Context For three of sixty general disbursement transactions selected for testing, the Division was initially unable to provide supporting documentation and confirmed lack of support for these items to auditors. After the conclusion of audit test work, the Division provided support for the sample selections, however, it was not submitted for audit review in a timely manner. Questioned Costs None noted. Cause The Division’s procedures and controls are not sufficient to ensure timely submission of requested audit documentation. Effect Lack of effective controls could cause the Division to incur program charges without supporting documentation. Recommendation The Division should review and enhance its procedures and controls regarding general disbursements to ensure that supporting documentation is readily available upon audit request. Views of Responsible Officials We acknowledge that audit ready evidence was not produced in a timely fashion but respectfully disagree that the Division did not maintain this evidence. The lack of timely production can be attributed to lack of awareness of the proper repository where such audit evidence was maintained and/or could be easily retrieved, as opposed to no maintenance at all. We also maintain that the division was able to substantiate all expenses queried. Auditor Rejoinder On October 1, 2025, auditors sent a request to the Division for supporting documentation for sixty samples selected for testing. Documentation was provided to auditors on November 10, 2025, but for three of the sixty samples it was deemed insufficient for testing. Auditors followed up with the Division, requesting additional support for these samples, but it was not provided. On February 17, 2026, auditors met with Fiscal Management regarding the status of the outstanding supporting documentation and were informed it was not available and would not be provided. After this meeting, auditors finalized audit test work, drafted the audit finding, and sent it to the Division for a written response. On March 11, 2026, the Division provided additional support to auditors after the conclusion of audit test work. Auditors acknowledge that support was eventually provided but maintain that the Division’s procedures and controls are insufficient to ensure that adequate supporting documentation is readily available for audit.

Reference Number: 2025-010 Prior Year Finding: 2024-004 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: State Workforce Agencies (SWA) responsibilities include: (1) establishing specific, detailed policies and operating procedures which comply with the requirements of federal laws and regulations; (2) determining the state Unemployment Insurance (UI) tax structure; (3) collecting state UI contributions from employers (commonly called “unemployment taxes”); (4) determining claimant eligibility and disqualification provisions; (5) making payment of UI benefits to claimants; (6) managing the program’s revenue and benefit administrative functions; (7) administering the programs in accordance with established policies and procedures; and (8) enacting state unemployment compensation (UC) law that conforms with federal UC law. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) did not maintain documentation supporting claimant eligibility and did not properly set up claimants to recoup overpayments. Context Sixty claimants were selected for testing, and the following exceptions were noted: • For 3 of 60 claimants, the Division was unable to provide documentation that the claimant provided weekly updates. • 2 of 60 claimants were not properly set up to recoup overpayments. One claimant was determined to be ineligible, but benefits were paid. One claimant was initially determined to be eligible, but after the employer appealed the claim, the claimant was determined to be ineligible. Neither claimant was properly set up to recoup the overpayments. • For 1 of 60 claimants, documentation could not be provided that the Division contacted the employer to verify the claimant’s employment status. Questioned Costs Undetermined. Cause The Division’s procedures and internal controls were not sufficient to ensure that documentation to support claimant eligibility was retained nor that claimants were properly set up to recoup overpayments. Effect The Division did not recoup benefits paid to claimants which were determined to be ineligible. Failure to maintain eligibility documentation could allow benefits to be paid to ineligible claimants. Recommendation The Division should review and enhance procedures and controls to ensure that claimant eligibility is properly determined, that documentation supporting claimant eligibility is retained, and that documentation is readily available for audit. Views of Responsible Officials For 3 of 60 claimants, the Division was unable to provide documentation that the claimant provided weekly updates. These cases (sample 2,7 and 36) relate to claimant weekly certifications and their responses to required eligibility questions for the applicable benefit weeks. Due to existing mainframe system limitations, the Division does not have the ability to directly view all claimant responses within the system interface. In preparation for the CLA review, Application Support generated a comprehensive report capturing weekly certification responses for all sampled claimants, based on Social Security Numbers. However, three claimants did not appear on this report, and therefore their responses could not be verified at the time of review. The Division has identified both short-term and long-term corrective actions to address this discrepancy: • Short-term solution: A service ticket has been submitted to the Application Support team to investigate and resolve the issue that caused these claimants to be excluded from the report. Once resolved, future reports are expected to consistently capture all claimant responses associated with weekly certifications. • Long-term solution: The Division recognizes the need for a modernized system to improve the efficiency and reliability of claims processing and adjudication. Current case management systems are outdated and have limited functionality. Implementation of an updated system will allow for automated capture of weekly certification responses, improved data accessibility, and enhanced identification of potential compliance issues requiring investigation.

Reference Number: 2025-011 Prior Year Finding: 2024-012 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Reporting – ETA 9130, Financial Status Report, UI Programs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: The ETA 9130-Financial Status Report, UI Programs report is used to report program and administrative expenditures. All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UA Projects (administration and benefits). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) submitted ETA 9130 reports that did not agree with supporting documentation. Context Eight of forty-four ETA 9130 reports selected for testing did not agree with supporting documentation and auditors were unable to verify the accuracy of the reports. Specifically, we noted the following: • 5 of 24 reports selected from the 9/30/2024 quarter did not agree with supporting documentation. • 3 of 20 reports selected from the 3/31/2025 quarter did not agree with supporting documentation. Questioned Costs Undetermined. Cause The Division’s procedures were not sufficient to ensure that reports submitted agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect ETA 9130 reports did not agree with supporting documentation. Recommendation We recommend the Division review and enhance procedures and internal controls to ensure that ETA 9130 reports agree with supporting documentation and that documentation is maintained and is readily available for audit. Views of Responsible Officials We acknowledge the audit finding that several ETA 9130 reports did not agree with the supporting documentation. Procedures have been implemented to ensure documentation used to complete the ETA 9130 reports are reviewed by both the Certifying and Approving Officials before final sign off. Procedures will be documented and saved for ease of retrieval and use. Backup will be saved in clearly marked folders on our Fiscal drive for ease of retrieval.

Reference Number: 2025-012 Prior Year Finding: 2024-006 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Special Tests and Provisions – Employer Experience Rating Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement Compliance: Certain benefits accrue to states and employers as a result of the state having a federally approved experience-rated UI tax system. All states currently have an approved system. For the purpose of proper administration of the system, the State Workforce Agency (SWA) maintains accounts, or subsidiary ledgers, on a state UI taxes received or due from individual employers, and the UI benefits charged to the employer. The employer’s “experience” with the unemployment of former employees is the dominant factor in the SWA computation of the employer’s annual state UI tax rate. The computation of the employer’s annual tax rate is based on state UI law (26 USC 3303). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) did not apply the correct employer experience rate for an employer. Context For one of sixty employers selected for testing, due to a manual error, the Division improperly applied the employer experience rate using the 2013 new employer rate instead of the 2023 new employer rate. Questioned Costs Undetermined. Cause The Division’s procedures and controls were not sufficient to ensure that it applied the proper employer experience rate. Effect The Division incorrectly applied the employer experience rate to an employer. Recommendation The Division should review and enhance procedures and controls to ensure that employer experience rates are properly calculated and applied. Views of Responsible Officials We disagree with the finding as we believe the employer’s account effective date and liability status were established in accordance with the applicable state UI laws and regulations. Documentation can be provided to substantiate this determination. Account# 69821 was established in November of 2024 with a liability date of 04/2013 per employer’s application on file, which gave the employer a new employer rate of 2.8. After my discussion with the auditor on 3/19/26, I pulled the folder to further investigate. Based on this review, we conclude that the rate assignment was accurate and compliant, and therefore the finding appears to be based on a misunderstanding of the employer’s account status or the applicable rate criteria. The business already implemented a corrective action plan in 2025 which entailed changing how the calculation is performed. This calculation is now done outside of the Mainframe system in compliance with Title 19 rules with results uploaded into the system after calculation. The UI program successfully provided an auditable population for calendar year 2025. Auditor Rejoinder On January 26, 2026, auditors met with the UI Tax Administrator and Fiscal Analyst to discuss the Employer Experience rate assignment of 2.8% for Account #69821. Auditors reviewed state law HB433 and the ETA handbook requirements noting that all new employers added will receive an experience rate of 1.2%, or experienced employers will receive .6% if its benefit wage ratio does not exceed 20%. The UI Tax Administrator confirmed to auditors that the liability date of April 26, 2013, was entered in error instead of April 26, 2023, which caused the 2013 rate of 2.8% to be input into the employer experience rating letter sent to the employer. As documented in the guidance, there is no current benefit wage ratio calculation that would result in an employer experience rating of 2.8%.

Reference Number: 2025-013 Prior Year Finding: 2024-013 Federal Agency: U.S. Department of the Treasury State Department Name: Office of the Governor Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP0139 (3/3/2021 – 12/31/2024) SLFRP2629 (3/3/2021 – 12/31/2024) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per the Compliance and Reporting Guidance issued by the Department of the Treasury (Treasury), recipients must submit quarterly Project and Expenditure Reports. Required project information includes current period obligation, cumulative obligation, current period expenditure, cumulative expenditure, and capital project information. Per 31 CFR §35.6(b)(4), a recipient, other than a Tribal government, must prepare and submit written justifications for projects with capital expenditures enumerated by Treasury in the final rule and with total capital expenditures greater than $10 million. For projects with capital expenditures greater than or equal to $1 million but less than $10 million, written justifications must be maintained in project files. Such written justifications must include the following elements: (i) Describe the harm or need to be addressed; (ii) Explain why a capital expenditure is appropriate; and (iii) Compare the proposed capital expenditure to at least two alternative capital expenditures and demonstrate why the proposed capital expenditure is superior. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition Capital project justifications reported and/or maintained in project files did not include all required elements. Context The Office of the Governor (Office) prepares and submits quarterly Project and Expenditure Reports. Eight projects with capital expenditures greater than or equal to $1 million were selected for testing on the September 30, 2024 and December 31, 2024 quarterly reports. Projects selected consisted of four with capital expenditures greater than or equal to $10 million and four with capital expenditures less than $10 million. The following exceptions were noted: • For 1 of 4 projects greater than or equal to $10 million, the reported capital project justification did not include required elements (ii) or (iii). • For 2 of 4 projects greater than or equal to $10 million reported capital project justifications did not include required element (iii). • For 1 of 4 projects less than $10 million, the capital project justification maintained in the project file did not include required element (iii). Cause The Office’s procedures and internal controls were not operating effectively to ensure that capital project justifications reported or maintained in project files contained all required elements. Effect Capital project justifications are intended to demonstrate that each capital project over $1 million is the best and proper use of program funds for the intended purpose. Failure to ensure capital project justifications include all required elements could allow a capital project to be initiated that is not in the best interest of the program or the best use of program funds. Questioned Costs Undetermined. Recommendation We recommend that the Office enhance procedures and internal controls to ensure that it reports and/or maintains in project files capital project justifications that contain all required elements. The Office should provide training of State agency personnel and conduct periodic reviews of written capital project justifications to ensure that they comply with program requirements. Views of Responsible Officials The ARPA team acknowledges that the repeat finding related to capital project justifications resulted from gaps in enforcement and follow-up procedures with state agencies. While guidance was provided, the team did not consistently ensure that complete and compliant capital project justifications were obtained and reviewed prior to reporting. Contributing factors included limited staffing resources also impacted agencies’ ability to provide complete historical information for projects initiated in prior reporting periods. In several cases, agency personnel responsible for original project justifications were no longer available, making it more difficult to obtain sufficient documentation to meet Treasury requirements. However, the ARPA team recognizes that these challenges do not mitigate the responsibility to ensure compliance with reporting requirements. To address this, the ARPA team will implement enhanced controls to ensure compliance with capital project justification requirements. These include requiring complete justifications prior to reporting, use of a standardized template and review checklist, and a formal second-level review process to verify completeness and accuracy. In addition, the team will maintain centralized tracking of all submissions, implement formal escalation procedures for nonresponsive agencies, and provide ongoing training and guidance, including support for new agency personnel. Periodic compliance reviews will also be conducted to ensure continued adherence to program requirements.

Reference Number: 2025-014 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Department Name: Division of Libraries Federal Program: COVID-19 – Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Award Number and Year: CPFFN0144 (2/4/2022 – 12/31/2026) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per 2 CFR section 200.317 Procurements by states, when procuring property and services under a Federal award, a state must follow the same policies and procedures it uses for procurements from its non-Federal funds. Per 29 Del C. Chapter 69, section 6981 Large professional service procurement process: (a) Any state contract for which an agency is a party with probable fees, including reimbursable expenses and amendments, greater than the threshold amount or amounts established by the Contracting and Purchasing Advisory Council pursuant to § 6913 of this title for the completed job will be subject to the provisions of this subchapter. (b) Each agency shall publicly announce, not less than once a week for two consecutive weeks in a newspaper published or circulated in each county of the State, when professional services are required (c) Each agency shall publicly announce each professional services contract subject to subsection (a) of this section by electronic publication accessible to the public in a manner prescribed pursuant to § 6902(9) of this title for two consecutive weeks. (d) Such announcement shall include: (1) The project identification; (2) General description and scope of the project; (3) Location; (4) Deadline for submission of brief letters of interest; (5) Criteria for selection of professionals including any special criteria required for any particular project; (6) Indication of how interested professionals can apply for consideration; (7) The agency's intention to award to more than one firm, if applicable; and (8) A description of the selection process to be used, as defined in § 6982 of this title. (f) Each agency shall establish written administrative procedures for the evaluation of applicants. These administrative procedures shall be adopted and made available to the public by each agency before publicly announcing an occasion when professional services are required. One or more of the following criteria may be utilized in ranking the applicants under consideration: (1) Experience and reputation; (2) Expertise (for the particular project under consideration); (3) Capacity to meet requirements (size, financial condition, etc.); (4) Location (geographical); (5) Demonstrated ability; (6) Familiarity with public work and its requirements; or (7) Distribution of work to individuals and firms or economic considerations. (g) In addition to the above, other criteria necessary for a quality, cost-effective project may be utilized. (h) Each project shall be given individual attention, and a weighted average may be applied to criteria according to its importance to each project. (i) For the selection process described in § 6982(b) of this title, price may be a criteria used to rank applicants under consideration. Per 29 Del C. Chapter 69, section 6982 Selection: (a) Agencies shall use the selection process described in paragraphs (b)(1) through (3) of this section. (1) Based upon the criteria established pursuant to § 6981(f) of this title, the agency shall determine all applicants that meet the minimum qualifications to perform the required services. (2) The agency shall then interview at least one of the qualified firms. The agency may negotiate with one firm without terminating negotiations with another firm and may negotiate with one or more firms during the same period. At any point in the negotiation process, the agency may, at its discretion, terminate negotiations with any or all firms. (3) The agency may require the firm with whom the agency is negotiating to execute a truth-in-negotiation certificate stating the wage rates and other factual unit costs supporting the compensation are accurate, complete and current at the time of contracting. All professional service contracts shall provide that the original contract price and any additions thereto shall be adjusted to exclude significant sums where the agency determines the contract price was increased due to inaccurate, incomplete or noncurrent wage rates and other factual unit costs. All such contract adjustments shall be made within one year following the end of the contract. Sole source procurement shall be avoided, except when no reasonable alternative sources exist. A written determination by the agency for the sole source procurement shall be included in the agency's contract file. (29 Del. C. §6904(i)) Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Libraries (Division) was unable to provide evidence that it had procured a contract in accordance with the State’s procurement policies. Context For one of five contracts selected for testing, the Division was unable to provide supporting documentation that it had procured the contract in accordance with the State’s procurement policies. Questioned Costs Undetermined. Cause The Division’s internal controls were not sufficient to ensure that federal and statewide procurement policies were followed for purchases made for the program. Effect Failure to adhere to procurement policies and procedures may result in the contract being issued under terms and conditions that are not in the best interest of the federal program and/or the State. Recommendation The Division should review and enhance controls and procedures to ensure that it follows the State’s procurement policies for all contracts charged to the program. Views of Responsible Officials The Department of State, Division of Libraries disputes the audit finding of “significant deficiency in internal control over compliance, other matters” on the basis that Title 29, Chapter 69 of the Delaware Code is inapplicable and exempts the purchase of services by libraries from the State procurement process, including construction. Without admission to any deficiency in the Division’s “internal control over compliance, other matters,” the Division of Libraries will review all internal controls and procedures to ensure compliance with the State’s procurement process. Auditor Rejoinder Auditors acknowledge that Title 29, Chapter 69(d) of the Delaware Code includes exemptions related to libraries. Specifically, it states: “This chapter shall not apply to any purchase of library materials such as books, periodicals, subscriptions and software by libraries of any agency, nor shall this chapter apply to the purchase of services by libraries of any agency pursuant to Chapter 66 of this title.” Library services is further defined in Title 29, Chapter 66, §6602(a), Contracting for library services, which states the following: “In order to encourage the maintenance and development of proper standards, including personnel standards, hours of operation, library materials, collection standards and interlibrary resource sharing, and to provide for the development of statewide public library service, the Delaware Division of Libraries may contract with any public library, including privately incorporated public libraries or public library systems established pursuant to Chapter 8 of Title 9, which qualifies under standards established by the Division with the approval of the Delaware Council on Libraries, to provide library services.” Furthermore, Title 29, Chapter 66A, establishes requirements regarding library construction which includes a provision for proposal review and does not exempt such projects from following established procurement policies. The contract identified by auditors in this finding is a $22 million contract for “management and construction services for the North Wilmington Library Think Do (“Project”)”. Auditors believe the scope and nature of this agreement does not fall under the exemptions established for library services under Title 29, Chapter 69(d) of the Delaware Code. The Division was unable to provide auditors with documentation that it had followed established procurement procedures when it entered into this agreement.

Reference Number: 2025-015 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Department Name: Office of the Governor Federal Program: COVID-19 – Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Award Number and Year: CPFFN0144 (2/4/2022 – 12/31/2026) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per the CPF State Guidance issued by the Department of the Treasury (Treasury), recipients must submit quarterly Project and Expenditure Reports. Required project information includes current and cumulative obligations and expenditure and other information applicable to each specific category of project. For Multi-Purpose Community Facility Projects, recipients must report planned and actual square footage funded by CPF. Reported square footage must be within 10% of the square footage included in supporting documentation. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of the Governor (Office) reported square footage for a project that varied by more than 10% of the amount included in supporting documentation. Context Eight projects categorized as Multi-Purpose Community Facility Projects were selected for testing from the September 30, 2024 and March 31, 2025 quarterly reports. For one of eight projects selected, the planned square footage reported varied by more than 10% of the planned square footage maintained in project files. The square footage in project files was 11,000, but the amount reported was 18,000 which is a variance of 64%. Auditors noted the same amount was reported in both quarters tested. Cause Procedures and internal controls were not operating effectively to ensure that square footage reported agreed with supporting documentation. Effect Reported square footage did not agree with supporting documentation and the variance exceeded 10%. Questioned Costs None noted. Recommendation We recommend that the Office enhance its procedures and internal controls to ensure that reported square footage agrees with supporting documentation. Views of Responsible Officials The ARPA team acknowledges that the discrepancy in reported square footage resulted from a data entry error and insufficient controls to ensure that updates to project data were reflected in subsequent reporting periods. To address this, the team has implemented enhanced data validation procedures, including reconciliation of reported data to supporting documentation each reporting period, formal tracking of changes to project data, and a secondary review of key data elements prior to submission. Ongoing monitoring will be performed to ensure continued accuracy and consistency across reporting periods.

Reference Number: 2025-016 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: NU50CK000497 (8/1/2019 – 7/31/2027) NU51CK000334 (8/1/2024 – 7/31/2029) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Public Health (Division) inaccurately charged payroll costs to the program. Context For one of forty time sheets selected for testing, the employee’s time and effort certification indicated that 50% of the employee’s time was spent on the program, but 100% of the employee’s time was charged. Questioned Costs $1,742, the amount charged to the program in error. Cause Controls were not operating effectively to ensure that time and effort reporting was performed accurately. Effect Unallowed payroll costs were charged to the program. Recommendation The Division should reevaluate its current process, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials ELC Financial Lead will work with DPH Support Services to track all recoded time against grant. As recodes are identified, time certifications for affected staff will need to be revised and filed appropriately.

Reference Number: 2025-017 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Social Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 2501DETANF (10/1/2024 – 9/30/2025) 2401DETANF (10/1/2023 – 9/30/2024) 2301DETANF (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity’s written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Social Services (Division) did not have evidence of that employee time charged to the program was properly documented. Context Forty timesheets were selected for testing, and the following exceptions were noted: • 17 of 40 timesheets selected for testing could not be provided to auditors for testing. • 14 of 40 timesheets selected for testing were not certified timely by a program supervisor. The timesheets were certified several months after the end of the pay period. • 1 of 40 timesheets selected for testing was not certified by a program supervisor. Questioned Costs Undetermined. Cause The Division’s controls are not sufficient to ensure that time and effort reporting is performed and documented in accordance with federal requirements. Effect Employee time charged to the program could not be verified and there is an increased risk of charging unallowed payroll costs to the program. Recommendation The Division should enhance procedures, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials The following action will be taken to improve the current process. • The Fiscal unit is implementing procedures to serve as the central repository for all Time and Effort records, replacing the current practice of storing these forms at the program manager level. • Implement internal controls for Time and Effort Reporting. • Confirm that T&E information submitted is accurate and reconciled. • Provide training for Time & Effort certification.

Reference Number: 2025-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Children’s Health Insurance Program Assistance Listing Number: 93.767 Award Number and Year: SAI000005399 (10/1/2023 – 9/30/2024) Compliance Requirement: Period of Performance Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: A non-Federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) was unable to provide evidence that expenditures were incurred during the grant’s allowable period of performance. Context Forty disbursement transactions recorded during September and October 2024 were selected for testing. For forty of forty transactions selected, the Division was unable to provide documentation that the costs were incurred during the grant’s period of performance. Cause The Division’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect Costs could be deemed unallowable by the awarding agency if funds are expended and/or obligated outside of the allowable period of performance. Questioned Costs Undetermined. Recommendation The Division should review and enhance its procedures and internal controls to ensure that it maintains documentation that expenditures charged to the program are incurred within an award’s allowable period of performance. Views of Responsible Officials To prevent recurrence, we are implementing the following actions: 1. Enhanced Monitoring Controls o Establish a centralized tracking system for all awards, including start and end dates. 2. Staff Training and Accountability o Conduct mandatory training for program and finance staff on compliance with period of performance requirements. o Assign clear responsibility for monitoring award timelines to designated personnel. 3. Pre-Closeout Review Process o Introduce a formal pre-closeout review 60 days before the award end date to identify and resolve outstanding obligations. o Require certification from both program and finance leads confirming that all expenditures fall within the allowable period. 4. Post-Expenditure Review o Perform monthly reconciliation of expenditures against the period of performance. o Immediately flag and correct any discrepancies identified.

Reference Number: 2025-022 Prior Year Finding: 2024-023 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2405DE5MAP (10/1/2023 – 9/30/2024) 2505DE5MAP (10/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions – Provider Health and Safety Standards Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. Context For thirty-six of sixty providers selected for testing, the Division was unable to provide evidence that the provider complied with health and safety standards. Questioned Costs Undetermined. Cause The Division’s procedures and controls were not sufficient to ensure that it maintained documentation that providers met the program’s health and safety requirements. Effect Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Recommendation The Division should reevaluate its current process and perform additional training to ensure documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of Responsible Officials DMMA will review the process of storing all data for provider’s screening and credentialing information. In addition, when a provider enrolls or revalidates into DMAP, they will be required to submit updated credentials and license information.

Reference Number: 2025-023 Prior Year Finding: 2024-022 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Children’s Health Insurance Program, Medicaid Cluster Assistance Listing Number: 93.767, 93.775, 93.777, 93.778 Award Number and Year: 2405DE5021 (10/1/2023 – 9/30/2025) 2505DE5021 (10/1/2024 – 9/30/2026) 2405DE5MAP (10/1/2023 – 9/30/2024) 2505DE5MAP (10/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions – Managed Care Financial Audit Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) was unable to provide documentation that it had posted results of managed care financial audits on its website. Context For three of three MCOs within the state, the Division did not post the results of the audits on its website. Questioned Costs None noted. Cause The Division’s procedures and controls were not sufficient to ensure that the results of MCO independent audits were posted to its website once completed. Effect The Division is not in compliance with the transparency requirements regarding MCO independent audits. Recommendation The Division should implement procedures and controls to ensure that it posts the results of independent audits to its website once completed, as required. Views of Responsible Officials DMMA will review the procedures and provide additional training for staff to ensure each MCO has had an audit, obtain copies of the audit, reviews the results, and post the results of the audit on the website.

Reference Number: 2025-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2405DE5MAP (10/1/2023 – 9/30/2024) 2505DE5MAP (10/1/2024 – 9/30/2025) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) did not maintain documentation supporting participant eligibility. Context For two of forty participants selected for testing, the Division did not maintain copies of the application, case comments, and/or renewal determination for the participants. Questioned Costs Undetermined. Cause The Division’s procedures and controls were not sufficient to ensure that it maintained documentation supporting participant eligibility. Effect Failure to maintain eligibility documentation could result in ineligible participants receiving benefits under the program. Recommendation The Division should implement procedures and controls to ensure that it maintains documentation supporting participant eligibility and this documentation should be readily available for audit. Views of Responsible Officials The Division of Medicaid and Medical Assistance (DMMA) in partnership with the Division of Social Services (DSS) will provide training for determination of member eligibility. DSS will also ensure supporting participant eligibility documentation is properly maintained.

Reference Number: 2025-025 Prior Year Finding: 2024-024 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Substance Abuse and Mental Health Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: H79TI085764 (9/30/2022 – 9/29/2024) 6H79TI085764 (9/30/2023 – 9/29/2025) 5H79TI083305 (9/30/2024 – 9/29/2027) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition Timesheets provided by the Division of Substance Abuse and Mental Health (Division) were not reviewed and approved timely by a supervisor. Context 16 of 28 timesheets selected for testing were not certified timely by a program supervisor. The timesheets were certified several months after the end of the pay period. Questioned Costs Undetermined. Cause The Division’s controls are not sufficient to ensure that time and effort reporting is performed and documented in a timely manner, in accordance with federal requirements. Effect There is an increased risk of charging unallowed payroll costs to the program. Recommendation The Division should enhance procedures, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials The Division evaluated the developed process and implemented controls for completion of the process within 60 days with added monitoring roles for accuracy and timeliness. The Division will be performing training for assigned staff, monitoring completion and will continue to improve the process for efficiency and compliance.

Reference Number: 2025-026 Prior Year Finding: 2024-025 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Substance Abuse and Mental Health Federal Program: Opioid STR Assistance Listing Number: 93.788 Award Number and Year: H79TI085764 (9/30/2022 – 9/29/2024) 6H79TI085764 (9/30/2023 – 9/29/2025) 5H79TI083305 (9/30/2024 – 9/29/2027) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Substance Abuse and Mental Health (Division) did not report required subaward information per FFATA requirements. Context Five of eleven subawards selected for testing were not reported timely per FFATA requirements. One subaward was issued on 9/22/2024 and has not been reported to SAM.gov. Four subawards were not reported timely and were reported 1 to 118 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause The Division’s policies and procedures were not sufficient to ensure that required subaward information was reported accurately no later than the end of the month following the date the subaward was issued. Internal controls did not prevent or detect the errors. Effect Subawards were not reported in accordance with FFATA requirements. Questioned Costs None noted. Recommendation We recommend that the Division develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Division develop controls and procedures to ensure that all required subawards are reported accurately and timely SAM.gov. Views of Responsible Officials The Division has reviewed the FFATA reporting requirements and evaluated the procedures in place for identifying and reporting subawards in SAM.gov. During the audit period, the Division relied on existing processes that did not include a formalized secondary review to ensure all reportable subawards were submitted within the required timeframe. In response to this finding, the Division has implemented enhanced internal controls and monitoring procedures to ensure compliance with FFATA reporting requirements. These actions include: • Development of a standardized FFATA tracking log to monitor all subawards issued under applicable federal programs. • Implementation of a secondary review process to verify that all reportable subawards meeting FFATA thresholds are identified and submitted in SAM.gov within required deadlines. • Coordination between program and fiscal staff to confirm subaward execution dates, amounts, and reporting applicability prior to the reporting deadline. • Periodic review of SAM.gov submissions to ensure completeness and accuracy. These corrective actions are intended to strengthen internal controls over FFATA reporting and ensure timely and accurate submission of required subaward reports going forward.

Reference Number: 2025-027 Prior Year Finding: 2024-026 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Substance Abuse and Mental Health Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: SAI000006426 (10/1/2023 – 9/30/2025) SAI000005888 (10/1/2022 – 9/30/2024) SAI000005101 (9/1/2021 – 9/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Substance Abuse and Mental Health (Division) did not report required subaward information in accordance with FFATA requirements. Context Two of five subawards selected for testing were not reported in accordance with FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause The Division’s policies and procedures were not sufficient to ensure that required subaward information was reported accurately no later than the end of the month following the date the subaward was issued. Internal controls did not prevent or detect the errors. Effect Subawards were not reported in accordance with FFATA requirements. Questioned Costs None noted. Recommendation We recommend that the Division develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Division develop controls and procedures to ensure that all required subawards are reported accurately and timely to SAM.gov. Views of Responsible Officials Regarding the subaward identified as not timely reported, the Division confirms that the subaward was submitted in SAM.gov on December 9, 2024. In accordance with FFATA reporting requirements, the subaward should have been reported no later than the end of the month following the month in which the subaward was issued. The delay in reporting was the result of administrative oversight. Since the prior finding, the Division has reviewed and strengthened its internal controls related to FFATA reporting to ensure compliance with federal requirements. Updated procedures have been implemented to formally track all subawards subject to FFATA reporting, including documentation of subaward issuance dates, calculation of reporting due dates, and verification of submission in SAM.gov within the required timeframe. In addition, the Division has implemented a secondary review process to monitor FFATA reporting on an ongoing basis. This includes periodic review of subaward activity and confirmation that all required reports have been submitted timely. These enhanced controls are intended to prevent recurrence of late reporting and to ensure full compliance with FFATA requirements going forward.

Eligibility Program Name: Summer Electronic Benefits Transfer Program for Children (Summer EBT) (Assistance Listing 10.646) Federal Award Agency: United States Department of Agriculture Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 244CT833N1175 Background The Department of Social Services (DSS) is the lead agency that administers the Summer EBT program and partners with the State Department of Education (SDE) to facilitate the program. DSS relies on the Integrated Management of Public Assistance for Connecticut (ImpaCT) system, the Connecticut Health Insurance Exchange (HIX) system, and third-party contractors when determining client eligibility. Additionally, SDE provides eligible client listings to DSS. DSS issues Summer EBT benefits to clients in multiple iterations. The department’s business systems and quality management divisions, and third-party contractors review the iterations. Each iteration requires a database change request prior to running the iteration. If the business systems division determines that it needs to make a change to the database change request, it will provide a formal approval. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Title 7 CFR Part 292.16(a)(5)(i) requires the state Summer EBT agency to establish a master issuance file which contains all information needed to identify eligible children, issue Summer EBT benefits, record the participation activity for each household, and supply all information necessary to fulfill reporting requirements. Condition Our inquiry about the Summer EBT client eligibility population disclosed that DSS did not track which agency was responsible for each client’s eligibility determination. The DSS business systems division did not approve four out of seven benefit iterations, totaling $993,840, and did not maintain sufficient documentation to support that it did not need to make a change to the database change request. Context DSS issued Summer EBT benefits in seven iterations totaling $30,362,441 during the fiscal year ended June 30, 2025. Questioned Costs $0 Effect DSS has reduced assurance over the accuracy and reliability of client eligibility determinations and oversight of Summer EBT benefit iterations. Cause The department’s current methods of combining multiple sets of Summer EBT issuance data files lacked sufficient controls to determine the source of client eligibility. The business systems division relied on quality management’s approval and did not maintain documentation to confirm that it made no changes to some database change requests. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls to identify the agency responsible for each client’s eligibility determination and document benefit iteration approvals for the Summer Electronic Benefits Transfer Program for Children. Views of Responsible Officials “The Department disagrees with this finding. Condition #1: Eligibility for the Summer EBT program is established through multiple pathways: receipt of Supplemental Nutrition Assistance Program (SNAP) benefits, Temporary Family Assistance (TFA), or HUSKY A coverage, and through applying for and receiving an eligibility determination for either the National School Lunch Program or the Summer EBT program itself. Determining eligibility is a shared responsibility between DSS and the State Department of Education (SDE), and children qualify through multiple pathways simultaneously. DSS maintains a record within its eligibility system and compiles reports of all eligible children. When eligibility is established through any additional means, the child’s record is then analyzed against all previous issuances to ensure duplicate participation and double issuance does not occur. Title 7 CFR Part 292.16 (a)(5)(i) requires the Summer EBT agency to establish a master issuance file which contains all information needed to identify eligible children, issue Summer EBT benefits, record the participation activity for each household and supply all information necessary to fulfill reporting requirements. The agency is not required to specify which program(s) were used to determine eligibility, which is reasonable given that there may be multiple overlapping avenues of eligibility. The implication that DSS is somehow not compliant or able to identify the source of eligibility is inaccurate. DSS can identify this information on an individual basis through reviewing the child’s receipt of SNAP, TFA, HUSKY A, or through its ongoing coordination and communication with SDE. Condition #2: It is not a requirement of the business systems division to request approval for each issuance. Each year the Department issues benefits for this program in a consistent manner. Since there were no changes to the process during the audit period, approval was not sought for the issuances. Business systems would only seek approval if there was a change to the process.” Auditors’ Concluding Comments Eligibility data at the summary and individual levels are both critical for an effective and efficient review of the program. The department could not provide documentation to substantiate that it used existing database change request scripts and approval by the business systems division was not necessary.

Special Tests and Provisions – EBT Card Security Program Name: Summer Electronic Benefits Transfer Program for Children (Summer EBT) (Assistance Listing 10.646) Federal Award Agency: United States Department of Agriculture Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 244CT833N1175 Background The Department of Social Services (DSS) provides Summer Electronic Benefits Transfer (EBT) benefits through EBT cards. The department’s financial services division tracks the status of returned EBT cards. The department’s mailroom staff are responsible for EBT card destruction. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 7 CFR Part 292.16(h)(3)(i) requires the state Summer EBT agency to provide adequate security for EBT cards including secure storage, inventory control records, and periodic review and validation of inventory control records. Title 7 CFR Part 292.15(h)(1)(i) requires Summer EBT agencies to expunge Summer EBT benefits 122 calendar days after issuance. Condition Our review of the status of returned Summer EBT cards disclosed that DSS destroyed returned EBT cards and did not maintain a log to record client information, disposition date, and reason for destruction. Context DSS issued $7,243,933 in Summer EBT refunds during fiscal year 2025. The refund amount included lost, stolen, or damaged EBT cards as well as expunged benefits. DSS destroyed seven 500-card tubes of returned EBT cards. Questioned Costs We were unable to determine if there were questioned costs as DSS did not maintain disposition records for the returned EBT cards. Effect DSS has reduced assurance over the security and accountability of returned EBT cards. Cause DSS informed us that it did not maintain a log due to the large volume of returned EBT cards. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls to ensure that it consistently secures, tracks, and records returned cards for the Summer EBT program. Views of Responsible Officials “The Department agrees with this finding. However, the Department believes that there are proper internal controls to ensure the security of returned cards. There was no log maintained by the Department but the controls in place reduced the risk of benefits being used incorrectly to an acceptable level. The returned cards were destroyed, and all unused benefits were expunged.” Auditors’ Concluding Comments DSS did not implement sufficient internal controls for the Summer EBT card program compared to the department's other federal EBT card programs. DSS was unable to provide documentation to support which EBT cards it destroyed and that it expunged benefits on all cards prior to destruction.

Subrecipient Monitoring Program Name: Crime Victim Assistance (Assistance Listing 16.575) Federal Award Agency: Department of Justice Award Years: Federal Fiscal Years 2021, 2022, and 2023 Federal Award Numbers: 15POVC-21-GG-00615-ASSI, 15POVC-22-GG-00715-ASSI, and 15 POVC-23-GG-00433-ASSI Background The Crime Victim Assistance program provides financial support and various services and resources to crime victims, including crisis counseling, criminal justice support and advocacy, shelter, and therapy. The Judicial Branch provides grants to subrecipients to provide these services. Title 28 U.S Code of Federal Regulations (CFR) Part 94.118 provides that subrecipients shall contribute not less than 20% of the total cost of each project. Subrecipients shall derive these contributions from non-federal sources. Each subrecipient shall maintain records that clearly show the source and amount of the matching contributions.Criteria Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal control over federal awards that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 CFR Part 200.332(e) provides that the pass-through entity shall monitor subrecipient activities as necessary to ensure that they comply with federal statutes, regulations, and the terms and conditions of the subaward. Title 28 CFR Part 94.106 provides that the state administering agency shall conduct regular desk monitoring of all subrecipients as well as on-site monitoring of all subrecipients at least once every two years during the award period. The state shall maintain a copy of site visit results and other documents related to compliance. Title 2 CFR Part 200.306(b) provides that the pass-through entity must accept any cost sharing funds as part of the subrecipient’s contributions to a program when the funds are verifiable in the subrecipient’s records. Condition The Judicial Branch did not perform regular subrecipient desk reviews or site visits at least once every two years during the award period as required by federal regulations. The branch does not complete reviews until the award period ends. As a result, it did not promptly examine subrecipients’ underlying documentation such as invoices, timesheets, or support for expenditures or matching contributions. The branch’s monitoring process was limited to monthly reviews of budget-to-actual summaries. Context During the fiscal year ended June 30, 2025, the branch made $8,759,482 in reimbursements to 40 subrecipients.Questioned Costs $0Effect The Judicial Branch has limited assurance that subrecipients used federal funds for allowable activities and met the mandatory matching requirements. This could potentially lead to future disallowed costs and federal repayment obligations.Cause Due to a lack of adequate staffing, the Judicial Branch prioritized reviewing supporting documentation for prior award periods rather than the current period. Prior Audit Finding We have not previously reported this finding.Recommendation The Judicial Branch should strengthen internal controls to ensure it complies with federal subrecipient monitoring requirements for the Crime Victim Assistance program. Views of Responsible Officials “The Judicial Branch Office of Victim Services (OVS) agrees to strengthen its internal controls as described below to comply with federal subrecipient monitoring requirements for the Victims of Crime Act Assistance (VOCA) Program. In 2025, OVS performed site visits for four VOCA-funded programs and completed financial-desk reviews of monthly or quarterly financial reports for all programs. That year, OVS experienced personnel turnover in its three-employee Fiscal Services Unit, notably the separation from state service of a Program Manager and a Court Planner, who together performed OVS’ programmatic site visits of VOCA-funded programs. Also, there was a significant increase in workload resulting from OVS’ contributions to the 2024-2025 VOCA request-for-proposal process. In response, staff outside the unit contributed while managing other assigned duties, a Program Manager and Grants and Contract Specialist were hired to restore the unit to its three-employee configuration, the new employees received training on subrecipient monitoring policies and procedures, and a revised subrecipient site visit plan was developed and has begun being implemented. To strengthen internal controls, OVS has developed a revised site visit plan for the remaining VOCA-funded programs scheduled to receive site visits in 2025. April 15, 2026, is the anticipated date for OVS to complete the site visits. OVS has completed sending letters to the subrecipients operating the VOCA-funded programs. The letters request supporting documentation, which is programmatic and financial in nature, in accordance with OVS administrative policy and procedure. Also, the letters inform subrecipients that site visits will commence in accordance with a revised site visit plan.”

Activities Allowed or Unallowed – Individual Plans and Service Records Program Name: Money Follows the Person Rebalancing Demonstration (MFP) (Assistance Listing 93.791) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 1LICMS300142 Background The Department of Social Services (DSS) is the designated single state agency to administer the Money Follows the Person Rebalancing Demonstration (MFP) program. Connecticut administered certain aspects of MFP through several state agencies including the Department of Developmental Services (DDS). Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.403 provides that to be allowable under federal awards, costs should be adequately documented. Title 2 CFR Part 200.303 requires the non-federal entity to establish, document, and maintain effective internal controls over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Procedure No. I.C.1.PR.002.a. of the DDS Operation Manual states that DDS should obtain agreements and approvals for the individual plan during the planning process. The case manager should document who participated in the planning process and obtain signatures on the individual plan. Participants typically include the recipient, parent, guardian, advocate, case manager, support brokers, private agency designee, and other DDS staff. Condition Our review of 25 MFP benefit payments totaling $11,000, of which $8,250 was federally reimbursed, disclosed that DDS did not have signatures of agreement and approval for six individual plans. Additionally, DDS could not obtain service records from one medical provider to support one $46 payment, for which DSS received $35 in federal reimbursement. Context During the fiscal year ended June 30, 2025, DSS processed $4,978,654 in MFP benefit payments on behalf of 36 DDS recipients. DSS received $3,733,990 in federal reimbursement. The sample was not statistically valid. Questioned Costs $0 Effect The lack of signatures to indicate agreement and approval of an individual plan by relevant participants increases the risk of inadequate services for the recipient. DSS received federal reimbursement for an unallowed expenditure. Cause Lack of management oversight contributed to the condition. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Developmental Services should strengthen internal controls to ensure it obtains the required signatures for the individual plan for all Money Follows the Person Rebalancing Demonstration recipients. The Department of Social Services should conduct an audit of the medical provider in accordance with Section 17b-99 of the Connecticut General Statutes to ensure integrity of the Money Follows the Person Rebalancing Demonstration program. Views of Responsible Officials Response provided by the Department of Developmental Services: “DDS agrees with the finding. The errors were attributed to current manual processes and case management oversight regarding documenting signatures when individual plan (IP) meetings are held remotely rather than in-person. Most of the deficiencies (5 of 6) were isolated to one case manager. The MFP division is small with 3-4 case managers, causing a higher error rate when extrapolated against the sample size. The missing support service records have been forwarded to the Department of Administrative Services for research. There are plans to improve the individual plan process to enhance internal controls through automation. In the interim, case managers and case manager supervisors will be reminded of the IP signature requirements.” Response provided by the Department of Social Services: “The Department agrees with this finding and the response provided by the Department of Developmental Services. Additional research is needed to determine whether the missing documentation was the provider's responsibility or was due to a billing issue. The Department of Developmental Services is coordinating with the Department of Administrative Services to research this further.”

Eligibility Program Name: Money Follows the Person Rebalancing Demonstration (MFP) (Assistance Listing 93.791) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 1LICMS300142 Background The Department of Social Services (DSS) uses several systems to administer the Money Follows the Person Rebalancing Demonstration (MFP) program. The My Community Choices web portal is the primary system that maintains data about MFP applicants and participants, including client start and end dates. The DSS eligibility management system maintains client eligibility determinations for the program. The Medicaid Management Information System (MMIS) processes medical services payments and provides financial reports for federal reimbursement claims. Since the My Community Choices web portal does not interface with other systems, DSS staff must manually input client MFP program start and end dates into the DSS eligibility management system. The DSS eligibility management system interfaces with MMIS daily. Criteria Section 6071(b)(2) of Public Law 109-171 defines an eligible individual for the MFP demonstration project as a person who, immediately before beginning participation in the MFP demonstration project, resides in an inpatient facility, receives Medicaid benefits for inpatient services, continues to require the level of care provided in an inpatient facility, and who resides in a qualified residence beginning on the initial date of participation in the demonstration project. Section 6071(b)(7) of Public Law 109-171 defines qualified expenditures by the state under its MFP demonstration project as home and community-based long-term care services for an eligible individual participating in the MFP demonstration project. However, this is only with respect to services furnished during the 12-month period beginning with the individual's discharge date from an inpatient facility. Title 2 U.S. Code of Federal Regulations (CFR) Part 200.403 provides that to be allowable under federal awards, costs should conform to any limitations or exclusions set forth in the federal award. Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal controls over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Title 42 CFR Part 431.420 requires the state to comply with the terms and conditions of the MFP demonstration project. MFP terms and conditions require the state to ensure the availability of adequate resources for implementation and monitoring of the demonstration project including tracking participant enrollment, maintaining eligibility systems, and administering effective transition coordination. MFP terms and conditions require the state to develop and amend an operational protocol that details how the state will adhere to statutory and program requirements. Section B of the MFP Operational Protocol includes the following policies and procedures. • Determining MFP eligibility includes ensuring an individual’s annualized cost of care in the community is equal to or less than the annualized rate paid for residing in an institution. • The state will not provide an administrative hearing to an applicant for denied services due to the applicant’s care plan exceeding the allowable cost of care in the community. • The state will suspend MFP participation and services during any inpatient stay. Suspended MFP participants may continue MFP participation upon discharge from the inpatient facility. Condition We reviewed 40 MFP claims, totaling $49,144, of which $36,858 was federally reimbursed, to determine if DSS properly granted eligibility. Our review disclosed the following: 1. DSS did not terminate MFP participation for two clients. DSS processed $918 for the selected claims for these clients. DSS processed $184,088 in additional claims in fiscal year 2025 and $270,274 in claims in prior fiscal years for periods when these clients were no longer eligible under the MFP program. DSS should have ended participation on April 5, 2018, and July 30, 2020, respectively. 2. DSS processed $7,724 of ineligible MFP expenses for two clients during inpatient hospital or nursing facility stays ranging from 14 to 21 days. DSS did not properly track MFP participation dates for these clients in its systems. Additionally, DSS did not properly track participation dates for a third client for seven days of hospitalization. 3. DSS approved two applicant care plans that exceeded the cost of institutional care by $1,530 (19%) and $3,507 (39%) per month. 4. DSS did not perform or document a comparative cost analysis for one client to demonstrate that care plan costs did not exceed nursing facility costs. Context During the fiscal year ended June 30, 2025, DSS processed $18,243,599 in payments on behalf of 824 MFP clients and received $13,682,699 in federal reimbursement. The sample was not statistically valid. Questioned Costs We computed questioned cost of $347,253 by applying the applicable federal financial participation rate to the ineligible expenditures. Questioned costs were $144,548 for fiscal year 2025 and $202,705 for prior fiscal years. Effect DSS provided MFP benefits to ineligible individuals. DSS received federal reimbursement for unallowed expenditures. Cause The My Community Choices web portal did not interface with DSS eligibility and financial systems. DSS relied on staff to manually input client participation start and end dates in multiple systems. Management oversight did not identify input errors of client participation dates. DSS management overrode applicant care plan costs. The MFP Operational Protocol has no written procedures to override program policies or federal regulations. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls to ensure that only eligible recipients receive Money Follows the Person Rebalancing Demonstration services in accordance with federal laws, award terms and conditions, and the Money Follows the Person Operational Protocol. Views of Responsible Officials “The Department agrees in part with this finding. Condition #1: DSS agrees that participation end dates were not updated timely due to cross-system manual entry limitations. Reconciliation procedures and supervisory oversight will be strengthened. Condition #2: DSS agrees that participation suspensions were not consistently reflected across systems due to timing delays. Monitoring and real-time reconciliation controls will be enhanced. Condition #3: DSS agrees approved costs exceeded institutional thresholds in limited cases. Variances were clinically justified, reviewed, and authorized. DSS will strengthen documentation and internal protocols to ensure clearer policy alignment. Condition #4: DSS agrees that the documentation was incomplete in one instance. Internal review standards will be reinforced to ensure comparative cost analyses are consistently documented. Please note, the Department will not be returning the questioned costs associated with this finding. According to federal regulations, recoveries based on eligibility errors can only be pursued when identified by programs operating under Centers for Medicare and Medicaid Services’ (CMS) Payment Error Rate Measurement program, per section 1903(u) of the Social Security Act and regulations at Title 42 CFR Part 431, Subpart Q.” Auditors’ Concluding Comments The Department of Social Services should amend its MFP Operational Protocol and seek approval from the Centers of Medicare and Medicaid Services if the department plans to continue to use management overrides of care plan costs.

Performance Reporting – Semi-Annual Progress Report and Special Reporting – MFP Work Plan Program Name: Money Follows the Person Rebalancing Demonstration (MFP) (Assistance Listing 93.791) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 1LICMS300142 Criteria The Money Follows the Person (MFP) Rebalancing Demonstration federal award requires the state to provide programmatic reports in accordance with Title 2 U.S. Code of Federal Regulations (CFR) Part 200.301. Title 2 CFR Part 200.301 requires the state to correlate financial data to performance accomplishments of the federal award. The state should also measure performance in a way that will help the United States Department of Health and Human Services (DHHS) and other non-federal entities to improve program outcomes, share lessons learned, and spread the adoption of promising practices. Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal controls over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. MFP terms and conditions require the state to submit a work plan that documents its progress on the use of initiatives designed to increase the use of home and community-based services rather than institutional long-term services and supports. MFP terms and conditions require the state to submit semi-annual progress reports that present the state’s analysis and the status of various operational areas in reaching the objectives of the demonstration. The semi-annual progress report documents the state’s progress in meeting MFP operational procedures and processes, transition benchmarks, and program goals for expanding and enhancing home and community-based services. Title 2 CFR Part 200.334 requires the state to retain financial and programmatic records to support reported information for three years from the date of submission. Condition Our review of the MFP work plan and semi-annual progress report for July 1 to December 31, 2024, disclosed that the Department of Social Services (DSS) did not maintain MFP program data to support figures reported for seven performance objectives in the work plan and 11 performance measures in the semi-annual progress report. Context DSS submitted two semi-annual progress reports and two work plans to DHHS during fiscal year 2025. The sample was not statistically valid. Questioned Costs $0 Effect DSS may have submitted an inaccurate work plan and progress report. DHHS may be using unreliable data to identify promising practices and make future federal program decisions. Cause DSS lacked adequate controls to document and retain MFP data. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls over performance and special reporting for the Money Follows the Person Rebalancing Demonstration to ensure it maintains data to support figures reported to the Department of Health and Human Services. Views of Responsible Officials “The Department agrees with this finding and is taking steps to strengthen internal controls over performance monitoring and special reporting for the Money Follows the Person (MFP) Rebalancing Demonstration. DSS is implementing a secure SharePoint repository to centrally maintain, organize, and track all documentation supporting the MFP Work Plan and the MFP Semi-Annual Report.”

Cash Management Program Name: HIV Care Formula Grants (Ryan White HIV/AIDS Program Part B) (Assistance Listing 93.917) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 6 X07HA00022-34-01 Background The Department of Public Health (DPH) receives rebates for pharmaceuticals and records them as revenue for the Ryan White HIV/AIDS Program Part B to reduce the program’s cash needs. DPH uses a drawdown tool to determine the timing and amount of its federal drawdowns. Criteria Title 31 U.S. Code of Federal Regulations (CFR) Part 205.11(a) provides that a state must minimize the time elapsing between the transfer of funds from the United States Treasury and the state's payout of funds for federal assistance program purposes, whether the transfer occurs before or after the payout of funds. Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal control over federal awards that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition We reviewed DPH’s drawdown tool and determined that it was not effective in monitoring the department’s cash needs. The tool understated expenditures by $29,208,717. As a result, the cash-on-hand amounts were not reliable. Context DPH drew down $8,881,530 for expenditures during the audited period. Questioned Costs $0 Effect Ineffective monitoring of cash needs increases the risk that federal drawdowns will not occur in accordance with the department’s immediate cash requirements to administer the program. Cause A lack of management oversight contributed to the condition. Prior Audit Finding We previously reported this as finding 2024-200. Recommendation The Department of Public Health should strengthen internal controls over cash management to ensure that federal drawdowns align with the immediate cash needs to administer the program. Views of Responsible Officials “We agree with this finding. The Fiscal Department, in collaboration with Management Assurance, has implemented enhanced internal controls to strengthen oversight of cash management activities. Together, the teams developed and formalized enhanced control measures within the Drawdown Tool. These enhancements include daily transaction-level monitoring, integration of rebate offsets, application of a multi-SID tiered allocation structure, and the addition of 90-day liquidation period. The controls have been clearly documented to address identified gaps in operational effectiveness and ensure a balanced approach between automation and manual oversight. This framework provides increased transparency and reliability in managing the timely and accurate drawdown of Ryan White Part B funds while ensuring strong standards and best practices.”

Reporting – Federal Funding Accountability and Transparency Act Program Name: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Assistance Listing 97.036) Federal Award Agency: United States Department of Homeland Security Award Years: Federal Fiscal Years 2020 - 2025 Federal Award Numbers: 4087DRCTP00000001, 4500DRCTP00000001, and 4820DRCTP00000001 Background The Disaster Grants – Public Assistance program provides funding to state and local governments and certain types of private nonprofit organizations so that communities can quickly respond to and recover from presidentially declared disasters and emergencies. The Department of Emergency Services and Public Protection (DESPP) is the primary recipient for the State of Connecticut and is responsible for working with the Federal Emergency Management Agency (FEMA) throughout the disaster response and recovery process. In coordination with FEMA, DESPP receives and distributes funding to subrecipients for all projects within the state. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 CFR Part 170 Appendix A requires that states report any action that obligates $30,000 or more in federal funds for a subaward to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the end of the following month after making the obligation. Recipients are to accurately report key data elements such as subaward numbers, amounts, and obligation dates. As of March 8, 2025, FSRS was retired and all subaward reporting data and functionality are now on the System for Award Management (SAM.gov). Condition DESPP did not establish effective internal controls over Federal Funding Accountability and Transparency Act (FFATA) reporting. The same individual entered subawards into FSRS and SAM.gov and reviewed the entries for accuracy and completeness. There was no documented management review process to verify the accuracy, completeness, and timeliness of FFATA reporting. We randomly selected ten subawards of $30,000 or more, totaling $12,224,700, and identified the following conditions: • DESPP entered two subawards, totaling $435,831, into FSRS 18 and 580 days late. • DESPP did not maintain adequate documentation to support the date it reported two subawards, totaling $9,556,735. As a result, we could not determine if DESPP reported the subawards on time. Transactions Tested Subaward Not Reported Report Not Timely Subaward Amount Incorrect Subaward Missing Key Elements 10 0 2 0 0 Dollar Amount of Tested Transactions Subaward Not Reported Report Not Timely Subaward Amount Incorrect Subaward Missing Key Elements $12,224,700 $0 $435,831 $0 $0 Context During the fiscal year ended June 30, 2025, DESPP made 68 subawards of $30,000 or more, totaling $38,215,595. The sample was not statistically valid. Questioned Costs $0 Effect There is an increased risk for inaccurate, incomplete, and untimely FFATA reporting. Additionally, DESPP decreased its public transparency regarding its spending of federal awards. Cause Management did not adequately monitor the internal control system or promptly remediate internal control deficiencies identified during prior audits, which contributed to the identified conditions. Prior Audit Finding We previously reported this as finding 2024-350 and in three prior audits. Recommendation The Department of Emergency Services and Public Protection should strengthen internal controls and promptly report subawards in compliance with the Federal Funding Accountability and Transparency Act. Views of Responsible Officials “DESPP does not agree with this finding. DESPP utilizes the federally designated FFATA reporting system (SAM.gov) for all FFATA reporting. This system does not possess the capability for any layered review or approval of information prior to upload or post submission. The system has no reporting mechanism to review information input into this system. Further, the system does not maintain capability to track the dates of changes and it records over upload dates at future submission timeframes. These issues have been repeatedly brought to the attention of both SAM.gov administrators at the federal level and DESPP’s FEMA funding agencies. In response to a similar finding by FEMA, DESPP provided the attached information, after which FEMA closed the DESPP finding. DESPP will continue to attempt to work with SAM.gov administrators to advocate for modifications to the FFATA reporting system to address these concerns, but is unable to address them unilaterally without federal agency intervention.” Auditors’ Concluding Comments DESPP should maintain sufficient documentation outside of SAM.gov to demonstrate compliance with reporting requirements and approvals by agency personnel.

Allowable Costs/Cost Principles – Assistance Payments Program Names: COVID-19 Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 VO Program Name: Mainstream Vouchers (Assistance Listing 14.879) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 DVO Background The United States Department of Housing and Urban Development’s (HUD) Section 8 Housing Choice Vouchers Program provides rental assistance to help very low-income families afford decent, safe, and sanitary housing. Section 3202 of the American Rescue Plan Act of 2021 provided for new incremental Emergency Housing Vouchers. Office of Public and Indian Housing (PIH) notice PIH 2021-25 provides that public housing agencies (PHA) should report Emergency Housing Vouchers under the Section 8 Housing Choice Vouchers Program. The Mainstream Vouchers Program enables families to lease affordable private housing when the head, spouse, or co-head is a person with disabilities. Public housing agencies are authorized to administer the programs locally and make housing assistance payments on behalf of eligible families directly to landlords for the lease of suitable program-eligible rental housing. In Connecticut, the programs are administered locally by over 40 public housing agencies and statewide by the Department of Housing (DOH) and its contracted vendor. DOH advances program funds to its contractor that disburses the funds to landlords and participants. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 24 CFR Part 982.158 provides that the PHA must maintain complete and accurate accounts and other records for the program in accordance with HUD requirements, in a manner that permits a prompt and effective audit. Title 24 CFR Part 982.305 provides that the PHA must execute a HAP contract no later than 60 calendar days from the beginning of the lease term. The PHA must not pay any housing assistance payment to the owner until it has executed the contract. If the PHA executes the HAP contract during the period of 60 calendar days from the beginning of the lease term, it will pay housing assistance payments after the execution of the HAP contract. Any HAP contract executed after the 60-day period is void, and the PHA may not pay any housing assistance payment to the owner. Title 24 CFR Part 982.503 requires the PHA to adopt a payment standard schedule that establishes voucher payment standard amounts for each fair market rent area in the PHA jurisdiction. For each fair market rent area, the PHA must establish payment standard amounts for each unit size. Unit size is measured by the number of bedrooms. Title 24 CFR Part 982.505 states that a payment standard is used to calculate the monthly housing assistance payment for a family. The payment standard for the family is the lower of the payment standard amount for the family unit size or the payment standard amount for the size of the dwelling unit rented by the family. Title 24 CFR Part 982.516 requires the PHA to conduct a reexamination of family income and composition at least annually. The PHA must obtain and document in the tenant file third-party verifications of reported family annual income, the value of assets, expenses related to deductions from annual income, and other factors that affect the determination of adjusted income, or must document why third-party verification was not available. At the effective date of a regular or interim reexamination, the PHA must make appropriate adjustments in the HAP. Title 24 CFR Part 982.517 requires the PHA to maintain a utility allowance schedule for all tenant-paid utilities (except telephone), for tenant supplied refrigerators and ranges, and for other tenant paid housing services (e.g., trash collection). The utility allowance schedule must be determined based on the typical cost of utilities and services paid by energy-conservative households that occupy housing of similar size and type in the same locality. The PHA must review its schedule each year and must revise its allowance for a utility category if there has been a change of ten percent or more in the utility rate since the last time the utility schedule was revised. Condition Our review of 60 housing assistance payments and utility reimbursements, totaling $99,286 and $2,813, respectively, disclosed that in 14 cases, payments were incorrectly calculated. Some cases had multiple errors. • In two cases, the PHA incorrectly calculated the tenant’s total annual adjusted income. • In eight cases, the PHA incorrectly calculated the tenant’s total annual income. • In three cases, the PHA did not use the correct payment standard. • In two cases, the PHA incorrectly calculated the utility allowance or did not use the correct utility allowance schedule. These errors resulted in $1,211 in housing assistance and utility reimbursement overpayments and $49 in underpayments for the tested benefit months. Further review noted an additional $8,495 in housing assistance and utility reimbursement overpayments, and $379 in underpayments during the audited period. We also noted that in two cases, the PHA paid $37,233 under housing assistance payment contracts that were void because they were not executed within 60 calendar days from the beginning of the lease term. Context During the fiscal year ended June 30, 2025, housing assistance payment transactions and utility reimbursements for the Section 8 Housing Choice Vouchers and Mainstream Vouchers programs totaled $127,656,361. The sample was not statistically valid. Questioned Costs Our review identified questioned costs totaling $41,491 for the Section 8 Housing Choice Vouchers program. Effect DOH has reduced assurance of the accuracy of housing assistance payments and utility reimbursements. Cause The conditions are due to a lack of management oversight. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Housing should strengthen internal controls to ensure that it properly calculates Section 8 Housing Choice Vouchers and Mainstream Vouchers housing assistance and utility benefit payments. Views of Responsible Officials “We agree with the finding. DOH did contract with a third-party entity to provide these services; however, DOH retains overall responsibility for the program. Recently, DOH established a Section 8 division within DOH to provide more oversight over the program and the contactor. We are working closely with the contractor to strengthen their internal control, develop policies and procedures. DOH will continue collaborating with the contractor to enhance system controls and minimize the risk of future issues. All identified errors in this finding have been corrected including the questionable cost, and the software now includes a new feature designed to prevent similar problems going forward. DOH remains committed to continuous improvement and effective oversight of the program and contractor.”

Eligibility Program Names: COVID-19 Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 VO Program Name: Mainstream Vouchers (Assistance Listing 14.879) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 DVO Background The United States Department of Housing and Urban Development’s (HUD) Section 8 Housing Choice Vouchers Program provides rental assistance to help very low-income families afford decent, safe, and sanitary housing. Section 3202 of the American Rescue Plan Act of 2021 provided for new incremental Emergency Housing Vouchers. Office of Public and Indian Housing (PIH) notice PIH 2021-25 provides that public housing agencies (PHA) should report Emergency Housing Vouchers under the Section 8 Housing Choice Vouchers Program. The Mainstream Vouchers Program enables families to lease affordable private housing when the head, spouse, or co-head is a person with disabilities. Public housing agencies are authorized to administer the programs locally and make housing assistance payments on behalf of eligible families directly to landlords for the lease of suitable program-eligible rental housing. In Connecticut, the programs are administered locally by over 40 public housing agencies and statewide by the Department of Housing (DOH) and its contracted vendor. DOH advances program funds to its contractor that disburses the funds to landlords and participants. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 24 CFR Part 982.158 provides that the PHA must maintain complete and accurate accounts and other records for the program in accordance with HUD requirements, in a manner that permits a prompt and effective audit. Title 24 CFR Part 5.233 requires PHAs to use the Enterprise Income Verification system in its entirety as a third-party source to verify tenant employment and income information during mandatory reexaminations of family compositions and income. Office of Public and Indian Housing (PIH) notice PIH 2018-18 provides that PHAs maintain the report and documentation of any follow up in the tenant file. The PHAs are also required to maintain copies of the Enterprise Income Verification income and Income Validation Tool reports used to confirm family reported income within 120 days of the Inventory Management Public and Indian Housing Information Center submission date. Office of Public and Indian Housing (PIH) notice PIH 2012-28 provides that PHAs adopt procedures at admission and at annual recertification/reexamination to prevent lifetime registered sex offenders from receiving federal housing assistance. If the tenant or a member of the tenant’s household engages in criminal activity (including sex offenses) while living in HUD-assisted housing, the PHA should pursue eviction or termination. Condition Our review of 60 housing assistance payments and utility reimbursements, totaling $99,286 and $2,813, respectively, disclosed the following: · In four cases, the PHA did not have Income Validation Tool reports on file to support tenant employment and income. · In two cases, the PHA did not receive all required source documents prior to completing the initial/annual reexaminations. · In one case, the PHA did not verify the tenant’s employment and income noted on the Income Validation Tool. · In one case, the PHA did not verify household members were not lifetime registered sex offenders or check their criminal record during the annual reexamination. Context During the fiscal year ended June 30, 2025, housing assistance payment transactions and utility reimbursements for the Section 8 Housing Choice Vouchers and Mainstream Vouchers programs totaled $127,656,361. The sample was not statistically valid. Questioned Costs $0 Effect There is an increased risk that DOH provides financial assistance to ineligible individuals. Cause The conditions are due to a lack of management oversight. Prior Audit Finding We previously reported this as finding 2024-727 and in two prior audits. Recommendation The Department of Housing should properly monitor its contractor to ensure that it only awards benefits to eligible recipients. Views of Responsible Officials “We agree with the finding. DOH did contract with a third-party entity to provide these services. The contractor has been experiencing technical difficulties accessing the HUD system. We are aware of this current situation, and we are working with HUD to resolve this issue as soon as possible. “

Special Tests and Provisions – Housing Assistance Payments Program Names: COVID-19 Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 VO Program Name: Mainstream Vouchers (Assistance Listing 14.879) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 DVO Background The United States Department of Housing and Urban Development’s (HUD) Section 8 Housing Choice Vouchers Program provides rental assistance to help very low-income families afford decent, safe, and sanitary housing. Section 3202 of the American Rescue Plan Act of 2021 provided for new incremental Emergency Housing Vouchers. Office of Public and Indian Housing (PIH) notice PIH 2021-25 provides that public housing agencies (PHA) should report Emergency Housing Vouchers under the Section 8 Housing Choice Vouchers Program. The Mainstream Vouchers Program enables families to lease affordable private housing when the head, spouse, or co-head is a person with disabilities. Public housing agencies are authorized to administer the programs locally and make housing assistance payments on behalf of eligible families directly to landlords for the lease of suitable program-eligible rental housing. In Connecticut, the programs are administered locally by over 40 public housing agencies and statewide by the Department of Housing (DOH) and its contracted vendor. DOH advances program funds to its contractor that disburses the funds to landlords and participants. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 24 CFR Part 982.158 provides that the PHA must maintain complete and accurate accounts and other records for the program in accordance with HUD requirements, in a manner that permits a prompt and effective audit. Title 24 CFR Part 982.516 requires the PHA to conduct a reexamination of family income and composition at least annually. The PHA must obtain and document in the tenant file third-party verifications of reported family annual income, the value of assets, expenses related to deductions from annual income, and other factors that affect the determination of adjusted income, or must document why third-party verification was not available. At the effective date of a regular or interim reexamination, the PHA must make appropriate adjustments in the HAP. Condition Our review of ten housing assistance payments and utility reimbursements totaling $17,721 and $351, respectively, disclosed that in one case, the PHA incorrectly calculated the payment. The PHA incorrectly calculated the tenant’s total annual income and total allowance/deductions. These errors resulted in an overpayment of $49 for the tested benefit month. Context During the fiscal year ended June 30, 2025, housing assistance payment transactions and utility reimbursements for the Section 8 Housing Choice Vouchers and Mainstream Vouchers programs totaled $127,656,361. The sample was not statistically valid. Questioned Costs Our review identified questioned costs totaling $49 for the Section 8 Housing Choice Vouchers program. Effect DOH has reduced assurance of the accuracy of housing assistance payments and utility reimbursements. Cause The condition was due to a lack of management oversight. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Housing should strengthen internal controls to ensure that it properly calculates and supports Section 8 Housing Choice Vouchers and Mainstream Vouchers housing assistance and utility benefit payments. Views of Responsible Officials “We agree with the finding. DOH did contract with a third-party entity to provide these services; however, DOH retains overall responsibility for the program. Recently, DOH established a Section 8 division within DOH to provide more oversight over the program and contactor. We are working closely with the contractor to strengthen their internal control, develop policies and procedures. DOH will continue collaborating with the contractor to enhance system controls and minimize the risk of future issues. All identified errors in this finding have been corrected including the questionable cost. DOH remains committed to continuous improvement and effective oversight of the program and contractor. “