Findings Citing § 200.303

Reference Number: 2025-010 Prior Year Finding: 2024-004 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: State Workforce Agencies (SWA) responsibilities include: (1) establishing specific, detailed policies and operating procedures which comply with the requirements of federal laws and regulations; (2) determining the state Unemployment Insurance (UI) tax structure; (3) collecting state UI contributions from employers (commonly called “unemployment taxes”); (4) determining claimant eligibility and disqualification provisions; (5) making payment of UI benefits to claimants; (6) managing the program’s revenue and benefit administrative functions; (7) administering the programs in accordance with established policies and procedures; and (8) enacting state unemployment compensation (UC) law that conforms with federal UC law. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) did not maintain documentation supporting claimant eligibility and did not properly set up claimants to recoup overpayments. Context Sixty claimants were selected for testing, and the following exceptions were noted: • For 3 of 60 claimants, the Division was unable to provide documentation that the claimant provided weekly updates. • 2 of 60 claimants were not properly set up to recoup overpayments. One claimant was determined to be ineligible, but benefits were paid. One claimant was initially determined to be eligible, but after the employer appealed the claim, the claimant was determined to be ineligible. Neither claimant was properly set up to recoup the overpayments. • For 1 of 60 claimants, documentation could not be provided that the Division contacted the employer to verify the claimant’s employment status. Questioned Costs Undetermined. Cause The Division’s procedures and internal controls were not sufficient to ensure that documentation to support claimant eligibility was retained nor that claimants were properly set up to recoup overpayments. Effect The Division did not recoup benefits paid to claimants which were determined to be ineligible. Failure to maintain eligibility documentation could allow benefits to be paid to ineligible claimants. Recommendation The Division should review and enhance procedures and controls to ensure that claimant eligibility is properly determined, that documentation supporting claimant eligibility is retained, and that documentation is readily available for audit. Views of Responsible Officials For 3 of 60 claimants, the Division was unable to provide documentation that the claimant provided weekly updates. These cases (sample 2,7 and 36) relate to claimant weekly certifications and their responses to required eligibility questions for the applicable benefit weeks. Due to existing mainframe system limitations, the Division does not have the ability to directly view all claimant responses within the system interface. In preparation for the CLA review, Application Support generated a comprehensive report capturing weekly certification responses for all sampled claimants, based on Social Security Numbers. However, three claimants did not appear on this report, and therefore their responses could not be verified at the time of review. The Division has identified both short-term and long-term corrective actions to address this discrepancy: • Short-term solution: A service ticket has been submitted to the Application Support team to investigate and resolve the issue that caused these claimants to be excluded from the report. Once resolved, future reports are expected to consistently capture all claimant responses associated with weekly certifications. • Long-term solution: The Division recognizes the need for a modernized system to improve the efficiency and reliability of claims processing and adjudication. Current case management systems are outdated and have limited functionality. Implementation of an updated system will allow for automated capture of weekly certification responses, improved data accessibility, and enhanced identification of potential compliance issues requiring investigation.

Reference Number: 2025-011 Prior Year Finding: 2024-012 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Reporting – ETA 9130, Financial Status Report, UI Programs Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: The ETA 9130-Financial Status Report, UI Programs report is used to report program and administrative expenditures. All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UA Projects (administration and benefits). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) submitted ETA 9130 reports that did not agree with supporting documentation. Context Eight of forty-four ETA 9130 reports selected for testing did not agree with supporting documentation and auditors were unable to verify the accuracy of the reports. Specifically, we noted the following: • 5 of 24 reports selected from the 9/30/2024 quarter did not agree with supporting documentation. • 3 of 20 reports selected from the 3/31/2025 quarter did not agree with supporting documentation. Questioned Costs Undetermined. Cause The Division’s procedures were not sufficient to ensure that reports submitted agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect ETA 9130 reports did not agree with supporting documentation. Recommendation We recommend the Division review and enhance procedures and internal controls to ensure that ETA 9130 reports agree with supporting documentation and that documentation is maintained and is readily available for audit. Views of Responsible Officials We acknowledge the audit finding that several ETA 9130 reports did not agree with the supporting documentation. Procedures have been implemented to ensure documentation used to complete the ETA 9130 reports are reviewed by both the Certifying and Approving Officials before final sign off. Procedures will be documented and saved for ease of retrieval and use. Backup will be saved in clearly marked folders on our Fiscal drive for ease of retrieval.

Reference Number: 2025-012 Prior Year Finding: 2024-006 Federal Agency: U.S. Department of Labor State Department Name: Department of Labor State Division: Division of Unemployment Insurance Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372152255A10 (10/1/2021 – 12/31/2024) UI393142355A10 (10/1/2022 – 12/31/2025) 24A55UI000067 (10/1/2023 – 12/31/2026) 25A55UI000116 (1/1/2024 – 12/31/2027) Compliance Requirement: Special Tests and Provisions – Employer Experience Rating Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement Compliance: Certain benefits accrue to states and employers as a result of the state having a federally approved experience-rated UI tax system. All states currently have an approved system. For the purpose of proper administration of the system, the State Workforce Agency (SWA) maintains accounts, or subsidiary ledgers, on a state UI taxes received or due from individual employers, and the UI benefits charged to the employer. The employer’s “experience” with the unemployment of former employees is the dominant factor in the SWA computation of the employer’s annual state UI tax rate. The computation of the employer’s annual tax rate is based on state UI law (26 USC 3303). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Unemployment Insurance (Division) did not apply the correct employer experience rate for an employer. Context For one of sixty employers selected for testing, due to a manual error, the Division improperly applied the employer experience rate using the 2013 new employer rate instead of the 2023 new employer rate. Questioned Costs Undetermined. Cause The Division’s procedures and controls were not sufficient to ensure that it applied the proper employer experience rate. Effect The Division incorrectly applied the employer experience rate to an employer. Recommendation The Division should review and enhance procedures and controls to ensure that employer experience rates are properly calculated and applied. Views of Responsible Officials We disagree with the finding as we believe the employer’s account effective date and liability status were established in accordance with the applicable state UI laws and regulations. Documentation can be provided to substantiate this determination. Account# 69821 was established in November of 2024 with a liability date of 04/2013 per employer’s application on file, which gave the employer a new employer rate of 2.8. After my discussion with the auditor on 3/19/26, I pulled the folder to further investigate. Based on this review, we conclude that the rate assignment was accurate and compliant, and therefore the finding appears to be based on a misunderstanding of the employer’s account status or the applicable rate criteria. The business already implemented a corrective action plan in 2025 which entailed changing how the calculation is performed. This calculation is now done outside of the Mainframe system in compliance with Title 19 rules with results uploaded into the system after calculation. The UI program successfully provided an auditable population for calendar year 2025. Auditor Rejoinder On January 26, 2026, auditors met with the UI Tax Administrator and Fiscal Analyst to discuss the Employer Experience rate assignment of 2.8% for Account #69821. Auditors reviewed state law HB433 and the ETA handbook requirements noting that all new employers added will receive an experience rate of 1.2%, or experienced employers will receive .6% if its benefit wage ratio does not exceed 20%. The UI Tax Administrator confirmed to auditors that the liability date of April 26, 2013, was entered in error instead of April 26, 2023, which caused the 2013 rate of 2.8% to be input into the employer experience rating letter sent to the employer. As documented in the guidance, there is no current benefit wage ratio calculation that would result in an employer experience rating of 2.8%.

Reference Number: 2025-013 Prior Year Finding: 2024-013 Federal Agency: U.S. Department of the Treasury State Department Name: Office of the Governor Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP0139 (3/3/2021 – 12/31/2024) SLFRP2629 (3/3/2021 – 12/31/2024) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per the Compliance and Reporting Guidance issued by the Department of the Treasury (Treasury), recipients must submit quarterly Project and Expenditure Reports. Required project information includes current period obligation, cumulative obligation, current period expenditure, cumulative expenditure, and capital project information. Per 31 CFR §35.6(b)(4), a recipient, other than a Tribal government, must prepare and submit written justifications for projects with capital expenditures enumerated by Treasury in the final rule and with total capital expenditures greater than $10 million. For projects with capital expenditures greater than or equal to $1 million but less than $10 million, written justifications must be maintained in project files. Such written justifications must include the following elements: (i) Describe the harm or need to be addressed; (ii) Explain why a capital expenditure is appropriate; and (iii) Compare the proposed capital expenditure to at least two alternative capital expenditures and demonstrate why the proposed capital expenditure is superior. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition Capital project justifications reported and/or maintained in project files did not include all required elements. Context The Office of the Governor (Office) prepares and submits quarterly Project and Expenditure Reports. Eight projects with capital expenditures greater than or equal to $1 million were selected for testing on the September 30, 2024 and December 31, 2024 quarterly reports. Projects selected consisted of four with capital expenditures greater than or equal to $10 million and four with capital expenditures less than $10 million. The following exceptions were noted: • For 1 of 4 projects greater than or equal to $10 million, the reported capital project justification did not include required elements (ii) or (iii). • For 2 of 4 projects greater than or equal to $10 million reported capital project justifications did not include required element (iii). • For 1 of 4 projects less than $10 million, the capital project justification maintained in the project file did not include required element (iii). Cause The Office’s procedures and internal controls were not operating effectively to ensure that capital project justifications reported or maintained in project files contained all required elements. Effect Capital project justifications are intended to demonstrate that each capital project over $1 million is the best and proper use of program funds for the intended purpose. Failure to ensure capital project justifications include all required elements could allow a capital project to be initiated that is not in the best interest of the program or the best use of program funds. Questioned Costs Undetermined. Recommendation We recommend that the Office enhance procedures and internal controls to ensure that it reports and/or maintains in project files capital project justifications that contain all required elements. The Office should provide training of State agency personnel and conduct periodic reviews of written capital project justifications to ensure that they comply with program requirements. Views of Responsible Officials The ARPA team acknowledges that the repeat finding related to capital project justifications resulted from gaps in enforcement and follow-up procedures with state agencies. While guidance was provided, the team did not consistently ensure that complete and compliant capital project justifications were obtained and reviewed prior to reporting. Contributing factors included limited staffing resources also impacted agencies’ ability to provide complete historical information for projects initiated in prior reporting periods. In several cases, agency personnel responsible for original project justifications were no longer available, making it more difficult to obtain sufficient documentation to meet Treasury requirements. However, the ARPA team recognizes that these challenges do not mitigate the responsibility to ensure compliance with reporting requirements. To address this, the ARPA team will implement enhanced controls to ensure compliance with capital project justification requirements. These include requiring complete justifications prior to reporting, use of a standardized template and review checklist, and a formal second-level review process to verify completeness and accuracy. In addition, the team will maintain centralized tracking of all submissions, implement formal escalation procedures for nonresponsive agencies, and provide ongoing training and guidance, including support for new agency personnel. Periodic compliance reviews will also be conducted to ensure continued adherence to program requirements.

Reference Number: 2025-014 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Department Name: Division of Libraries Federal Program: COVID-19 – Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Award Number and Year: CPFFN0144 (2/4/2022 – 12/31/2026) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per 2 CFR section 200.317 Procurements by states, when procuring property and services under a Federal award, a state must follow the same policies and procedures it uses for procurements from its non-Federal funds. Per 29 Del C. Chapter 69, section 6981 Large professional service procurement process: (a) Any state contract for which an agency is a party with probable fees, including reimbursable expenses and amendments, greater than the threshold amount or amounts established by the Contracting and Purchasing Advisory Council pursuant to § 6913 of this title for the completed job will be subject to the provisions of this subchapter. (b) Each agency shall publicly announce, not less than once a week for two consecutive weeks in a newspaper published or circulated in each county of the State, when professional services are required (c) Each agency shall publicly announce each professional services contract subject to subsection (a) of this section by electronic publication accessible to the public in a manner prescribed pursuant to § 6902(9) of this title for two consecutive weeks. (d) Such announcement shall include: (1) The project identification; (2) General description and scope of the project; (3) Location; (4) Deadline for submission of brief letters of interest; (5) Criteria for selection of professionals including any special criteria required for any particular project; (6) Indication of how interested professionals can apply for consideration; (7) The agency's intention to award to more than one firm, if applicable; and (8) A description of the selection process to be used, as defined in § 6982 of this title. (f) Each agency shall establish written administrative procedures for the evaluation of applicants. These administrative procedures shall be adopted and made available to the public by each agency before publicly announcing an occasion when professional services are required. One or more of the following criteria may be utilized in ranking the applicants under consideration: (1) Experience and reputation; (2) Expertise (for the particular project under consideration); (3) Capacity to meet requirements (size, financial condition, etc.); (4) Location (geographical); (5) Demonstrated ability; (6) Familiarity with public work and its requirements; or (7) Distribution of work to individuals and firms or economic considerations. (g) In addition to the above, other criteria necessary for a quality, cost-effective project may be utilized. (h) Each project shall be given individual attention, and a weighted average may be applied to criteria according to its importance to each project. (i) For the selection process described in § 6982(b) of this title, price may be a criteria used to rank applicants under consideration. Per 29 Del C. Chapter 69, section 6982 Selection: (a) Agencies shall use the selection process described in paragraphs (b)(1) through (3) of this section. (1) Based upon the criteria established pursuant to § 6981(f) of this title, the agency shall determine all applicants that meet the minimum qualifications to perform the required services. (2) The agency shall then interview at least one of the qualified firms. The agency may negotiate with one firm without terminating negotiations with another firm and may negotiate with one or more firms during the same period. At any point in the negotiation process, the agency may, at its discretion, terminate negotiations with any or all firms. (3) The agency may require the firm with whom the agency is negotiating to execute a truth-in-negotiation certificate stating the wage rates and other factual unit costs supporting the compensation are accurate, complete and current at the time of contracting. All professional service contracts shall provide that the original contract price and any additions thereto shall be adjusted to exclude significant sums where the agency determines the contract price was increased due to inaccurate, incomplete or noncurrent wage rates and other factual unit costs. All such contract adjustments shall be made within one year following the end of the contract. Sole source procurement shall be avoided, except when no reasonable alternative sources exist. A written determination by the agency for the sole source procurement shall be included in the agency's contract file. (29 Del. C. §6904(i)) Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Libraries (Division) was unable to provide evidence that it had procured a contract in accordance with the State’s procurement policies. Context For one of five contracts selected for testing, the Division was unable to provide supporting documentation that it had procured the contract in accordance with the State’s procurement policies. Questioned Costs Undetermined. Cause The Division’s internal controls were not sufficient to ensure that federal and statewide procurement policies were followed for purchases made for the program. Effect Failure to adhere to procurement policies and procedures may result in the contract being issued under terms and conditions that are not in the best interest of the federal program and/or the State. Recommendation The Division should review and enhance controls and procedures to ensure that it follows the State’s procurement policies for all contracts charged to the program. Views of Responsible Officials The Department of State, Division of Libraries disputes the audit finding of “significant deficiency in internal control over compliance, other matters” on the basis that Title 29, Chapter 69 of the Delaware Code is inapplicable and exempts the purchase of services by libraries from the State procurement process, including construction. Without admission to any deficiency in the Division’s “internal control over compliance, other matters,” the Division of Libraries will review all internal controls and procedures to ensure compliance with the State’s procurement process. Auditor Rejoinder Auditors acknowledge that Title 29, Chapter 69(d) of the Delaware Code includes exemptions related to libraries. Specifically, it states: “This chapter shall not apply to any purchase of library materials such as books, periodicals, subscriptions and software by libraries of any agency, nor shall this chapter apply to the purchase of services by libraries of any agency pursuant to Chapter 66 of this title.” Library services is further defined in Title 29, Chapter 66, §6602(a), Contracting for library services, which states the following: “In order to encourage the maintenance and development of proper standards, including personnel standards, hours of operation, library materials, collection standards and interlibrary resource sharing, and to provide for the development of statewide public library service, the Delaware Division of Libraries may contract with any public library, including privately incorporated public libraries or public library systems established pursuant to Chapter 8 of Title 9, which qualifies under standards established by the Division with the approval of the Delaware Council on Libraries, to provide library services.” Furthermore, Title 29, Chapter 66A, establishes requirements regarding library construction which includes a provision for proposal review and does not exempt such projects from following established procurement policies. The contract identified by auditors in this finding is a $22 million contract for “management and construction services for the North Wilmington Library Think Do (“Project”)”. Auditors believe the scope and nature of this agreement does not fall under the exemptions established for library services under Title 29, Chapter 69(d) of the Delaware Code. The Division was unable to provide auditors with documentation that it had followed established procurement procedures when it entered into this agreement.

Reference Number: 2025-015 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Department Name: Office of the Governor Federal Program: COVID-19 – Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Award Number and Year: CPFFN0144 (2/4/2022 – 12/31/2026) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per the CPF State Guidance issued by the Department of the Treasury (Treasury), recipients must submit quarterly Project and Expenditure Reports. Required project information includes current and cumulative obligations and expenditure and other information applicable to each specific category of project. For Multi-Purpose Community Facility Projects, recipients must report planned and actual square footage funded by CPF. Reported square footage must be within 10% of the square footage included in supporting documentation. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Office of the Governor (Office) reported square footage for a project that varied by more than 10% of the amount included in supporting documentation. Context Eight projects categorized as Multi-Purpose Community Facility Projects were selected for testing from the September 30, 2024 and March 31, 2025 quarterly reports. For one of eight projects selected, the planned square footage reported varied by more than 10% of the planned square footage maintained in project files. The square footage in project files was 11,000, but the amount reported was 18,000 which is a variance of 64%. Auditors noted the same amount was reported in both quarters tested. Cause Procedures and internal controls were not operating effectively to ensure that square footage reported agreed with supporting documentation. Effect Reported square footage did not agree with supporting documentation and the variance exceeded 10%. Questioned Costs None noted. Recommendation We recommend that the Office enhance its procedures and internal controls to ensure that reported square footage agrees with supporting documentation. Views of Responsible Officials The ARPA team acknowledges that the discrepancy in reported square footage resulted from a data entry error and insufficient controls to ensure that updates to project data were reflected in subsequent reporting periods. To address this, the team has implemented enhanced data validation procedures, including reconciliation of reported data to supporting documentation each reporting period, formal tracking of changes to project data, and a secondary review of key data elements prior to submission. Ongoing monitoring will be performed to ensure continued accuracy and consistency across reporting periods.

Reference Number: 2025-016 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: NU50CK000497 (8/1/2019 – 7/31/2027) NU51CK000334 (8/1/2024 – 7/31/2029) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Public Health (Division) inaccurately charged payroll costs to the program. Context For one of forty time sheets selected for testing, the employee’s time and effort certification indicated that 50% of the employee’s time was spent on the program, but 100% of the employee’s time was charged. Questioned Costs $1,742, the amount charged to the program in error. Cause Controls were not operating effectively to ensure that time and effort reporting was performed accurately. Effect Unallowed payroll costs were charged to the program. Recommendation The Division should reevaluate its current process, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials ELC Financial Lead will work with DPH Support Services to track all recoded time against grant. As recodes are identified, time certifications for affected staff will need to be revised and filed appropriately.

Reference Number: 2025-017 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Social Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 2501DETANF (10/1/2024 – 9/30/2025) 2401DETANF (10/1/2023 – 9/30/2024) 2301DETANF (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity’s written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Social Services (Division) did not have evidence of that employee time charged to the program was properly documented. Context Forty timesheets were selected for testing, and the following exceptions were noted: • 17 of 40 timesheets selected for testing could not be provided to auditors for testing. • 14 of 40 timesheets selected for testing were not certified timely by a program supervisor. The timesheets were certified several months after the end of the pay period. • 1 of 40 timesheets selected for testing was not certified by a program supervisor. Questioned Costs Undetermined. Cause The Division’s controls are not sufficient to ensure that time and effort reporting is performed and documented in accordance with federal requirements. Effect Employee time charged to the program could not be verified and there is an increased risk of charging unallowed payroll costs to the program. Recommendation The Division should enhance procedures, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials The following action will be taken to improve the current process. • The Fiscal unit is implementing procedures to serve as the central repository for all Time and Effort records, replacing the current practice of storing these forms at the program manager level. • Implement internal controls for Time and Effort Reporting. • Confirm that T&E information submitted is accurate and reconciled. • Provide training for Time & Effort certification.

Reference Number: 2025-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Children’s Health Insurance Program Assistance Listing Number: 93.767 Award Number and Year: SAI000005399 (10/1/2023 – 9/30/2024) Compliance Requirement: Period of Performance Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: A non-Federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) was unable to provide evidence that expenditures were incurred during the grant’s allowable period of performance. Context Forty disbursement transactions recorded during September and October 2024 were selected for testing. For forty of forty transactions selected, the Division was unable to provide documentation that the costs were incurred during the grant’s period of performance. Cause The Division’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect Costs could be deemed unallowable by the awarding agency if funds are expended and/or obligated outside of the allowable period of performance. Questioned Costs Undetermined. Recommendation The Division should review and enhance its procedures and internal controls to ensure that it maintains documentation that expenditures charged to the program are incurred within an award’s allowable period of performance. Views of Responsible Officials To prevent recurrence, we are implementing the following actions: 1. Enhanced Monitoring Controls o Establish a centralized tracking system for all awards, including start and end dates. 2. Staff Training and Accountability o Conduct mandatory training for program and finance staff on compliance with period of performance requirements. o Assign clear responsibility for monitoring award timelines to designated personnel. 3. Pre-Closeout Review Process o Introduce a formal pre-closeout review 60 days before the award end date to identify and resolve outstanding obligations. o Require certification from both program and finance leads confirming that all expenditures fall within the allowable period. 4. Post-Expenditure Review o Perform monthly reconciliation of expenditures against the period of performance. o Immediately flag and correct any discrepancies identified.

Reference Number: 2025-022 Prior Year Finding: 2024-023 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2405DE5MAP (10/1/2023 – 9/30/2024) 2505DE5MAP (10/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions – Provider Health and Safety Standards Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. Context For thirty-six of sixty providers selected for testing, the Division was unable to provide evidence that the provider complied with health and safety standards. Questioned Costs Undetermined. Cause The Division’s procedures and controls were not sufficient to ensure that it maintained documentation that providers met the program’s health and safety requirements. Effect Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Recommendation The Division should reevaluate its current process and perform additional training to ensure documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of Responsible Officials DMMA will review the process of storing all data for provider’s screening and credentialing information. In addition, when a provider enrolls or revalidates into DMAP, they will be required to submit updated credentials and license information.

Reference Number: 2025-023 Prior Year Finding: 2024-022 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Children’s Health Insurance Program, Medicaid Cluster Assistance Listing Number: 93.767, 93.775, 93.777, 93.778 Award Number and Year: 2405DE5021 (10/1/2023 – 9/30/2025) 2505DE5021 (10/1/2024 – 9/30/2026) 2405DE5MAP (10/1/2023 – 9/30/2024) 2505DE5MAP (10/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions – Managed Care Financial Audit Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Two types of audits are required for managed care: 1. Audited Financial Reports – The contract with each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)). 2. Periodic Audits – Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) was unable to provide documentation that it had posted results of managed care financial audits on its website. Context For three of three MCOs within the state, the Division did not post the results of the audits on its website. Questioned Costs None noted. Cause The Division’s procedures and controls were not sufficient to ensure that the results of MCO independent audits were posted to its website once completed. Effect The Division is not in compliance with the transparency requirements regarding MCO independent audits. Recommendation The Division should implement procedures and controls to ensure that it posts the results of independent audits to its website once completed, as required. Views of Responsible Officials DMMA will review the procedures and provide additional training for staff to ensure each MCO has had an audit, obtain copies of the audit, reviews the results, and post the results of the audit on the website.

Reference Number: 2025-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Medicaid and Medical Assistance Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2405DE5MAP (10/1/2023 – 9/30/2024) 2505DE5MAP (10/1/2024 – 9/30/2025) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Medicaid and Medical Assistance (Division) did not maintain documentation supporting participant eligibility. Context For two of forty participants selected for testing, the Division did not maintain copies of the application, case comments, and/or renewal determination for the participants. Questioned Costs Undetermined. Cause The Division’s procedures and controls were not sufficient to ensure that it maintained documentation supporting participant eligibility. Effect Failure to maintain eligibility documentation could result in ineligible participants receiving benefits under the program. Recommendation The Division should implement procedures and controls to ensure that it maintains documentation supporting participant eligibility and this documentation should be readily available for audit. Views of Responsible Officials The Division of Medicaid and Medical Assistance (DMMA) in partnership with the Division of Social Services (DSS) will provide training for determination of member eligibility. DSS will also ensure supporting participant eligibility documentation is properly maintained.

Reference Number: 2025-025 Prior Year Finding: 2024-024 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Substance Abuse and Mental Health Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: H79TI085764 (9/30/2022 – 9/29/2024) 6H79TI085764 (9/30/2023 – 9/29/2025) 5H79TI083305 (9/30/2024 – 9/29/2027) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition Timesheets provided by the Division of Substance Abuse and Mental Health (Division) were not reviewed and approved timely by a supervisor. Context 16 of 28 timesheets selected for testing were not certified timely by a program supervisor. The timesheets were certified several months after the end of the pay period. Questioned Costs Undetermined. Cause The Division’s controls are not sufficient to ensure that time and effort reporting is performed and documented in a timely manner, in accordance with federal requirements. Effect There is an increased risk of charging unallowed payroll costs to the program. Recommendation The Division should enhance procedures, implement proper controls, and perform additional training over time and effort reporting. The Division should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit. Views of Responsible Officials The Division evaluated the developed process and implemented controls for completion of the process within 60 days with added monitoring roles for accuracy and timeliness. The Division will be performing training for assigned staff, monitoring completion and will continue to improve the process for efficiency and compliance.

Reference Number: 2025-026 Prior Year Finding: 2024-025 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Substance Abuse and Mental Health Federal Program: Opioid STR Assistance Listing Number: 93.788 Award Number and Year: H79TI085764 (9/30/2022 – 9/29/2024) 6H79TI085764 (9/30/2023 – 9/29/2025) 5H79TI083305 (9/30/2024 – 9/29/2027) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Substance Abuse and Mental Health (Division) did not report required subaward information per FFATA requirements. Context Five of eleven subawards selected for testing were not reported timely per FFATA requirements. One subaward was issued on 9/22/2024 and has not been reported to SAM.gov. Four subawards were not reported timely and were reported 1 to 118 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause The Division’s policies and procedures were not sufficient to ensure that required subaward information was reported accurately no later than the end of the month following the date the subaward was issued. Internal controls did not prevent or detect the errors. Effect Subawards were not reported in accordance with FFATA requirements. Questioned Costs None noted. Recommendation We recommend that the Division develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Division develop controls and procedures to ensure that all required subawards are reported accurately and timely SAM.gov. Views of Responsible Officials The Division has reviewed the FFATA reporting requirements and evaluated the procedures in place for identifying and reporting subawards in SAM.gov. During the audit period, the Division relied on existing processes that did not include a formalized secondary review to ensure all reportable subawards were submitted within the required timeframe. In response to this finding, the Division has implemented enhanced internal controls and monitoring procedures to ensure compliance with FFATA reporting requirements. These actions include: • Development of a standardized FFATA tracking log to monitor all subawards issued under applicable federal programs. • Implementation of a secondary review process to verify that all reportable subawards meeting FFATA thresholds are identified and submitted in SAM.gov within required deadlines. • Coordination between program and fiscal staff to confirm subaward execution dates, amounts, and reporting applicability prior to the reporting deadline. • Periodic review of SAM.gov submissions to ensure completeness and accuracy. These corrective actions are intended to strengthen internal controls over FFATA reporting and ensure timely and accurate submission of required subaward reports going forward.

Reference Number: 2025-027 Prior Year Finding: 2024-026 Federal Agency: U.S. Department of Health and Human Services State Department Name: Department of Health and Social Services State Division: Division of Substance Abuse and Mental Health Federal Program: Block Grants for Prevention and Treatment of Substance Abuse, COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: SAI000006426 (10/1/2023 – 9/30/2025) SAI000005888 (10/1/2022 – 9/30/2024) SAI000005101 (9/1/2021 – 9/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Division of Substance Abuse and Mental Health (Division) did not report required subaward information in accordance with FFATA requirements. Context Two of five subawards selected for testing were not reported in accordance with FFATA requirements. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause The Division’s policies and procedures were not sufficient to ensure that required subaward information was reported accurately no later than the end of the month following the date the subaward was issued. Internal controls did not prevent or detect the errors. Effect Subawards were not reported in accordance with FFATA requirements. Questioned Costs None noted. Recommendation We recommend that the Division develop internal controls and procedures to ensure that FFATA reporting requirements are met. We further recommend the Division develop controls and procedures to ensure that all required subawards are reported accurately and timely to SAM.gov. Views of Responsible Officials Regarding the subaward identified as not timely reported, the Division confirms that the subaward was submitted in SAM.gov on December 9, 2024. In accordance with FFATA reporting requirements, the subaward should have been reported no later than the end of the month following the month in which the subaward was issued. The delay in reporting was the result of administrative oversight. Since the prior finding, the Division has reviewed and strengthened its internal controls related to FFATA reporting to ensure compliance with federal requirements. Updated procedures have been implemented to formally track all subawards subject to FFATA reporting, including documentation of subaward issuance dates, calculation of reporting due dates, and verification of submission in SAM.gov within the required timeframe. In addition, the Division has implemented a secondary review process to monitor FFATA reporting on an ongoing basis. This includes periodic review of subaward activity and confirmation that all required reports have been submitted timely. These enhanced controls are intended to prevent recurrence of late reporting and to ensure full compliance with FFATA requirements going forward.

Eligibility Program Name: Summer Electronic Benefits Transfer Program for Children (Summer EBT) (Assistance Listing 10.646) Federal Award Agency: United States Department of Agriculture Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 244CT833N1175 Background The Department of Social Services (DSS) is the lead agency that administers the Summer EBT program and partners with the State Department of Education (SDE) to facilitate the program. DSS relies on the Integrated Management of Public Assistance for Connecticut (ImpaCT) system, the Connecticut Health Insurance Exchange (HIX) system, and third-party contractors when determining client eligibility. Additionally, SDE provides eligible client listings to DSS. DSS issues Summer EBT benefits to clients in multiple iterations. The department’s business systems and quality management divisions, and third-party contractors review the iterations. Each iteration requires a database change request prior to running the iteration. If the business systems division determines that it needs to make a change to the database change request, it will provide a formal approval. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Title 7 CFR Part 292.16(a)(5)(i) requires the state Summer EBT agency to establish a master issuance file which contains all information needed to identify eligible children, issue Summer EBT benefits, record the participation activity for each household, and supply all information necessary to fulfill reporting requirements. Condition Our inquiry about the Summer EBT client eligibility population disclosed that DSS did not track which agency was responsible for each client’s eligibility determination. The DSS business systems division did not approve four out of seven benefit iterations, totaling $993,840, and did not maintain sufficient documentation to support that it did not need to make a change to the database change request. Context DSS issued Summer EBT benefits in seven iterations totaling $30,362,441 during the fiscal year ended June 30, 2025. Questioned Costs $0 Effect DSS has reduced assurance over the accuracy and reliability of client eligibility determinations and oversight of Summer EBT benefit iterations. Cause The department’s current methods of combining multiple sets of Summer EBT issuance data files lacked sufficient controls to determine the source of client eligibility. The business systems division relied on quality management’s approval and did not maintain documentation to confirm that it made no changes to some database change requests. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls to identify the agency responsible for each client’s eligibility determination and document benefit iteration approvals for the Summer Electronic Benefits Transfer Program for Children. Views of Responsible Officials “The Department disagrees with this finding. Condition #1: Eligibility for the Summer EBT program is established through multiple pathways: receipt of Supplemental Nutrition Assistance Program (SNAP) benefits, Temporary Family Assistance (TFA), or HUSKY A coverage, and through applying for and receiving an eligibility determination for either the National School Lunch Program or the Summer EBT program itself. Determining eligibility is a shared responsibility between DSS and the State Department of Education (SDE), and children qualify through multiple pathways simultaneously. DSS maintains a record within its eligibility system and compiles reports of all eligible children. When eligibility is established through any additional means, the child’s record is then analyzed against all previous issuances to ensure duplicate participation and double issuance does not occur. Title 7 CFR Part 292.16 (a)(5)(i) requires the Summer EBT agency to establish a master issuance file which contains all information needed to identify eligible children, issue Summer EBT benefits, record the participation activity for each household and supply all information necessary to fulfill reporting requirements. The agency is not required to specify which program(s) were used to determine eligibility, which is reasonable given that there may be multiple overlapping avenues of eligibility. The implication that DSS is somehow not compliant or able to identify the source of eligibility is inaccurate. DSS can identify this information on an individual basis through reviewing the child’s receipt of SNAP, TFA, HUSKY A, or through its ongoing coordination and communication with SDE. Condition #2: It is not a requirement of the business systems division to request approval for each issuance. Each year the Department issues benefits for this program in a consistent manner. Since there were no changes to the process during the audit period, approval was not sought for the issuances. Business systems would only seek approval if there was a change to the process.” Auditors’ Concluding Comments Eligibility data at the summary and individual levels are both critical for an effective and efficient review of the program. The department could not provide documentation to substantiate that it used existing database change request scripts and approval by the business systems division was not necessary.

Special Tests and Provisions – EBT Card Security Program Name: Summer Electronic Benefits Transfer Program for Children (Summer EBT) (Assistance Listing 10.646) Federal Award Agency: United States Department of Agriculture Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 244CT833N1175 Background The Department of Social Services (DSS) provides Summer Electronic Benefits Transfer (EBT) benefits through EBT cards. The department’s financial services division tracks the status of returned EBT cards. The department’s mailroom staff are responsible for EBT card destruction. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 7 CFR Part 292.16(h)(3)(i) requires the state Summer EBT agency to provide adequate security for EBT cards including secure storage, inventory control records, and periodic review and validation of inventory control records. Title 7 CFR Part 292.15(h)(1)(i) requires Summer EBT agencies to expunge Summer EBT benefits 122 calendar days after issuance. Condition Our review of the status of returned Summer EBT cards disclosed that DSS destroyed returned EBT cards and did not maintain a log to record client information, disposition date, and reason for destruction. Context DSS issued $7,243,933 in Summer EBT refunds during fiscal year 2025. The refund amount included lost, stolen, or damaged EBT cards as well as expunged benefits. DSS destroyed seven 500-card tubes of returned EBT cards. Questioned Costs We were unable to determine if there were questioned costs as DSS did not maintain disposition records for the returned EBT cards. Effect DSS has reduced assurance over the security and accountability of returned EBT cards. Cause DSS informed us that it did not maintain a log due to the large volume of returned EBT cards. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls to ensure that it consistently secures, tracks, and records returned cards for the Summer EBT program. Views of Responsible Officials “The Department agrees with this finding. However, the Department believes that there are proper internal controls to ensure the security of returned cards. There was no log maintained by the Department but the controls in place reduced the risk of benefits being used incorrectly to an acceptable level. The returned cards were destroyed, and all unused benefits were expunged.” Auditors’ Concluding Comments DSS did not implement sufficient internal controls for the Summer EBT card program compared to the department's other federal EBT card programs. DSS was unable to provide documentation to support which EBT cards it destroyed and that it expunged benefits on all cards prior to destruction.

Subrecipient Monitoring Program Name: Crime Victim Assistance (Assistance Listing 16.575) Federal Award Agency: Department of Justice Award Years: Federal Fiscal Years 2021, 2022, and 2023 Federal Award Numbers: 15POVC-21-GG-00615-ASSI, 15POVC-22-GG-00715-ASSI, and 15 POVC-23-GG-00433-ASSI Background The Crime Victim Assistance program provides financial support and various services and resources to crime victims, including crisis counseling, criminal justice support and advocacy, shelter, and therapy. The Judicial Branch provides grants to subrecipients to provide these services. Title 28 U.S Code of Federal Regulations (CFR) Part 94.118 provides that subrecipients shall contribute not less than 20% of the total cost of each project. Subrecipients shall derive these contributions from non-federal sources. Each subrecipient shall maintain records that clearly show the source and amount of the matching contributions.Criteria Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal control over federal awards that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 CFR Part 200.332(e) provides that the pass-through entity shall monitor subrecipient activities as necessary to ensure that they comply with federal statutes, regulations, and the terms and conditions of the subaward. Title 28 CFR Part 94.106 provides that the state administering agency shall conduct regular desk monitoring of all subrecipients as well as on-site monitoring of all subrecipients at least once every two years during the award period. The state shall maintain a copy of site visit results and other documents related to compliance. Title 2 CFR Part 200.306(b) provides that the pass-through entity must accept any cost sharing funds as part of the subrecipient’s contributions to a program when the funds are verifiable in the subrecipient’s records. Condition The Judicial Branch did not perform regular subrecipient desk reviews or site visits at least once every two years during the award period as required by federal regulations. The branch does not complete reviews until the award period ends. As a result, it did not promptly examine subrecipients’ underlying documentation such as invoices, timesheets, or support for expenditures or matching contributions. The branch’s monitoring process was limited to monthly reviews of budget-to-actual summaries. Context During the fiscal year ended June 30, 2025, the branch made $8,759,482 in reimbursements to 40 subrecipients.Questioned Costs $0Effect The Judicial Branch has limited assurance that subrecipients used federal funds for allowable activities and met the mandatory matching requirements. This could potentially lead to future disallowed costs and federal repayment obligations.Cause Due to a lack of adequate staffing, the Judicial Branch prioritized reviewing supporting documentation for prior award periods rather than the current period. Prior Audit Finding We have not previously reported this finding.Recommendation The Judicial Branch should strengthen internal controls to ensure it complies with federal subrecipient monitoring requirements for the Crime Victim Assistance program. Views of Responsible Officials “The Judicial Branch Office of Victim Services (OVS) agrees to strengthen its internal controls as described below to comply with federal subrecipient monitoring requirements for the Victims of Crime Act Assistance (VOCA) Program. In 2025, OVS performed site visits for four VOCA-funded programs and completed financial-desk reviews of monthly or quarterly financial reports for all programs. That year, OVS experienced personnel turnover in its three-employee Fiscal Services Unit, notably the separation from state service of a Program Manager and a Court Planner, who together performed OVS’ programmatic site visits of VOCA-funded programs. Also, there was a significant increase in workload resulting from OVS’ contributions to the 2024-2025 VOCA request-for-proposal process. In response, staff outside the unit contributed while managing other assigned duties, a Program Manager and Grants and Contract Specialist were hired to restore the unit to its three-employee configuration, the new employees received training on subrecipient monitoring policies and procedures, and a revised subrecipient site visit plan was developed and has begun being implemented. To strengthen internal controls, OVS has developed a revised site visit plan for the remaining VOCA-funded programs scheduled to receive site visits in 2025. April 15, 2026, is the anticipated date for OVS to complete the site visits. OVS has completed sending letters to the subrecipients operating the VOCA-funded programs. The letters request supporting documentation, which is programmatic and financial in nature, in accordance with OVS administrative policy and procedure. Also, the letters inform subrecipients that site visits will commence in accordance with a revised site visit plan.”

Activities Allowed or Unallowed – Individual Plans and Service Records Program Name: Money Follows the Person Rebalancing Demonstration (MFP) (Assistance Listing 93.791) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 1LICMS300142 Background The Department of Social Services (DSS) is the designated single state agency to administer the Money Follows the Person Rebalancing Demonstration (MFP) program. Connecticut administered certain aspects of MFP through several state agencies including the Department of Developmental Services (DDS). Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.403 provides that to be allowable under federal awards, costs should be adequately documented. Title 2 CFR Part 200.303 requires the non-federal entity to establish, document, and maintain effective internal controls over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Procedure No. I.C.1.PR.002.a. of the DDS Operation Manual states that DDS should obtain agreements and approvals for the individual plan during the planning process. The case manager should document who participated in the planning process and obtain signatures on the individual plan. Participants typically include the recipient, parent, guardian, advocate, case manager, support brokers, private agency designee, and other DDS staff. Condition Our review of 25 MFP benefit payments totaling $11,000, of which $8,250 was federally reimbursed, disclosed that DDS did not have signatures of agreement and approval for six individual plans. Additionally, DDS could not obtain service records from one medical provider to support one $46 payment, for which DSS received $35 in federal reimbursement. Context During the fiscal year ended June 30, 2025, DSS processed $4,978,654 in MFP benefit payments on behalf of 36 DDS recipients. DSS received $3,733,990 in federal reimbursement. The sample was not statistically valid. Questioned Costs $0 Effect The lack of signatures to indicate agreement and approval of an individual plan by relevant participants increases the risk of inadequate services for the recipient. DSS received federal reimbursement for an unallowed expenditure. Cause Lack of management oversight contributed to the condition. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Developmental Services should strengthen internal controls to ensure it obtains the required signatures for the individual plan for all Money Follows the Person Rebalancing Demonstration recipients. The Department of Social Services should conduct an audit of the medical provider in accordance with Section 17b-99 of the Connecticut General Statutes to ensure integrity of the Money Follows the Person Rebalancing Demonstration program. Views of Responsible Officials Response provided by the Department of Developmental Services: “DDS agrees with the finding. The errors were attributed to current manual processes and case management oversight regarding documenting signatures when individual plan (IP) meetings are held remotely rather than in-person. Most of the deficiencies (5 of 6) were isolated to one case manager. The MFP division is small with 3-4 case managers, causing a higher error rate when extrapolated against the sample size. The missing support service records have been forwarded to the Department of Administrative Services for research. There are plans to improve the individual plan process to enhance internal controls through automation. In the interim, case managers and case manager supervisors will be reminded of the IP signature requirements.” Response provided by the Department of Social Services: “The Department agrees with this finding and the response provided by the Department of Developmental Services. Additional research is needed to determine whether the missing documentation was the provider's responsibility or was due to a billing issue. The Department of Developmental Services is coordinating with the Department of Administrative Services to research this further.”

Eligibility Program Name: Money Follows the Person Rebalancing Demonstration (MFP) (Assistance Listing 93.791) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 1LICMS300142 Background The Department of Social Services (DSS) uses several systems to administer the Money Follows the Person Rebalancing Demonstration (MFP) program. The My Community Choices web portal is the primary system that maintains data about MFP applicants and participants, including client start and end dates. The DSS eligibility management system maintains client eligibility determinations for the program. The Medicaid Management Information System (MMIS) processes medical services payments and provides financial reports for federal reimbursement claims. Since the My Community Choices web portal does not interface with other systems, DSS staff must manually input client MFP program start and end dates into the DSS eligibility management system. The DSS eligibility management system interfaces with MMIS daily. Criteria Section 6071(b)(2) of Public Law 109-171 defines an eligible individual for the MFP demonstration project as a person who, immediately before beginning participation in the MFP demonstration project, resides in an inpatient facility, receives Medicaid benefits for inpatient services, continues to require the level of care provided in an inpatient facility, and who resides in a qualified residence beginning on the initial date of participation in the demonstration project. Section 6071(b)(7) of Public Law 109-171 defines qualified expenditures by the state under its MFP demonstration project as home and community-based long-term care services for an eligible individual participating in the MFP demonstration project. However, this is only with respect to services furnished during the 12-month period beginning with the individual's discharge date from an inpatient facility. Title 2 U.S. Code of Federal Regulations (CFR) Part 200.403 provides that to be allowable under federal awards, costs should conform to any limitations or exclusions set forth in the federal award. Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal controls over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Title 42 CFR Part 431.420 requires the state to comply with the terms and conditions of the MFP demonstration project. MFP terms and conditions require the state to ensure the availability of adequate resources for implementation and monitoring of the demonstration project including tracking participant enrollment, maintaining eligibility systems, and administering effective transition coordination. MFP terms and conditions require the state to develop and amend an operational protocol that details how the state will adhere to statutory and program requirements. Section B of the MFP Operational Protocol includes the following policies and procedures. • Determining MFP eligibility includes ensuring an individual’s annualized cost of care in the community is equal to or less than the annualized rate paid for residing in an institution. • The state will not provide an administrative hearing to an applicant for denied services due to the applicant’s care plan exceeding the allowable cost of care in the community. • The state will suspend MFP participation and services during any inpatient stay. Suspended MFP participants may continue MFP participation upon discharge from the inpatient facility. Condition We reviewed 40 MFP claims, totaling $49,144, of which $36,858 was federally reimbursed, to determine if DSS properly granted eligibility. Our review disclosed the following: 1. DSS did not terminate MFP participation for two clients. DSS processed $918 for the selected claims for these clients. DSS processed $184,088 in additional claims in fiscal year 2025 and $270,274 in claims in prior fiscal years for periods when these clients were no longer eligible under the MFP program. DSS should have ended participation on April 5, 2018, and July 30, 2020, respectively. 2. DSS processed $7,724 of ineligible MFP expenses for two clients during inpatient hospital or nursing facility stays ranging from 14 to 21 days. DSS did not properly track MFP participation dates for these clients in its systems. Additionally, DSS did not properly track participation dates for a third client for seven days of hospitalization. 3. DSS approved two applicant care plans that exceeded the cost of institutional care by $1,530 (19%) and $3,507 (39%) per month. 4. DSS did not perform or document a comparative cost analysis for one client to demonstrate that care plan costs did not exceed nursing facility costs. Context During the fiscal year ended June 30, 2025, DSS processed $18,243,599 in payments on behalf of 824 MFP clients and received $13,682,699 in federal reimbursement. The sample was not statistically valid. Questioned Costs We computed questioned cost of $347,253 by applying the applicable federal financial participation rate to the ineligible expenditures. Questioned costs were $144,548 for fiscal year 2025 and $202,705 for prior fiscal years. Effect DSS provided MFP benefits to ineligible individuals. DSS received federal reimbursement for unallowed expenditures. Cause The My Community Choices web portal did not interface with DSS eligibility and financial systems. DSS relied on staff to manually input client participation start and end dates in multiple systems. Management oversight did not identify input errors of client participation dates. DSS management overrode applicant care plan costs. The MFP Operational Protocol has no written procedures to override program policies or federal regulations. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls to ensure that only eligible recipients receive Money Follows the Person Rebalancing Demonstration services in accordance with federal laws, award terms and conditions, and the Money Follows the Person Operational Protocol. Views of Responsible Officials “The Department agrees in part with this finding. Condition #1: DSS agrees that participation end dates were not updated timely due to cross-system manual entry limitations. Reconciliation procedures and supervisory oversight will be strengthened. Condition #2: DSS agrees that participation suspensions were not consistently reflected across systems due to timing delays. Monitoring and real-time reconciliation controls will be enhanced. Condition #3: DSS agrees approved costs exceeded institutional thresholds in limited cases. Variances were clinically justified, reviewed, and authorized. DSS will strengthen documentation and internal protocols to ensure clearer policy alignment. Condition #4: DSS agrees that the documentation was incomplete in one instance. Internal review standards will be reinforced to ensure comparative cost analyses are consistently documented. Please note, the Department will not be returning the questioned costs associated with this finding. According to federal regulations, recoveries based on eligibility errors can only be pursued when identified by programs operating under Centers for Medicare and Medicaid Services’ (CMS) Payment Error Rate Measurement program, per section 1903(u) of the Social Security Act and regulations at Title 42 CFR Part 431, Subpart Q.” Auditors’ Concluding Comments The Department of Social Services should amend its MFP Operational Protocol and seek approval from the Centers of Medicare and Medicaid Services if the department plans to continue to use management overrides of care plan costs.

Performance Reporting – Semi-Annual Progress Report and Special Reporting – MFP Work Plan Program Name: Money Follows the Person Rebalancing Demonstration (MFP) (Assistance Listing 93.791) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 1LICMS300142 Criteria The Money Follows the Person (MFP) Rebalancing Demonstration federal award requires the state to provide programmatic reports in accordance with Title 2 U.S. Code of Federal Regulations (CFR) Part 200.301. Title 2 CFR Part 200.301 requires the state to correlate financial data to performance accomplishments of the federal award. The state should also measure performance in a way that will help the United States Department of Health and Human Services (DHHS) and other non-federal entities to improve program outcomes, share lessons learned, and spread the adoption of promising practices. Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal controls over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. MFP terms and conditions require the state to submit a work plan that documents its progress on the use of initiatives designed to increase the use of home and community-based services rather than institutional long-term services and supports. MFP terms and conditions require the state to submit semi-annual progress reports that present the state’s analysis and the status of various operational areas in reaching the objectives of the demonstration. The semi-annual progress report documents the state’s progress in meeting MFP operational procedures and processes, transition benchmarks, and program goals for expanding and enhancing home and community-based services. Title 2 CFR Part 200.334 requires the state to retain financial and programmatic records to support reported information for three years from the date of submission. Condition Our review of the MFP work plan and semi-annual progress report for July 1 to December 31, 2024, disclosed that the Department of Social Services (DSS) did not maintain MFP program data to support figures reported for seven performance objectives in the work plan and 11 performance measures in the semi-annual progress report. Context DSS submitted two semi-annual progress reports and two work plans to DHHS during fiscal year 2025. The sample was not statistically valid. Questioned Costs $0 Effect DSS may have submitted an inaccurate work plan and progress report. DHHS may be using unreliable data to identify promising practices and make future federal program decisions. Cause DSS lacked adequate controls to document and retain MFP data. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls over performance and special reporting for the Money Follows the Person Rebalancing Demonstration to ensure it maintains data to support figures reported to the Department of Health and Human Services. Views of Responsible Officials “The Department agrees with this finding and is taking steps to strengthen internal controls over performance monitoring and special reporting for the Money Follows the Person (MFP) Rebalancing Demonstration. DSS is implementing a secure SharePoint repository to centrally maintain, organize, and track all documentation supporting the MFP Work Plan and the MFP Semi-Annual Report.”

Cash Management Program Name: HIV Care Formula Grants (Ryan White HIV/AIDS Program Part B) (Assistance Listing 93.917) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 6 X07HA00022-34-01 Background The Department of Public Health (DPH) receives rebates for pharmaceuticals and records them as revenue for the Ryan White HIV/AIDS Program Part B to reduce the program’s cash needs. DPH uses a drawdown tool to determine the timing and amount of its federal drawdowns. Criteria Title 31 U.S. Code of Federal Regulations (CFR) Part 205.11(a) provides that a state must minimize the time elapsing between the transfer of funds from the United States Treasury and the state's payout of funds for federal assistance program purposes, whether the transfer occurs before or after the payout of funds. Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal control over federal awards that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition We reviewed DPH’s drawdown tool and determined that it was not effective in monitoring the department’s cash needs. The tool understated expenditures by $29,208,717. As a result, the cash-on-hand amounts were not reliable. Context DPH drew down $8,881,530 for expenditures during the audited period. Questioned Costs $0 Effect Ineffective monitoring of cash needs increases the risk that federal drawdowns will not occur in accordance with the department’s immediate cash requirements to administer the program. Cause A lack of management oversight contributed to the condition. Prior Audit Finding We previously reported this as finding 2024-200. Recommendation The Department of Public Health should strengthen internal controls over cash management to ensure that federal drawdowns align with the immediate cash needs to administer the program. Views of Responsible Officials “We agree with this finding. The Fiscal Department, in collaboration with Management Assurance, has implemented enhanced internal controls to strengthen oversight of cash management activities. Together, the teams developed and formalized enhanced control measures within the Drawdown Tool. These enhancements include daily transaction-level monitoring, integration of rebate offsets, application of a multi-SID tiered allocation structure, and the addition of 90-day liquidation period. The controls have been clearly documented to address identified gaps in operational effectiveness and ensure a balanced approach between automation and manual oversight. This framework provides increased transparency and reliability in managing the timely and accurate drawdown of Ryan White Part B funds while ensuring strong standards and best practices.”

Reporting – Federal Funding Accountability and Transparency Act Program Name: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (Assistance Listing 97.036) Federal Award Agency: United States Department of Homeland Security Award Years: Federal Fiscal Years 2020 - 2025 Federal Award Numbers: 4087DRCTP00000001, 4500DRCTP00000001, and 4820DRCTP00000001 Background The Disaster Grants – Public Assistance program provides funding to state and local governments and certain types of private nonprofit organizations so that communities can quickly respond to and recover from presidentially declared disasters and emergencies. The Department of Emergency Services and Public Protection (DESPP) is the primary recipient for the State of Connecticut and is responsible for working with the Federal Emergency Management Agency (FEMA) throughout the disaster response and recovery process. In coordination with FEMA, DESPP receives and distributes funding to subrecipients for all projects within the state. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 CFR Part 170 Appendix A requires that states report any action that obligates $30,000 or more in federal funds for a subaward to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the end of the following month after making the obligation. Recipients are to accurately report key data elements such as subaward numbers, amounts, and obligation dates. As of March 8, 2025, FSRS was retired and all subaward reporting data and functionality are now on the System for Award Management (SAM.gov). Condition DESPP did not establish effective internal controls over Federal Funding Accountability and Transparency Act (FFATA) reporting. The same individual entered subawards into FSRS and SAM.gov and reviewed the entries for accuracy and completeness. There was no documented management review process to verify the accuracy, completeness, and timeliness of FFATA reporting. We randomly selected ten subawards of $30,000 or more, totaling $12,224,700, and identified the following conditions: • DESPP entered two subawards, totaling $435,831, into FSRS 18 and 580 days late. • DESPP did not maintain adequate documentation to support the date it reported two subawards, totaling $9,556,735. As a result, we could not determine if DESPP reported the subawards on time. Transactions Tested Subaward Not Reported Report Not Timely Subaward Amount Incorrect Subaward Missing Key Elements 10 0 2 0 0 Dollar Amount of Tested Transactions Subaward Not Reported Report Not Timely Subaward Amount Incorrect Subaward Missing Key Elements $12,224,700 $0 $435,831 $0 $0 Context During the fiscal year ended June 30, 2025, DESPP made 68 subawards of $30,000 or more, totaling $38,215,595. The sample was not statistically valid. Questioned Costs $0 Effect There is an increased risk for inaccurate, incomplete, and untimely FFATA reporting. Additionally, DESPP decreased its public transparency regarding its spending of federal awards. Cause Management did not adequately monitor the internal control system or promptly remediate internal control deficiencies identified during prior audits, which contributed to the identified conditions. Prior Audit Finding We previously reported this as finding 2024-350 and in three prior audits. Recommendation The Department of Emergency Services and Public Protection should strengthen internal controls and promptly report subawards in compliance with the Federal Funding Accountability and Transparency Act. Views of Responsible Officials “DESPP does not agree with this finding. DESPP utilizes the federally designated FFATA reporting system (SAM.gov) for all FFATA reporting. This system does not possess the capability for any layered review or approval of information prior to upload or post submission. The system has no reporting mechanism to review information input into this system. Further, the system does not maintain capability to track the dates of changes and it records over upload dates at future submission timeframes. These issues have been repeatedly brought to the attention of both SAM.gov administrators at the federal level and DESPP’s FEMA funding agencies. In response to a similar finding by FEMA, DESPP provided the attached information, after which FEMA closed the DESPP finding. DESPP will continue to attempt to work with SAM.gov administrators to advocate for modifications to the FFATA reporting system to address these concerns, but is unable to address them unilaterally without federal agency intervention.” Auditors’ Concluding Comments DESPP should maintain sufficient documentation outside of SAM.gov to demonstrate compliance with reporting requirements and approvals by agency personnel.

Allowable Costs/Cost Principles – Assistance Payments Program Names: COVID-19 Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 VO Program Name: Mainstream Vouchers (Assistance Listing 14.879) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 DVO Background The United States Department of Housing and Urban Development’s (HUD) Section 8 Housing Choice Vouchers Program provides rental assistance to help very low-income families afford decent, safe, and sanitary housing. Section 3202 of the American Rescue Plan Act of 2021 provided for new incremental Emergency Housing Vouchers. Office of Public and Indian Housing (PIH) notice PIH 2021-25 provides that public housing agencies (PHA) should report Emergency Housing Vouchers under the Section 8 Housing Choice Vouchers Program. The Mainstream Vouchers Program enables families to lease affordable private housing when the head, spouse, or co-head is a person with disabilities. Public housing agencies are authorized to administer the programs locally and make housing assistance payments on behalf of eligible families directly to landlords for the lease of suitable program-eligible rental housing. In Connecticut, the programs are administered locally by over 40 public housing agencies and statewide by the Department of Housing (DOH) and its contracted vendor. DOH advances program funds to its contractor that disburses the funds to landlords and participants. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 24 CFR Part 982.158 provides that the PHA must maintain complete and accurate accounts and other records for the program in accordance with HUD requirements, in a manner that permits a prompt and effective audit. Title 24 CFR Part 982.305 provides that the PHA must execute a HAP contract no later than 60 calendar days from the beginning of the lease term. The PHA must not pay any housing assistance payment to the owner until it has executed the contract. If the PHA executes the HAP contract during the period of 60 calendar days from the beginning of the lease term, it will pay housing assistance payments after the execution of the HAP contract. Any HAP contract executed after the 60-day period is void, and the PHA may not pay any housing assistance payment to the owner. Title 24 CFR Part 982.503 requires the PHA to adopt a payment standard schedule that establishes voucher payment standard amounts for each fair market rent area in the PHA jurisdiction. For each fair market rent area, the PHA must establish payment standard amounts for each unit size. Unit size is measured by the number of bedrooms. Title 24 CFR Part 982.505 states that a payment standard is used to calculate the monthly housing assistance payment for a family. The payment standard for the family is the lower of the payment standard amount for the family unit size or the payment standard amount for the size of the dwelling unit rented by the family. Title 24 CFR Part 982.516 requires the PHA to conduct a reexamination of family income and composition at least annually. The PHA must obtain and document in the tenant file third-party verifications of reported family annual income, the value of assets, expenses related to deductions from annual income, and other factors that affect the determination of adjusted income, or must document why third-party verification was not available. At the effective date of a regular or interim reexamination, the PHA must make appropriate adjustments in the HAP. Title 24 CFR Part 982.517 requires the PHA to maintain a utility allowance schedule for all tenant-paid utilities (except telephone), for tenant supplied refrigerators and ranges, and for other tenant paid housing services (e.g., trash collection). The utility allowance schedule must be determined based on the typical cost of utilities and services paid by energy-conservative households that occupy housing of similar size and type in the same locality. The PHA must review its schedule each year and must revise its allowance for a utility category if there has been a change of ten percent or more in the utility rate since the last time the utility schedule was revised. Condition Our review of 60 housing assistance payments and utility reimbursements, totaling $99,286 and $2,813, respectively, disclosed that in 14 cases, payments were incorrectly calculated. Some cases had multiple errors. • In two cases, the PHA incorrectly calculated the tenant’s total annual adjusted income. • In eight cases, the PHA incorrectly calculated the tenant’s total annual income. • In three cases, the PHA did not use the correct payment standard. • In two cases, the PHA incorrectly calculated the utility allowance or did not use the correct utility allowance schedule. These errors resulted in $1,211 in housing assistance and utility reimbursement overpayments and $49 in underpayments for the tested benefit months. Further review noted an additional $8,495 in housing assistance and utility reimbursement overpayments, and $379 in underpayments during the audited period. We also noted that in two cases, the PHA paid $37,233 under housing assistance payment contracts that were void because they were not executed within 60 calendar days from the beginning of the lease term. Context During the fiscal year ended June 30, 2025, housing assistance payment transactions and utility reimbursements for the Section 8 Housing Choice Vouchers and Mainstream Vouchers programs totaled $127,656,361. The sample was not statistically valid. Questioned Costs Our review identified questioned costs totaling $41,491 for the Section 8 Housing Choice Vouchers program. Effect DOH has reduced assurance of the accuracy of housing assistance payments and utility reimbursements. Cause The conditions are due to a lack of management oversight. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Housing should strengthen internal controls to ensure that it properly calculates Section 8 Housing Choice Vouchers and Mainstream Vouchers housing assistance and utility benefit payments. Views of Responsible Officials “We agree with the finding. DOH did contract with a third-party entity to provide these services; however, DOH retains overall responsibility for the program. Recently, DOH established a Section 8 division within DOH to provide more oversight over the program and the contactor. We are working closely with the contractor to strengthen their internal control, develop policies and procedures. DOH will continue collaborating with the contractor to enhance system controls and minimize the risk of future issues. All identified errors in this finding have been corrected including the questionable cost, and the software now includes a new feature designed to prevent similar problems going forward. DOH remains committed to continuous improvement and effective oversight of the program and contractor.”

Eligibility Program Names: COVID-19 Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 VO Program Name: Mainstream Vouchers (Assistance Listing 14.879) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 DVO Background The United States Department of Housing and Urban Development’s (HUD) Section 8 Housing Choice Vouchers Program provides rental assistance to help very low-income families afford decent, safe, and sanitary housing. Section 3202 of the American Rescue Plan Act of 2021 provided for new incremental Emergency Housing Vouchers. Office of Public and Indian Housing (PIH) notice PIH 2021-25 provides that public housing agencies (PHA) should report Emergency Housing Vouchers under the Section 8 Housing Choice Vouchers Program. The Mainstream Vouchers Program enables families to lease affordable private housing when the head, spouse, or co-head is a person with disabilities. Public housing agencies are authorized to administer the programs locally and make housing assistance payments on behalf of eligible families directly to landlords for the lease of suitable program-eligible rental housing. In Connecticut, the programs are administered locally by over 40 public housing agencies and statewide by the Department of Housing (DOH) and its contracted vendor. DOH advances program funds to its contractor that disburses the funds to landlords and participants. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 24 CFR Part 982.158 provides that the PHA must maintain complete and accurate accounts and other records for the program in accordance with HUD requirements, in a manner that permits a prompt and effective audit. Title 24 CFR Part 5.233 requires PHAs to use the Enterprise Income Verification system in its entirety as a third-party source to verify tenant employment and income information during mandatory reexaminations of family compositions and income. Office of Public and Indian Housing (PIH) notice PIH 2018-18 provides that PHAs maintain the report and documentation of any follow up in the tenant file. The PHAs are also required to maintain copies of the Enterprise Income Verification income and Income Validation Tool reports used to confirm family reported income within 120 days of the Inventory Management Public and Indian Housing Information Center submission date. Office of Public and Indian Housing (PIH) notice PIH 2012-28 provides that PHAs adopt procedures at admission and at annual recertification/reexamination to prevent lifetime registered sex offenders from receiving federal housing assistance. If the tenant or a member of the tenant’s household engages in criminal activity (including sex offenses) while living in HUD-assisted housing, the PHA should pursue eviction or termination. Condition Our review of 60 housing assistance payments and utility reimbursements, totaling $99,286 and $2,813, respectively, disclosed the following: · In four cases, the PHA did not have Income Validation Tool reports on file to support tenant employment and income. · In two cases, the PHA did not receive all required source documents prior to completing the initial/annual reexaminations. · In one case, the PHA did not verify the tenant’s employment and income noted on the Income Validation Tool. · In one case, the PHA did not verify household members were not lifetime registered sex offenders or check their criminal record during the annual reexamination. Context During the fiscal year ended June 30, 2025, housing assistance payment transactions and utility reimbursements for the Section 8 Housing Choice Vouchers and Mainstream Vouchers programs totaled $127,656,361. The sample was not statistically valid. Questioned Costs $0 Effect There is an increased risk that DOH provides financial assistance to ineligible individuals. Cause The conditions are due to a lack of management oversight. Prior Audit Finding We previously reported this as finding 2024-727 and in two prior audits. Recommendation The Department of Housing should properly monitor its contractor to ensure that it only awards benefits to eligible recipients. Views of Responsible Officials “We agree with the finding. DOH did contract with a third-party entity to provide these services. The contractor has been experiencing technical difficulties accessing the HUD system. We are aware of this current situation, and we are working with HUD to resolve this issue as soon as possible. “

Special Tests and Provisions – Housing Assistance Payments Program Names: COVID-19 Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Section 8 Housing Choice Vouchers (Assistance Listing 14.871) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 VO Program Name: Mainstream Vouchers (Assistance Listing 14.879) Federal Award Agency: United States Department of Housing and Urban Development Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: ACC CT 901 DVO Background The United States Department of Housing and Urban Development’s (HUD) Section 8 Housing Choice Vouchers Program provides rental assistance to help very low-income families afford decent, safe, and sanitary housing. Section 3202 of the American Rescue Plan Act of 2021 provided for new incremental Emergency Housing Vouchers. Office of Public and Indian Housing (PIH) notice PIH 2021-25 provides that public housing agencies (PHA) should report Emergency Housing Vouchers under the Section 8 Housing Choice Vouchers Program. The Mainstream Vouchers Program enables families to lease affordable private housing when the head, spouse, or co-head is a person with disabilities. Public housing agencies are authorized to administer the programs locally and make housing assistance payments on behalf of eligible families directly to landlords for the lease of suitable program-eligible rental housing. In Connecticut, the programs are administered locally by over 40 public housing agencies and statewide by the Department of Housing (DOH) and its contracted vendor. DOH advances program funds to its contractor that disburses the funds to landlords and participants. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 24 CFR Part 982.158 provides that the PHA must maintain complete and accurate accounts and other records for the program in accordance with HUD requirements, in a manner that permits a prompt and effective audit. Title 24 CFR Part 982.516 requires the PHA to conduct a reexamination of family income and composition at least annually. The PHA must obtain and document in the tenant file third-party verifications of reported family annual income, the value of assets, expenses related to deductions from annual income, and other factors that affect the determination of adjusted income, or must document why third-party verification was not available. At the effective date of a regular or interim reexamination, the PHA must make appropriate adjustments in the HAP. Condition Our review of ten housing assistance payments and utility reimbursements totaling $17,721 and $351, respectively, disclosed that in one case, the PHA incorrectly calculated the payment. The PHA incorrectly calculated the tenant’s total annual income and total allowance/deductions. These errors resulted in an overpayment of $49 for the tested benefit month. Context During the fiscal year ended June 30, 2025, housing assistance payment transactions and utility reimbursements for the Section 8 Housing Choice Vouchers and Mainstream Vouchers programs totaled $127,656,361. The sample was not statistically valid. Questioned Costs Our review identified questioned costs totaling $49 for the Section 8 Housing Choice Vouchers program. Effect DOH has reduced assurance of the accuracy of housing assistance payments and utility reimbursements. Cause The condition was due to a lack of management oversight. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Housing should strengthen internal controls to ensure that it properly calculates and supports Section 8 Housing Choice Vouchers and Mainstream Vouchers housing assistance and utility benefit payments. Views of Responsible Officials “We agree with the finding. DOH did contract with a third-party entity to provide these services; however, DOH retains overall responsibility for the program. Recently, DOH established a Section 8 division within DOH to provide more oversight over the program and contactor. We are working closely with the contractor to strengthen their internal control, develop policies and procedures. DOH will continue collaborating with the contractor to enhance system controls and minimize the risk of future issues. All identified errors in this finding have been corrected including the questionable cost. DOH remains committed to continuous improvement and effective oversight of the program and contractor. “

Allowable Costs/Cost Principles – Evidence of Services Provided by Part-Time and Extension Credit Lecturers Program Name: Coronavirus State and Local Fiscal Recovery Funds (Assistance Listing 21.027) Federal Award Agency: Department of the Treasury Award Year: Federal Fiscal Year 2025 Federal Award Number: N/A Background The Office of Policy and Management (OPM) was designated as the primary state agency responsible for overseeing the Coronavirus State and Local Fiscal Recovery Funds and reporting to the federal government. OPM allocated funds to the CT State Community College and other state agencies to assist with carrying out the program’s objectives. CT State Community College contracts with part-time and extension credit lecturers who teach a term or class at a flat rate. The college pays them in equal installments based on the terms of individual contracts. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 CFR Part 200.430(g) provides that charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. Such records must be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, and comply with the established accounting policies and procedures of the recipient. Sections 3-117(b) and 3-119(a) of the Connecticut General Statutes require state entities to certify services are received and documented before paying contractors and state employees. Condition CT State Community College made $70,175,519 in salary and fringe benefit payments for 2,796 part-time and extension credit lecturers without verifying the lecturers provided the contractual services or documenting supervisory approval. Context During the fiscal year ended June 30, 2025, CT State Community College charged $70,624,749 in payroll and fringe benefit costs to Coronavirus State and Local Fiscal Recovery Funds, of which $70,175,519 was attributed to contracted faculty members. Questioned Costs $0 Effect CT State Community College could pay part-time and extension lecturers for services they did not provide. Cause CT State Community College lacks policies and procedures to ensure compensation for part-time and extension credit lecturers is contingent on fulfillment of contractual obligations. Prior Audit Finding We previously reported this as finding 2024-400. Recommendation CT State Community College should strengthen internal controls to ensure that part-time and extension credit lecturer payroll and fringe benefits costs are based on actual time worked and are properly approved. Views of Responsible Officials Response provided by CT State Community College: “Management agrees with this finding and work towards a viable long-term solution for workload review at the campus level is underway. As noted in previous audits, controls were implemented in Banner as part of the Payroll Exception review process that was initiated by the Audit Advisory Committee. These reports are currently unavailable due to limitations that will be resolved soon. Once resolved, the reports will be shared with the appropriate academic reviewer for confirmation of services received.” Views of Responsible Officials Response provided by the Office of Policy and Management: “The Office of Policy and Management has no additional response beyond that offered by the CT State Community College.”

Eligibility Program Names: COVID-19 Medical Assistance Program (Medicaid, Title XIX) (Assistance Listing 93.778) Medical Assistance Program (Medicaid, Title XIX) (Assistance Listing 93.778) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Numbers: 2405CT5MAP and 2505CT5MAP Criteria Title 42 U.S. Code of Federal Regulations (CFR) Part 435.603 requires the state Medicaid agency to determine a household’s financial eligibility for Medicaid based on the sum of the modified adjusted gross income (MAGI) of every individual in the household. Title 42 United States Code Section 1396b(v) provides that aliens who meet certain requirements are eligible for Medicaid only if such care and services are necessary for the treatment of an emergency medical condition. Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The CFR requires the non-federal entity to take prompt action when it identifies instances of noncompliance, including noncompliance identified in audit findings. Condition We reviewed 60 Medicaid cases to determine if the Department of Social Services (DSS) properly granted eligibility. Our review included 40 MAGI cases totaling $12,386, of which $6,367 was federally reimbursed and 20 non-MAGI cases totaling $41,480, of which $21,029 was federally reimbursed. Our review disclosed that DSS granted Medicaid eligibility to one MAGI recipient upon denial of their renewal application in June 2023. DSS improperly continued eligibility for 30 months until notification of our review. DSS paid $7 in Medicaid benefits for the selected claim. Furthermore, our review disclosed that DSS paid an additional $10,587 in Medicaid benefits for the ineligible recipient during fiscal year 2025. We reviewed the status of prior audit findings to determine if DSS took appropriate steps to resolve and prevent identified conditions. Our review of 18 non-qualified aliens who received non-emergency medical services in prior audits disclosed that DSS issued $12,443 in payments for non-emergency medical services provided to one non-qualified alien who was ineligible to receive services in fiscal year 2025. Context DSS provided us with a detailed listing of fee-for-service benefit payments issued during the fiscal year ended June 30, 2025. We stratified the data into two eligibility determination groups based on MAGI and non-MAGI determinations (e.g., Aged, Blind and Disabled). During the fiscal year ended June 30, 2025, DSS issued $5,978,762,480 in payments on behalf of 2,379,288 MAGI recipients and received $3,038,953,956 in federal reimbursement. In addition, DSS issued $5,158,976,619 in payments on behalf of 772,464 non-MAGI recipients and received $2,598,909,828 in federal reimbursement. We further stratified the payment data for recipients without a Social Security number who were over three years old. DSS issued $91,099,447 in payments on behalf of 20,125 MAGI recipients and received $46,371,061 in federal reimbursement. In addition, DSS issued $36,001,833 in payments on behalf of 7,812 non-MAGI recipients and received $18,046,253 in federal reimbursement. Of these 27,937 recipients, we could not determine the number of non-qualified aliens without reviewing each case. The samples were not statistically valid. Questioned Costs We computed $11,518 in questioned costs by applying the applicable federal financial participation rate to the benefit payments associated with the ineligible recipients. Effect DSS received federal reimbursement for unallowed expenditures. Cause DSS implemented system overrides during COVID-19 that prevented case closure for recipients determined ineligible after the pandemic. DSS eligibility workers granted eligibility to a non-qualified alien without proper documentation or authority. Prior Audit Finding We previously reported this as finding 2024-012. Recommendation The Department of Social Services should strengthen internal controls to ensure that only eligible recipients receive Medicaid services in accordance with federal laws and the Medicaid State Plan. Views of Responsible Officials “The Department agrees with this finding. The Department identified cases where overrides that were applied during the public health emergency were not removed. This resulted in individuals remaining enrolled inappropriately. Our Business Systems Division is implementing a tiered resolution approach, beginning with individuals enrolled in the Medicare Savings Program and HUSKY-C coverage. Please note: The Department will not be returning the questioned costs associated with this finding. According to federal regulations, recoveries based on eligibility errors can only be pursued when identified by programs operating under CMS’ Payment Error Rate Measurement program, per section 1903(u) of the Social Security Act and regulations at Title 42 CFR Part 431, Subpart Q.”

Compliance Requirement: Allowable Costs/Cost Principles Internal Control Impact: Significant Deficiency Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of Agriculture Pass-Through Entity: Georgia Department of Education Assistance Listing Number and Title: 10.553 – School Breakfast Program 10.555 – National School Lunch Program Federal Award Number: 255GA324N1199 (Year: 2025) Questioned Costs: $7,474 Repeat of Prior Year Finding: FA 2024-001, FA 2023-004 Description: The policies and procedures of the School District were insufficient to provide adequate internal controls over the employee compensation process as it relates to the Child Nutrition Cluster. Background Information: The Child Nutrition Cluster (CNC) is comprised of various programs that are intended to assist states in administering and overseeing food service program operators that provide healthful, nutritious meals to eligible children in public and non-profit private schools, residential childcare institutions, and summer programs. This Cluster of programs also fosters healthy eating habits in children by providing fresh fruits and fresh vegetables to children attending elementary and secondary schools and encourages the domestic consumption of nutritious agricultural commodities. CNC funding was granted to the Georgia Department of Education (GaDOE) by the U.S. Department of Agriculture. GaDOE is responsible for distributing funds to local educational agencies (LEAs) and overseeing the various CNC programs. CNC funds totaling $60,051,234.81 were expended and reported on the DeKalb County Board of Education’s Schedule of Expenditures of Federal Awards (SEFA) for fiscal year 2025. Criteria: As a recipient of federal awards, the School District is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Provisions included in the Uniform Guidance, Section 200.403 – Factors Affecting Allowability of Costs state that “costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the recipient or subrecipient… (g) Be adequately documented…” Furthermore, provisions included in the Uniform Guidance, Section 200.430 – Compensation-Personal Services prescribe standards for documentation of personnel expenses and state, in part, that “(a) … Costs for compensation are allowable to the extent that they satisfy… specific requirements… and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the recipient or subrecipient consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a recipient’s or subrecipient’s laws, rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (g)…, [as follows:] (g) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the recipient or subrecipient…” Condition: A sample of 60 employees was randomly selected for testing using a non-statistical sampling approach. These employees were reviewed to determine if internal controls were properly functioning, and applicable compliance requirements were met. The following deficiencies were noted: • One employee was paid on the incorrect pay scale and thus was overpaid by $4,903. • Two employees were paid on the incorrect pay scale and thus were underpaid by $1,287. • Additional pay totaling $967 for 2 employees was incorrectly charged to the federal program. • Documentation of retrospective pay totaling $317 could not be located for 1 employee. Questioned Costs: Upon testing a sample of $1,643,657 in personnel services expenditures, known questioned costs of $7,474 were identified for payroll charges not supported by adequate documentation. Using the total personnel services expenditure population of $20,618,901 (excluding benefits payments), we project the likely questioned costs to be approximately $93,759. The following Assistance Listing Numbers were affected by known and likely questioned costs: 10.553 and 10.555. Cause: A lack of oversight by personnel in the Office of Federal Grants and Program Compliance led to noncompliance with the requirements of the Uniform Guidance in relation to charging of personnel costs to a federal program. Effect: The School District is not in compliance with the Uniform Guidance and GaDOE guidance. Failure to pay employees with CNC funds the appropriate amount and/or maintain documentation supporting those payments could result in the expenditure of funds for unallowable purposes. This may also expose the School District to unnecessary financial strains and shortages within the CNC funds as ED or GaDOE may require the School District to return funds associated with improperly documented expenditures. Recommendation: The School District should evaluate their internal control process related to the approval and retention of documentation to support employee compensation payments. Where vulnerable, the School District should develop and/or modify its policies and procedures to ensure that CNC employees are paid appropriately. Furthermore, management should develop and implement a monitoring process to ensure that these procedures are functioning properly. Views of Responsible Officials: The District acknowledges the audit team’s findings regarding undocumented additional pay and the isolated instances of overpayment identified during the testing of School Food Nutrition program. While the District remains committed to absolute fiscal accuracy, we believe the following context is essential for a complete understanding of the program’s scale and the nature of the identified error. • Scale of Operations: The District’s School Food Nutrition program is a massive operation, serving over 90,000 students across 124 separate kitchens. This decentralized environment requires the management of approximately 900 personnel and a total salary expenditure of $20,618,901. • Statistical Significance vs. Actual Error: The audit identified actual errors totaling $7,474. While the District understands that federal auditing standards (Uniform Guidance) require this amount to be extrapolated across the entire $20.6M population-resulting in a projected error exceeding the $25,000 mandatory reporting threshold-it is important to note that the actual identified discrepancy represents only 0.036% of the program’s personnel budget. • Accuracy Rate: Even when utilizing the extrapolated figure of $25,000, the District maintains a 99.64% accuracy rate in payroll processing for this program. We believe this demonstrates a robust internal control environment, particularly given the complexities of managing 124 distinct points of service. • Disproportionate Reporting Thresholds: The District notes that the $25,000 reporting threshold is a fixed statutory limit that does not scale with the size of the Local Educational Agency (LEA). Consequently, a District of our size is held to a significantly more compressed margin of error (less than one-eighth of one percent) than a smaller district with fewer employees and sites. Auditor’s Concluding Remarks: While the questioned costs identified by auditors appear to be relatively small in the context of the School District’s overall School Nutrition expenditures, the amounts exceed the reporting threshold established by the Uniform Guidance. This threshold is designed to ensure consistent reporting of noncompliance across entities of all sizes. Given the information reflected above, we reaffirm our finding and will review the status of the finding during our next audit.

2025 – 003 – Documentation of Review Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Assistance Listing Number: Student Financial Aid Cluster Award Period: July 1, 2024 to June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The 2 CFR Section 200.303 require that nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal Statues, regulations, and the term and conditions of the federal awards. Condition: During our testing of Return of Title IV Funds (R2T4), student federal award packaging, and review of the FISAP, we noted there was a review process implemented; however, there was no process in place to retain the review being performed as to provide evidence to ensure the controls are being performed effectively. Questioned Costs: N/A Context: During our testing, it was noted the University does not have a process in place to ensure controls are being performed effectively. Cause: The University did not have a process in place to ensure controls implemented are being performed effectively. Effect or Potential Effect of Finding: There is no way to determine who was involved in the process should an error be present. Repeat Finding: No. Recommendation: We recommend the University reevaluate its procedures and review policies surrounding controls implemented for Title IV Aid. Views of Responsible Official: There is no disagreement with the audit finding.

Finding Reference 2025-04 Assistance Listing Number Transit Services Programs Cluster 20.513Enhanced Mobility of Seniors and Individuals with Disabilities 20.516Job Access and Reverse Commute Program 20.521 New Freedom Program Name of Federal Agency Department of Transportation Compliance Requirement Subrecipient Monitoring Type of Finding Significant Deficiency on Internal Control and Noncompliance Condition From a sample of nine (9) subrecipients, the auditors identified that for one (1) subrecipient, the Authority, did not perform subrecipient monitoring within the required three (3)-year cycle established in its State Management Plan, as of the audit period ended June 30, 2025. Although monitoring activities were scheduled for a subsequent period (2026), such actions occurred after the audit period and do not address the absence of compliance as of June 30, 2025. Criteria 2 CFR 200.332(d) requires pass-through entities to monitor the activities of subrecipients to ensure compliance with Federal statutes, regulations, and the terms and conditions of the subaward. 2 CFR 200.303 requires non-federal entities to establish and maintain effective internal control over Federal awards. FTA Circular 5010.1E (Chapter 5) states that federal oversight activities (e.g., inspections or reviews) do not relieve the recipient of its responsibility to manage and oversee federally funded projects. The Authority’s State Management Plan establishes a risk-based monitoring approach, including a three (3)- year monitoring cycle for subrecipients. Cause The Authority did not ensure that subrecipient monitoring procedures were performed and documented within the required three-year cycle for all subrecipients. Additionally, management relied on the FTA Triennial Review process as evidence of monitoring, which reflects a misinterpretation of federal requirements regarding the Authority’s responsibilities as a pass-through entity. Effect The failure to perform and document subrecipient monitoring within the established cycle increases the risk that noncompliance with federal requirements by subrecipients may not be identified in a timely manner. In addition, federal funds may not be used in accordance with applicable laws, regulations, and grant requirements. The Authority may be exposed to questioned costs, repayment obligations, or increased federal oversight. Questioned Costs None. Recommendation We recommend that the Authority: Ensure that subrecipient monitoring is performed and documented in accordance with its State Management Plan and within the established three-year cycle. Reinforce internal controls and training to clarify that federal reviews (e.g., FTA Triennial Review) do not replace the Authority’s monitoring responsibilities under 2 CFR 200. Views of Responsible Officials Refer to Management’s unaudited corrective action plan.

Federal Agency: U.S. Department of Agriculture and U.S. Department of Health and Human Services Federal Program Name: Research and Development Assistance Listing Number: 10.215 and 93.433 Federal Award Identification Number and Year: 90RTEM0009 - 2025, 20213864034724 - 2025, 90RTST0002 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Federal Government requires that when the reimbursement method is used, the Federal awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the Federal awarding agency or pass-through entity reasonably believes the request to be improper (2 CFR section 200.305(b)(3)). Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not make payments to subrecipients within 30 days after receipt of invoices. Questioned costs: None. Context: During our testing we identified 4 out of 14 subrecipient payments that did not process payment requests from the subrecipients timely. Cause: The University did not have an effective control in place to ensure subrecipient payments were paid timely. Effect: Subrecipients on federal awards do not receive timely payment for federal contract work. Repeat Finding: Yes, 2024-001 Recommendation: We recommend the University review and update policies and procedures to allow for more timely payment to subrecipients for work the University contracts them to perform. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: 84.379 Federal Award Identification Number and Year: P379T250352 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding:  Significant Deficiency in Internal Control over Compliance  Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 686.11(a)(5), states that if the student is beyond the first year of a program of undergraduate education as determined by the institution, a cumulative undergraduate GPA of at least 3.25 on a 4.0 scale, or the numeric equivalent, through the most-recently completed payment period, is a requirement to be eligible to receive a TEACH Grant. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University awarded the TEACH Grant to a student who did not meet the GPA requirement. Questioned costs: None. Context: During our testing of eligibility, we identified one student that was only maintaining a 2.75 GPA even though the federal requirements states the student should be maintaining at least a 3.25 GPA to be eligible for the TEACH Grant funds. Cause: The University did not thoroughly review federal regulations for eligibility requirements prior to awarding the student the TEACH Grant. Effect: Failure to follow eligibility requirements may result in noncompliance of federal regulations. Repeat Finding: No Recommendation: We recommend the University review and update current procedures to ensure that students meet eligibility requirements prior to receiving the TEACH Grant. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number and Year: P063P240352- 2025, P268K250352 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding:  Significant Deficiency in Internal Control over Compliance  Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.22(j)(1), states that an institution must return the amount of title IV funds for which it is responsible as soon as possible but no later than 45 days after the date of the institution's determination that the student withdrew. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not return Title IV funds within 45-days. Questioned costs: None. Context: During our testing of 9 students’ Return of Title IV (R2T4) calculations, we identified 2 with refunds that were not returned within the 45-day requirement. Cause: The University has not implemented precise controls to ensure timely return of funds related to withdrawals. Effect: The University was not in compliance with the requirements to properly return refunds within the 45-day requirement. Repeat Finding: No Recommendation: We recommend the University review its current procedures for Title IV funds and implement additional procedures to ensure refunds are returned timely. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033, 84.379 Federal Award Identification Number and Year: P063P240352- 2025, P268K250352 - 2025, P007A243424 - 2025, P033A243424 – 2025, P379T250352 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding:  Material Weakness in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Questioned costs: None. Context: During our testing of 60 students, we identified 7 students whose campus enrollment status change was not reported, 15 students whose program enrollment status change was not reported correctly, 2 students with incorrect effective dates reported for campus enrollment, 8 students with incorrect effective dates reported for program enrollment, and 26 students whose status changes were not reported timely. We also identified that for 3 of the selected students, the program-level enrollment does not show student participating in correct program per institutional records. Cause: The University didn't have effective controls in place to verify students' status in NSLDS matched the institutions records accurately or in a timely manner. Effect: The University was not in compliance with the requirements to properly report student enrollment data correctly. Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: Yes, 2024-006 Recommendation: We recommend the University review current processes for reporting to NSLDS and implement additional procedures to ensure submissions are reported timely and accurately. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: U.S. Department of Agriculture, and U.S. Department of Education Federal Program Name: Research & Development, Agriculture Extension at 1890 Land-grant Institutions, and Higher Education Institutional Aid Assistance Listing Number: 10.205, 10.512, 84.031 Federal Award Identification Number and Year: NI241445XXXXG012 - 2025, NI221444XXXXG019 - 2025, NI211444XXXXG016 - 2025, P031B220009 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.318(i), the recipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not go through procurement procedures prior to entering into a contract with the vendor. Questioned costs: None. Context: During our testing of the Research & Development Cluster, we identified 1 out of 8 transactions that did not go through the proper procurement procedures. During our testing of the Higher Education Institutional Aid Program, we identified 1 out of 8 transactions that did not go through the proper procurement procedures. During our testing of the Extension Services at 1890 Colleges and Tuskegee University, West Virginia State College, and Central State University Program, we identified 3 out of 8 transactions that did not go through the proper procurement procedures. Cause: The University did not have an effective control in place to ensure that the purchases went through the procurement procedures. Effect: The University was not in compliance with the regulation to go through the procurement procedures prior to entering a contract. Repeat Finding: No Recommendation: We recommend that the University review policies and procedures for procurement to ensure that every applicable transaction is going through the proper procurement procedures. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: Federal Government Federal Program Name: Research & Development, Agriculture Extension at 1890 Land-grant Institutions, and Higher Education Institutional Aid Assistance Listing Number: Multiple Federal Award Identification Number and Year: Multiple Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Material Weakness in Internal Control over Compliance Criteria or specific requirement: Uniform Grant Guidance, 2 CFR 200.313(d)(2), procedures for managing equipment (including replacement equipment), whether acquired in whole or in part under a Federal award, until disposition takes place will, as a minimum, meet the following requirements, a physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not have documentation of physical inventory of the equipment purchased with Federal funds. Questioned costs: None. Context: During inquiries with management, the University had been unable to fill a staffing position to help implement correct action of tracking equipment purchased with Federal funds. Cause: The University did not have an effective control in place to ensure physical inventory over equipment was completed every two years. Effect: Failure to maintain accurate inventory records inhibits the University from properly safeguarding and maintaining equipment. Repeat Finding: Yes, 2024-002 Recommendation: We recommend the University ensures that a physical inventory over equipment is completed at least every two years. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Finding 2025-003 — Material Weakness (Internal Control Over Compliance): Grant Accounting and Close Process Affecting Major Programs Condition: The deficiencies noted in Finding 2025-001 also affect internal control over compliance for major programs. Programs Affected: 1) ALN 14.872 – Public Housing Capital Fund and 2) ALN 97.036 – Disaster Grants – Public Assistance. Repeat finding: No. Criteria: 2 CFR 200.303 and 200.516(a) require effective internal control over compliance. Cause: Lack of a structured, documented month end and year end close process and delayed reconciliations of grant related activity. Effect: Increased risk of misclassification or reporting in the wrong period for federal awards. Questioned Costs: 1) Known questioned costs were $0 and 2) likely questioned costs were $0. Perspective / Context: The control deficiencies were observed across all grant related closing cycles reviewed for FY 2025, demonstrating a systemic process issue rather than isolated instances. Recommendation: Apply the corrective actions in Finding 2025-001, including: 1) establishing a documented monthly and year end closing calendar, 2) performing timely reconciliations of grant activity, 3) strengthening supervisory review points prior to SEFA preparation and reporting. Management Response: Management concurs and will implement the recommended improvements beginning FY 2026.

Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063, 84.268 Program Expenditures: $31,997,072 Program Name: Federal Pell Grant Program, Federal Direct Student Loans Award Number(s): P063P231391, P063P241391, P063P251391, P268K241391, and P268K251391 Questioned Costs: None CONDITION: Western Illinois University (University) did not have adequate procedures in place to complete accurate enrollment reporting for all students. During our testing of Pell or Direct Loan borrowers, we noted 4 out of 40 (10%) students campus-level record and program-level record were not updated with accurate enrollment status changes. The sample was not a statistically valid sample. The University is required to report enrollment reporting changes accurately. During the year, there were underlying problems with how data was being submitted to the National Student Clearinghouse (NSC), resulting in enrollment status changes and degree confirmations to be inaccurate for 4 students tested out of 40 students tested (10% of students tested).While the University had a policy in place to ensure enrollment reporting for degree confirmations and status changes were being submitted to the NSC, there was a flaw in the University’s process that caused the fall graduate batch of students to be initially coded to “G-Not Applied” in the National Student Loan Data System (NSLDS). This was due to an error in the upload compared with underlying information in the NSLDS system. When the next batch of students were submitted to the NSLDS, this resulted in all “G-Not Applied” students to auto-update to “Withdrawn” in the NSLDS system. CRITERIA: For the Federal Pell Grant Program, 34 CFR Section 690.83(b)(2) requires an institution to submit in accordance with deadline dates established by the secretary, through publication in the Federal Register, other reports and information the secretary requires and shall comply with the procedures the secretary finds necessary to ensure that the reports are correct. For the Federal Direct Student Loans, 34 CFR Section 685.309(b) requires changes in student status to be reported to the NSLDS in accordance with enrollment reporting in transmissions sent to the NSLDS, including updating all flagged information by NSLDS. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is accurate. CAUSE AND EFFECT: University officials indicated staff turnover required reassessment of internal documentation and procedures that were in place to ensure all required campus-level data and program-level data was being reported to NSLDS via NSC accurately due to a flaw in their process causing degree confirmations to be overridden. Inadequate Internal Control over Student Enrollment Reporting (Continued) Without sufficient controls around enrollment reporting there is a greater risk that student enrollment data will not be reported accurately. Inaccurate reporting of student enrollment data can result in inconsistencies between the University’s records and the National Student Loan Data System as well as potential delays in the repayment of federal loans. (Finding Code No. 2025-001, 2024-001, 2023-001, 2022-002) RECOMMENDATION: We recommend the University implement controls to ensure that all enrollment status changes and degree confirmations are being appropriately reported through NSC to NSLDS and that submissions of degree confirmations to NSC are appropriate to ensure enrollment status changes are reported accurately. UNIVERSITY RESPONSE: The University agrees wth the finding. The University is implementing enhanced internal controls to ensure enrollment status changes and degree confirmations are being appropriately submitted and reported.

Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063, 84.268, 84.007, 84.379 Program Expenditures: $32,514,420 Program Name: Federal Pell Grant Program, Federal Direct Student Loans, Federal Supplemental Education Opportunity Grants, Teacher Education Assistance for College and Higher Education Grants Award Number(s): P063P231391, P063P241391, P063P251391, P268K241391, P268K251391, P007A241313, P379T241391, and P379T251391 Questioned Costs: None CONDITION: Western Illinois University (University) did not have adequate procedures in place to complete accurate and timely return of Title IV funds for all students within the required time period. During our testing of borrowers that withdrew from the University, we noted 7 out of 40 (17.5%) students return of Title IV funds were not processed within the 45 day window, ranging from 60-163 days late. The sample was not a statistically valid sample. CRITERIA : A school participating in Title IV aid programs must establish and maintain proper administrative and fiscal procedures and initiate returns accurately within 45 days after the determined date of withdrawal (34 CFR 668.173(b)), and accurately calculate the amount of unearned title IV assistance to be returned to the Department of Education (34 CFR 668.22(g)). Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure the return of Title IV funds is accurate and timely. CAUSE AND EFFECT: University management indicated staffing shortages as well as regulatory and systemic changes during the 2024-2025 aid year caused this to occur. Without sufficient controls in place to return Title IV funds, there is a greater risk that the school does not return funds timely or accurately or that students may not receive post-withdrawal disbursements timely or accurately. (Finding Code No. 2025-002, 2024-002, 2023-002) RECOMMENDATION: We recommend the University implement controls to ensure that all refunds of Title IV funds are initiated within 45 days of the date of determination for the students withdrawal and additional controls to ensure proper review of the return of Title IV calculations. We also recommend these controls be monitored to ensure that all necessary refunds are completed within the required time frame and accurately. UNIVERSITY RESPONSE: The University agrees with the finding. The University is committed to developing a comprehensive plan to ensure compliance with return of Title IV funds policies and procedures.

Federal Agency: Department of Agriculture Assistance Listing Number: 10.310 Program Expenditures: $1,328,494 Program Name: Oilseed Pennycress: A New Cash Cover-Crop for the Midwest Award Number(s): 2019-69012-29851 Questioned Costs: None CONDITION: Western Illinois University (University) did not have adequate procedures in place to complete a timely disbursement of requested pass-through funds to subrecipients within the required time period. During our testing of payments made on requests from subrecipients, there were 2 out of 8 (25%) tested instances of the University not disbursing funds within 30 days of the payment request, as required. For the samples mentioned, the funds were sent 32 days and 120 days after the request. The sample was not a statistically valid sample. CRITERIA: Uniform Guidance (2 CFR 200.305(b)(3)) states that when the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure the timely disbursement of funds to subrecipients. CAUSE AND EFFECT: The University did not have adequate procedures in place to ensure all payments to subrecipients were made within the 30 day requirement. Without sufficient controls around return over subrecipient payments and overall cash management, there is a greater risk that the school will miss a payment to be passed through to the subrecipient, thus understating expenditures on the Schedule of Expenditures of Federal Awards. (Finding Code No. 2025-003) RECOMMENDATION: We recommend the University implement controls to ensure that all payments to be passed through to subrecipients are identified and paid within the required time frame. UNIVERSITY RESPONSE: The University agrees with the finding. The University is committed to developing a comprehensive plan to ensure compliance with payment of pass-through funds policies and procedures.

Criteria or Specific Requirement: Entities receiving federal awards must identify in its accounts all federal awards expended and report those amounts on the Schedule of Expenditures of Federal Awards for the period the federal award was expensed. Specifically, in accordance with Uniform Administrative Requirements outlined in 2 CFR 200, the guidance states: • Per 2 CFR 200.502, the determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs. • Per 2 CFR 200.303, entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. • In addition, per 2 CFR 200.510, the Schedule of Expenditures of Federal Awards (SEFA) must be prepared to reflect the awards for the period covered by the auditee’s financial statements. 2 CFR 200.510 also states that for costs to be allowable, they should be determined in accordance with generally accepted accounting principles (with exceptions provided in that part). Condition: The University’s year-end cutoff controls allowed for certain costs from Fiscal Year 2023 and Fiscal Year 2024 to be reported in the Fiscal Year 2025 SEFA. Context: During our testing of 40 payroll transactions, we found 1 instance of payroll related expenses that were incurred during Fiscal Year 2023 being charged to the federal program in Fiscal Year 2025 and 12 instances of payroll related expenses that were incurred during Fiscal Year 2024 being charged to the federal program in Fiscal Year 2025. Questioned Costs: Known amounts of Fiscal Year 2023 costs included in the Fiscal Year 2025 SEFA was $813 and known amounts of Fiscal Year 2024 costs included in the Fiscal Year 2025 SEFA was $23,838. Cause: Per the University, the cause for the 13 exceptions was due to the University improperly identifying the awards as State funded at inception. During Fiscal Year 2025, the University discovered that the award through the State of Oregon was Federally funded and re-indexed costs previously recorded on the State award indexes to Federal award indexes. During the re-indexing of these costs, the transaction dates of costs that were incurred during Fiscal Year 2023 and Fiscal Year 2024 were recorded with dates in Fiscal Year 2025 causing them to be included in the Fiscal Year 2025 SEFA. Effect: The University was out of compliance as it relates to identifying and reporting federal costs in the period incurred. Repeat Finding: No Recommendation: We recommend that the University evaluate its cutoff procedures to ensure that federal costs are identified and reported in the correct fiscal year. We also recommend that the University evaluate its internal controls to ensure that federal awards are properly identified as such at inception. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria: Management is responsible for the preparation and fair presentation of the financial statements in accordance with U.S. generally accepted accounting principles (GAAP), including the proper timing of revenue recognition for costreimbursement grants in accordance with Accounting Standards Codification (ASC) 958. In addition, 2 CFR 200.303 – Internal Controls requires nonfederal entities to establish and maintain effective internal control over financial reporting and compliance to provide reasonable assurance that transactions are recorded in the proper accounting period. Further, 2 CFR 200.510(b) requires the auditee to prepare a Schedule of Expenditures of Federal Awards (SEFA) that accurately reflects federal expenditures for the fiscal year. Condition: During the audit, it was identified that cash received from federal granting agencies under cost-reimbursement grants prior to year-end were appropriately recorded as refundable advances; however, reimbursable expenditures incurred prior to year-end were not fully recognized as contribution revenue and federal expenditures in the appropriate fiscal year. As a result, audit adjustments were required to recognize contribution revenue and federal expenditures related to costs incurred prior to year-end and to update the SEFA to reflect the corrected expenditures. The updated SEFA resulted in an additional federal program being identified as a major program subject to audit. Cause: Internal controls were not sufficiently designed to ensure that reimbursement requests submitted to federal granting agencies were evaluated and incorporated into the revenue recognition and SEFA preparation process. Specifically, while cash received in advance was properly recorded as refundable advances, management did not have a control in place to identify reimbursable expenditures incurred prior to year-end and convert refundable advances to contribution revenue and federal expenditures in the appropriate fiscal period. Effect: Failure to recognize reimbursable grant revenue and federal expenditures in the proper fiscal year resulted in the understatement of contribution revenue and federal expenditures, including amounts reported on the SEFA, prior to audit adjustments. This condition affected the determination of major programs and increased the risk that federal awards may not be accurately reported for audit purposes. Questioned Costs: None. Recommendation: We recommend that management strengthen internal controls over cost-reimbursement grant accounting by implementing procedures to ensure that reimbursable expenditures are identified, reviewed, and recorded in the appropriate fiscal year. This should include reconciliation of reimbursement requests, refundable advances, recorded revenue, and amounts reported on the SEFA, along with documented supervisory review of year-end cutoff procedures. Views of Responsible Officials: Management acknowledges the above finding and will continue to enhance its year-end grant review and reconciliation procedures. During the year ended June 30, 2025, management implemented enhanced grant accounting practices, including engaging an outsourced accounting firm. Management also clarified roles and responsibilities related to federal reporting requirements and implemented additional oversight and training. Management remains committed to the ongoing improvement of internal controls over federal grant reporting and compliance.

Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Section 811 - Project Rental Assistance Program Assistance Listing Number: 14.326 Federal Award Identification Number and Year: IL06RDD1201 - 2012; IL06RDD1301 - 2013; IL06RDD1901 - 2019 Pass-Through Agency: State of Illinois Pass-Through Number: IL902 Award Period: July 1, 2024 to June 30, 2025 Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-001 Failure to Adequately Monitor Subrecipients CONDITION The Illinois Housing Development Authority (Authority) did not follow its established policies and procedures for monitoring subrecipients of the Section 811 Project Rental Assistance (Section 811) program. The Authority has implemented procedures whereby program staff perform property inspections over subrecipient compliance with regulations applicable to the Section 811 program. The Authority’s policies require the subrecipient to have an inspection every three years. During our testing of the monitoring of subrecipients, we noted one of eight (13%) subrecipients (with expenditures of $319,404 during the year ended June 30, 2025) had not received an inspection within the required three-year period in accordance with Authority policy. The most recent inspection for this subrecipient was conducted in fiscal year 2019. This sample was not intended to be, and was not, a statistically valid sample. CRITERIA OR SPECIFIC REQUIREMENT According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include ensuring inspections are performed in a timely manner. CAUSE Authority management indicated there are three underlying causes for this audit finding: 1) Increased volume in required inspections - the annual volume of required inspections in fiscal year 2025 was 56% higher than the annual required inspections in fiscal year 2020 while staffing remained constant. 2) COVID-19 Waivers - In 2020, the Internal Revenue Service issued COVID-19 waivers that eliminated physical inspection requirements and allowed a calendar “reset” for Low Income Housing Tax Credit transactions until 2023. The result of the increased volume and calendar “reset” created a significant backlog of physical inspections due. 3) Inadequate controls – lack of quality control procedures to ensure the inspection reports were completed and filed appropriately. EFFECT Failure to adequately perform inspections of subrecipients may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. (Finding Code No. 2025-001) RECOMMENDATION We recommend the Authority improve its internal controls to ensure inspections are completed in accordance with established policies and procedures. AUTHORITY RESPONSE The Authority agrees with the finding. The Authority will implement additional internal controls, including quality control of completed inspection, documentation, and inspection scheduling. Additionally, the Authority recognizes that the volume of required annual inspections has increased beyond existing Full Time Equivalent (FTE) capacity; therefore, an RFP for the third-party inspection vendor has been issued to supplement internal resources and support timely completion of inspections.

Special Tests – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ASSISTANCE LISTING Number: 84.268 – Federal Direct Student Loans 84.063 – Federal Pell Grant Program Federal Award Identification: Various Award Period: June 1, 2024 to June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matter Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035) (Pell, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309). Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. There are two categories of enrollment information; “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that roster file. The University must also have an adequate process to internally review submissions to either the third-party servicer or directly to NSLDS. Additionally, Institutions are required to ensure adequate internal controls over compliance are established and maintained in accordance with 2 CFR 200.303. Condition: During our testing of the Direct Loan and Pell Grant programs, we selected a sample of 40 student enrollment changes to test for timeliness and accurate reporting of student status changes to the National Student Loan Data System (NSLDS). Our testing resulted in the following items of noncompliance. 1. 1 student enrollment changes where the enrollment status effective date was not correctly reported to NSLDS. 34 CFR 685.309 (b)(1) and 34 CFR 690.83(b)(2) 2. 5 instances where a student’s enrollment status change was not reported timely to NSLDS. 34 CFR 685.309(b)(1) and 34 CFR 690.83(b)(2) 3. 1 student enrollment change where status change was not reported to NSLDS. 34 CFR 685.309(b)(1) and 34 CFR 690.83(b)(2) Questioned costs: N/A Context: Out of a sample of 40 enrollment changes selected for testing for the requirement noted above, we noted 6 students with exceptions. 1 student had multiple instances of noncompliance. Cause: The university was unaware of the errors which were caused by the transmission of date between their student information system and the third-party servicer. Effect: The NSLDS system could not be updated accurately or timely with student enrollment information. Repeat finding: Yes 2024-001 Recommendation: We recommend that the University enhance its policies and procedures regarding enrollment reporting including additional monitoring over the third-party service provider to ensure that reporting is completed accurately and timely. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.

Program: WIC Special Supplemental Nutrition Program for Women, Infants, and Children Federal Financial Assistance Listing Number: 10.557 Federal Grantor: U.S. Department of Agriculture Passed-Through: California Department of Public Health Award No. and Year: 22-10270 A03 and 2022 Compliance Requirements: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR Section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR Section 200.430, Compensation – Personal Services, states that charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Condition: During our testing of the HCA’s provisions for activities allowed or unallowed and allowable costs/cost principles requirements, we noted that for one (1) of sixty (60) payroll samples tested, the employee was able to review and approve their own timecard. Cause: It was determined that the control deficiency resulted from a system configuration error that permitted the employee to approve their own timecard under the supervisor/manager review role. Effect: Failure to consistently apply internal controls over payroll charges increases the risk that unallowable or unsupported payroll costs could be charged to the Federal program and not be detected in a timely manner. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sampling of sixty (60) timecards was selected for testing out of a population of 1,144. The condition noted above was identified during our procedures related to activities allowed or unallowed and allowable costs/cost principles. Repeat Finding from Prior Years: No. Recommendation: Management should ensure appropriate segregation of duties within the payroll system by restricting approval authority to independent supervisors or managers and implementing controls to prevent self-approval. In addition, management should periodically review user access roles and system configurations to confirm that approval controls are operating as designed and that payroll charges to Federal programs are allowable, properly allocated, and adequately supported. Views of Responsible Officials: See separately issued Corrective Action Plan.

Program: Refugee and Entrant Assistance State/Replacement Designee Administered Programs Federal Financial Assistance Listing Number: 93.566 Federal Grantor: U.S. Department of Health and Human Services Pass Through: California Department of Social Services Award No. and Year: Various Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance and Instance of Noncompliance Criteria: 2 CFR Section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 45 CFR Part 400, prescribes the eligibility conditions refugees must meet to receive RCA including the following: • RCA recipients must meet the general eligibility requirements for immigration status and refugee identification in accordance with 45 CFR §400.40 - §400.44. • RCA is limited to refugees who are ineligible for TANF, SSI, OAA, AB, APTD, and AABD in accordance with 45 CFR §400.53. • Mandatory work registrants must comply with work requirements and may not voluntarily quit or refuse suitable employment within 30 days prior to application; benefits must be terminated when requirements are not met (45 CFR §§400.75(a), 400.77, and 400.82(a)). • RCA payments may not exceed ORR-authorized rates and may not be less than the State TANF payment rate (45 CFR §§400.60(b) and 400.60(d); ORR PL 22-01). Condition: During our testing of the Social Service Agency’s (SSA) compliance with eligibility and allowable cost/cost principles, we noted the following: • One (1) instance of payment issued to a participant who did not meet eligible immigration status requirements. • One (1) instance of payment issued to a participant who was eligible for another federally funded cash assistance program. • One (1) instance of payment issued to a participant who failed to meet the mandatory work registrant requirements within the required time frame. • One (1) instance of payment issued to a participant using an incorrect benefit rate. Cause: Controls over eligibility determination and benefit rate calculation were not consistently applied, including insufficient verification and supervisory review of eligibility criteria and payment amounts. Effect: Program funds were expended for ineligible participants and an incorrect benefit rate was used, increasing the risk of noncompliance with federal requirements. Questioned Costs: Questioned costs for cases tested in which we determined to be ineligible to receive cash assistance was $1,814. Context/Sampling: A nonstatistical sample of sixty (60) out of all active program participants were sampled. For ineligible cases, we have projected questioned costs against the remaining population for a total of $24,276. The underpayment related to an incorrect benefit rate used was not projected as questioned costs as this did not result in an over-expenditure of federal funds. The condition above was identified during our procedures over eligibility, activities allowed or unallowed, and allowable costs/cost principles testing. Repeat Finding from Prior Years: Yes. Recommendation: We recommend that the SSA department strengthen its internal controls to ensure that program eligibility criteria and benefit determinations are properly supported. Views of Responsible Officials: See separately issued Corrective Action Plan.

Program: HIV Emergency Relief Project Grants (Ryan White) Federal Financial Assistance Listing Number: 93.914 Federal Grantor: U.S. Department of Health and Human Services Award No. and Year: 6H89HA00019-32-04; 2024 Compliance Requirements: Activities Allowable or Unallowed and Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR Section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR Section 200.430, Compensation – Personal Services, states that charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Condition: During our testing, for one (1) out of sixty (60) payroll expenditures, we noted the timecard did not contain documented evidence of supervisory approval. Cause: The County’s internal control procedures were not consistently followed to ensure that the review and approval of timecards was documented. Effect: Lack of documented review for personnel hours could lead to an increased risk that unallowable or inaccurate activities and costs to be charged to the Federal program. Question Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sampling of sixty (60) timecards were selected for testing out of a population of 5,994. The condition noted above was identified during our procedures related to activities allowed or unallowed and allowable costs/cost principles. Repeat Findings from Prior Years: No. Recommendation: We recommend that the County strengthen its policies and procedures to ensure that timecards consistently include documented evidence of supervisor approval prior to payroll processing. The County should also establish compensating controls for circumstances where timely supervisory approvals is not possible, and ensure such controls are consistently documented. Views of Responsible Officials: See separately issued Corrective Action Plan.

Program: Congressionally Recommended Awards / HOME Investment Partnerships Program / Homeland Security Grant Program / Epidemiology and Laboratory Capacity for Infectious Disease Federal Financial Assistance Listing Number: 16.753 / 14.239 / 97.067 / 93.323 Federal Grantor: U.S. Department of Justice / U.S. Department of Housing and Urban Development / U.S. Department of Homeland Security / U.S. Department of Health and Human Services Award No. and Year: Multiple Compliance Requirements: Other – Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) §200.510(b) - Schedule of Expenditures of Federal awards Type of Finding: Material Weakness in Internal Control Over Compliance Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) §200.510(b) states that the auditee (the County) must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee’s financial statements, which must include the total federal awards expended as determined in accordance with §200.502. §200.331 of the Uniform Guidance states the County is responsible for making case-by-case determinations to determine whether the entity receiving the Federal funds is a subrecipient. In addition, §200.303 of the Uniform Guidance states that the County must establish and maintain effective internal control over the federal awards, including controls over the accuracy of program information and expenditure amounts. Condition: During our audit procedures performed over the SEFA we noted the following: • The Sheriff-Coroner Department did not properly identify the amount expended for the Congressionally Recommended Awards, AL No. 16.753. The expenditures reported by the Department were overstated by $2,638,516. • The Orange County Community Resources Department did not properly identify the amount of Federal funding passed through to subrecipients for the HOME Investment Partnerships Program, AL No. 14.239. The amount passed through to subrecipients reported by the Department was overstated by $4,500,624. • The Sheriff-Coroner Department did not properly identify the amounts expended for the Homeland Security Grant Program, AL No. 97.067. The expenditures reported by the Department were overstated by $715,489. • The Orange County Health Care Agency (HCA) did not properly identify the amount expended for the Epidemiology and Laboratory Capacity for Infectious Disease program, AL No. 93.323. The expenditures reported by the Agency were overstated by $486,000. Cause: As a result, the County lacked adequate internal controls to ensure the SEFA is completely and accurately stated. Specifically, the County’s processes for recording and tracking expenditures of Federal awards are not designed so that expenditures are identified when incurred. In addition, the County’s processes for identifying and reporting subrecipients are not designed to ensure appropriate reporting on the SEFA. Effect: Adjustments to the SEFA were required. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: No sampling was used. Program expenditures and amounts passed through to subrecipients were reconciled to the supporting records. Repeat Finding from Prior Years: No. Recommendation: The County, including all its reporting departments, should follow existing policies, procedures and internal controls to ensure all expenditures and amounts passed through to subrecipients are accurately tracked and reported on the SEFA. Personnel knowledgeable of federal expenditures should review amounts coded to federal programs for completeness and accuracy. The SEFA should be prepared and reviewed in a timely manner and reconciled to underlying records as well as the basic financial statements. Views of Responsible Officials: See separately issued Corrective Action Plan.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Criteria or Specific Requirement: Per 2 CFR section 200.303(a), a nonfederal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During the audit, it was observed that the University did not have adequate segregation of duties in its financial aid office and did not maintain supporting documentation. The Director of Financial Aid prepares is responsible for authorizing, processing, and reviewing transactions related to Title IV funds. Questioned Costs: N/A Context: Effective internal controls are crucial to ensure funds are properly managed and disbursed. There are instances where the Director of Financial Aid is reviewing and approving financial aid packages, reconciliations and other required reports. We also noted instances were supporting documentation could not be provided. Cause: The University’s financial aid processes have overlapping responsibilities which has resulted in inadequate segregation of duties. Effect: The absence of proper segregation of duties increases risk for errors, noncompliance, and inaccuracies in awarding and reporting of Title IV funds. Repeat Finding: No Recommendation: We recommend the University implement additional internal controls to ensure proper segregation of duties. This includes hiring additional staff or redistributing responsibilities to separate the functions of authorizing, processing, and reviewing transactions. Additionally, ongoing training should be provided to financial aid staff on the importance of internal controls and compliance with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding and the University is in the process of implementing corrective procedures. Federal Award Identification Number: P007A243144, P063P241946, P033A243144, P268K251946 Award Period: July 1, 2024 – June 30, 2025 Type of Finding: Material Weakness in Internal Control over Compliance