Findings Citing § 200.303

Reference Number: 2025-005 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: 23A55WP000005 (7/1/2023 – 9/30/2026) 24A55WP000063 (7/1/2024 – 9/30/2027) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Four of forty timesheets selected for testing charged costs to the program based on budgeted rates instead of actual time worked per employee timesheets. Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Specifically, we noted the following: • 2 of 40 employee timesheets selected for testing did not use combination codes and the employees’ time was defaulted to a budgeted grant allocation rather than the employees’ actual time and effort on the program. • 2 of 40 employee timesheets selected for testing had a bilingual differential and were missing combination codes. The payment was not based on the employee’s timesheet but instead was based on a budgeted percentage of time. One employee’s time was overcharged by 25% and the other was overcharged by 40%. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Questioned costs: $5,389, the amount overcharged to the program based on budgeted time rather than actual time recorded on employee timesheets. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-006 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: 23A55WP000005 (7/1/2023 – 9/30/2026) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s); in this case, Employment Service and Unemployment Insurance Programs (Employment Service Cluster). Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: One of seven ETA 9130 reports selected for testing did not agree with supporting documentation. Specifically, unliquidated obligations reported for program FES2024 in the 6/30/2024 quarter did not agree to underlying records. Cause: The Department’s procedures were not sufficient to ensure that the ETA 9130 report was accurate and agreed with supporting documentation. Internal controls did not prevent or detect the error. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-007 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) Compliance Requirement: Reporting – ETA 2112, UI Financial Transaction Summary Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 2112, UI Financial Transaction Summary (OMB No. 1205-0154) – Per ET Handbook 401, 5th Edition, Form ETA 2112 is a monthly summary of transactions in a state unemployment fund which consists of the Clearing Account, Unemployment Trust Fund (UTF) Account, and Benefit Payment Account. All payments by employers (and employees where applicable) into a state unemployment fund for contributions, payments in lieu of contributions, and special assessments should be accounted for in the report. Penalty and interest should be reported if deposited into the clearing account and transferred to the UTF. Funds received from the Federal Employees Compensation Account (FECA) and the Extended Unemployment Compensation Account (EUCA) as advances or reimbursements for Federal benefit obligations paid through the benefit payment account should be identified and reported in appropriate line items. All funds deposited into, transferred, or paid from the state unemployment fund (the state clearing account, the state account in the UTF, and the state benefit payment account) should be reflected on the ETA 2112 except for payments/benefits paid under the Alternative Trade Adjustment Assistance (ATAA) and Trade Adjustment Assistance (TAA) programs. Form ETA 2112 provides a summary of data pertaining to state unemployment insurance (UI) tax collections, regular benefits paid, Federal and state shares of extended benefits paid, Federal temporary program benefits paid, and other transactions affecting the UTF. In addition, it reflects specific areas where adjustments are indicated to determine the adequacy of resources available for regular unemployment benefit payments. Data from this form are also used with data from other statistical reports to study trends in financial aspects of the UI program and as a basis for solvency studies. This report is due the 1st day of the second month following the month of reference. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 2112, UI Financial Transaction Summary reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Four ETA 2112 reports were selected for testing. For 2 of the 4 reports tested, we noted the following exceptions: • For 1 of the 4 reports tested, the incorrect amount was reported on Line 28 (Other Sources #4) for Item D. Clearing Account. The report was overstated by $56,283. • For 1 of the 4 reports tested, the amounts on Line 11 (Net UI Contributions), Line 19 (Reimb Local Govt/Indian Tribes) and Line 21 (Reimbursement Non-Profit) under Item D. Clearing Account did not agree to supporting documentation. While the total amount agrees overall, each individual line item does not reconcile to the supporting documentation. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that ETA 2112 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Recommendation: The Department should review its procedures to ensure that ETA 2112 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-008 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) Compliance Requirement: Reporting – ETA 2208A – Quarterly UI Above-Base Report Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: ETA 2208A, Quarterly UI Above-Base Report (OMB No. 1205-0132) – Quarterly report of staff years worked and paid by program category. Reports are due no later than 30 days after the end of each quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 2208A – Quarterly UI Above-Base Reports submitted by the Executive Office of Labor and Workforce Development (Department) contained multiple data entry and calculation errors. Context: Three ETA 2208A reports were selected for testing for each of the 9/30/2024 and 12/31/2024 quarters for a total of six ETA 2208A reports tested. The ETA 2208A is commonly referred to as the “UI‑3,” which is the legacy name for the report. Exceptions were identified in 2 of the 6 reports selected for testing. Specifically, we noted the following: • For 1 of 3 reports selected for the 9/30/2024 quarter, the incorrect number was input on "Line 1 Initial Claims" of the ETA UI-3 Additional Benefits report. The total workload reported was 232 and should have been 268. In addition, "Line 2 weeks claims" for the UI-3 Additional Benefits report was incorrectly reported. The number on the underlying support was 3,661 and the reported total workload was 3,361. • For 1 of 3 reports selected for the 12/31/2024 quarter, the incorrect number was input on "Line 1 Initial Claims" of the UI-3 Additional Benefits report. The total workload reported was 233 and should have been 305. In addition, the underlying support for “Line 1. Initial Claims” reported total workload of 1 for Unemployment Compensation for Federal Employees for the month of December 2024, but should have been reported as 0. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that ETA 2208A reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Recommendation: The Department should review and update its reporting procedures and controls to ensure that ETA 2208A reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-009 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) Compliance Requirement: ETA 9052 – Nonmonetary Determination Time Lapse Detection Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it takes states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant non-monetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department was unable to provide documentation that the ETA 9052 – Nonmonetary Determination Time Lapse Detection report was submitted timely. Context: Four monthly ETA 9052 reports were selected for testing. Specifically, we noted the following: • For 1 of 4 reports selected for testing, the Department was unable to provide support that the report was submitted timely. The report for the month of May 2025 had a submission due date of June 20, 2025. The Department did not maintain a copy of the original report and auditors were unable to verify the submission date. After the original submission, the Department discovered a reporting error caused by a system transition, and the Department submitted a revised report on July 22, 2025. Questioned costs: Undetermined. Cause: The Department’s internal controls were insufficient to ensure that copies of submitted reports were retained. Effect: The untimely submission of required federal reports resulted in noncompliance with federal reporting requirements. Recommendation: The Department should review and update its reporting procedures and controls to ensure that ETA 9052 - Nonmonetary Determination Time Lapse Detection reports are submitted timely and that copies of report submissions are maintained and are readily available for audit. Reports should be reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-010 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 24A55UI00054 (10/1/2023 – 12/31/2026) Compliance Requirement: Reporting – ETA 9130, Financial Status Report, UI Programs Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: ETA 9130, Financial Status Report, UI Programs (OMB No. 1205-0461) – The ETA 9130 report is used to report program and administrative expenditures. All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UI Projects (administration and benefits). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130, Financial Status Reports for UI Programs submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Eight ETA 9130 reports were selected for testing. For 1 of the 8 reports tested, we noted the following exception: • Expenditures related to the Interdepartmental Service Agreements (ISA) object class were not included in “Line G Federal Share of Unliquidated Obligations” of the report. The supporting documentation for the report included the object class ISA in the amount of federal share of unliquidated obligations; however, this was not included in the report. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-011 Prior Year Finding: 2024-005 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). BAM estimates error rates, number of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not complete BAM case investigations within the time limits established in the ET Handbook No. 395. Context: Sixty cases were selected for testing. The Department did not meet the required time limits for closing cases within 90 days. We noted that 92% of cases tested (55 of 60 cases) were closed within 90 days, which is less than the required 95%. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met the required BAM investigation time limits for closing cases. Auditors note that the Department’s corrective action plan from the prior audit had not yet been fully implemented in FY 2025. Effect: Noncompliance with BAM case investigation time limits could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-012 Prior Year Finding: 2024-006 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) 23A60UR000009 (1/1/2023 – 9/30/2025) 24A60UR000073 (1/1/2024 – 9/30/2026) 25A60UR000122 (1/1/2025 – 6/30/2027) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. RESEA-related performance reports are due on the 20th day of the second month following the end of the reporting quarter. A state UI staff member must review these reports for accuracy each calendar quarter and prior to submission, in addition to being reviewed by the RESEA program lead (if a different staff member). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not review performance reports prior to submission. Context: The Department lacks a formalized process for validating the accuracy of quarterly performance reports. Consequently, there was no documentation available to confirm that these reports were reviewed prior to submission. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met RESEA program and reporting requirements. The Department does not have a formal process to validate the accuracy of quarterly performance reports. Auditors note that the Department’s corrective action plan from the prior audit had not yet been fully implemented in FY 2025. Effect: The Department was unable to demonstrate that it was operating the RESEA program in accordance with federal requirements. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. We recommend the Department review and enhance procedures and controls to ensure that RESEA program requirements are met. We further recommend the Department develop a formal process to review quarterly performance reports for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-013 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) Compliance Requirement: Special Tests and Provisions: UI Program Integrity – Overpayments Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: States are (1) required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments, and (2) states are prohibited from providing relief from charges to an employer’s Unemployment Insurance (UI) account when overpayments are the result of the employer’s failure to respond timely or adequately to a request for information. States may continue to waive recovery of overpayments in certain situations and must continue to offer the individual a fair hearing prior to recovery. In addition, states may approve “blanket waivers” where individuals are eligible for payment under an unemployment benefit program for a given week, but through no fault of the individual, they were paid incorrectly under either the PUA or PEUC program at a higher WBA, or specific to PUA, when, through no fault of the individual, the state paid the individual a minimum WBA based on DUA guidance other than UIPL No. 03-20 (UIPL No. 20-21, section 4.d.ii). Program requirements for overpayments include the State must identify the basis for the overpayment consistent with its written procedures. An overpayment memorandum is created summarizing the details of the overpayment and submitted to UI cross-match staff or claims deputy for review. Upon review, the overpayment is established, and a Deputy Decision or WVUC-B-14-J Overpayment Determination is generated and sent to the claimant. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was not in compliance with program requirements for recovering overpayments. Context: Sixty overpayment claims were selected for testing. For 10 of 60 claims selected for testing we noted multiple errors were identified regarding overpayments documentation and recovery. Specifically, we noted the following: • For 5 of 60 claims, the claim was the result of a claimant error related to fault or fraud. The claimant was not being charged interest on the overpayment as required. • For 3 of 60 claims, the incorrect cause of the overpayment was reported in the system. • For 1 of 60 claims, there was a penalty balance charged to the claimant although the overpayment was not the result of fault or fraud. Questioned costs: Undetermined. Cause: The Department’s procedures and controls are not sufficient to ensure that overpayments are recovered in accordance with program requirements. Staff are not adequately trained in proper handling of overpayment documentation and recovery. Effect: Failure to recover overpayments in accordance with federal requirements compromises the integrity and sustainability of the UI program. Unrecovered overpayments reduce funds available to pay legitimate benefits, increase the risk of fraud and improper payments, and undermine compliance with federal program standards. Recommendation: The Department should perform staff training and strengthen its procedures and controls to ensure overpayments are identified, recorded, and recovered in a timely manner and in full compliance with federal requirements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-014 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (4/1/2022 – 6/30/2025) 23A55AW000048 (7/1/2023 – 6/30/2026) 23A55AY000020 (4/1/2023 – 6/30/2026) 23A55WP000005 (7/1/2023 – 9/30/2026) 24A55WP000063 (7/1/2024 – 9/30/2027) 25A55WP000139 (7/1/2025 - 9/30/2028) 24A55WG000092 ((7/1/2024 – 9/30/2027) 23A55WG000028 (7/1/2023 – 9/30/2026) ES387362255A25 (7/1/2022 - 9/30/2025) 25555DV000114 (10/1/2024 - 9/30/2025) 24555DV000087 (10/1/2023 - 12/31/2025) 23555DV000008 (10/1/2022 - 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Indirect Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR Part 200, Appendix V, all costs and other data used to distribute costs included in the central service cost allocation plan should be supported by formal accounting and other records that will support the propriety of the costs assigned to Federal awards. Per 2 CFR Part 200, Appendix VII C.1.b., where a governmental unit's department or agency has several major functions which benefit from its indirect costs in varying degrees, the allocation of indirect costs may require the accumulation of such costs into separate cost groupings which then are allocated individually to benefitted functions by means of a base which best measures the relative degree of benefit. The indirect costs allocated to each function are then distributed to individual Federal awards and other activities included in that function by means of an indirect cost rate(s). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) was unable to provide documentation supporting the calculation of its internal negotiated indirect cost rate (NICR) which was approved by the U.S. Department of Labor and was in effect for FY 2025. Context: WIOA Cluster: For 32 of 40 reimbursement requests selected for testing, the Department applied the approved internal NICR in effect for FY 2025. Auditors recalculated the NICR using supporting documentation provided by the Department and determined that the rate was 6.60% but the rate submitted to and approved by the U.S. Department of Labor was 4.19%. The Department was unable to provide documentation for how the 4.19% rate was calculated. Employment Service Cluster: For 32 of 40 reimbursement requests selected for testing, the Department applied the approved internal NICR in effect for FY 2025. Auditors recalculated the NICR using supporting documentation provided by the Department and determined that the rate was 6.60% but the rate submitted to and approved by the U.S. Department of Labor was 4.19%. The Department was unable to provide documentation for how the 4.19% rate was calculated. Cause: The Department’s procedures and internal controls were not operating effectively to ensure that it properly calculated its NICR nor that it maintained appropriate documentation supporting the rate calculation. The department indicated the lack of supporting documentation for the 4.19% rate was due to staff turnover. Effect: The rate supported by documentation was 6.60%, but the rate submitted to the U.S. Department of Labor was 4.19%, resulting in the Department receiving lower indirect cost reimbursement than it was entitled to. Questioned costs: None. The approved indirect cost rate was properly applied, but was lower than the rate calculated using supporting documentation. Recommendation: The Department should review and enhance its procedures and internal controls regarding the calculation of its negotiated indirect cost rate and for maintaining documentation supporting the rate calculation. This documentation should be readily available for audit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-015 Prior Year Finding: 2024-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AW000097 (7/1/2024 – 6/30/2027) AA-38535-22-55-A-25 (4/1/2022 – 6/30/2025) 24A55AT000067 (7/1/2024 – 6/30/2027) 24A55AY000057 (4/1/2024 – 6/30/2027) 23A55AY000020 (4/1/2023 – 6/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information timely and did not have evidence of review and approval of FFATA reports prior to report submission. Context: Ten subawards were selected for testing and several of these subawards were modified after the initial award, for a total of fourteen subaward transactions tested. Nine of fourteen subaward transactions tested were not reported in accordance with FFATA requirements. Specifically, we noted the following: • 9 of 14 subaward transactions were not reported timely. The subaward transactions were reported from one to seven months after the due date. • For 2 of 14 subaward transactions, the Department was unable to produce documentation supporting review and approval of the FFATA reports prior to submission. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subaward transactions were reported timely nor that the FFATA report submissions were reviewed and approved prior to submission. Auditors note that the Department’s corrective action plan from the prior audit had not yet been fully implemented in FY 2025. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department’s procedures and internal controls should ensure that all required FFATA report submissions are reviewed, approved and subsequently reported timely no later than the end of the month following the month of issuance of the subaward or subaward modification. Documentation of implemented controls should be readily available for audit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-016 Prior Year Finding: 2024-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 23A55AT000036 (7/1/2023 – 6/30/2026) 24A55AW000097 (7/1/2024 – 6/30/2027) AA-38535-22-55-A-25 (4/1/2022 – 6/30/2025) 24A55AT000067 (7/1/2024 – 6/30/2027) 23A55AW000048 (7/1/2023 – 6/30/2026) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Nine ETA 9130 reports were selected for testing, which included three reports for the Adult program, four reports for the Dislocated Worker program, and two reports for the Youth program. For 7 of the 9 reports tested, exceptions were noted for several line items on each report. Specifically, we noted the following exceptions: • 3 of 3 reports for the Adult program did not agree to supporting documentation. The discrepancies were found in the following line items: o Federal share of expenditure o Total administration expenditures o Federal share unobligated obligations o Total program income earned o Program income expended in accordance with the addition method • 3 of 4 reports for the Dislocated Worker program did not agree to support documentation. The discrepancies were found in the following line items: o Federal share of expenditure o Total administration expenditures o Federal share unobligated obligations o Total program income earned o Program income expended in accordance with the addition method o Real property proceeds expended • 1 of 2 reports for the Youth program did not agree to supporting documentation. The discrepancies were found in the following line items: o Recapture funds expended o Program income expended in accordance with the addition method Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Auditors note that the Department’s corrective action plan from the prior audit had not yet been fully implemented in FY 2025. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-017 Prior Year Finding: 2024-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AW000097 (7/1/2024 – 6/30/2027) 23A55AW000048 (7/1/2023 – 6/30/2026) AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Two of sixty timesheets selected for testing charged costs to the program based on budgeted rates instead of actual time worked per employee timesheets. Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). For these two transactions, the employee had a bilingual differential and was missing combination codes. Payment was not based on the employee timesheets of 55% worked on the program but instead was based on a budgeted percentage of time of 100%. The program was therefore overcharged by 45% for the bilingual differential portion of the employee payroll. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Auditors note that the Department’s corrective action plan from the prior audit had not yet been fully implemented in FY 2025. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Questioned costs: $72, the amount overcharged to the program for the pay period tested for the bilingual differential. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-018 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AW000097 (7/1/2024 – 6/30/2027) 23A55AW000048 (7/1/2023 – 6/30/2026) AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Earmarking – Statewide Activities: The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under 29 USC 3164(b) or statewide employment and training activities for adults or dislocated workers under 29 USC 3174(a) (29 USC 3163(a), 128 Stat. 1502). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) does not have procedures to ensure it does not exceed the 15% limit for statewide activities. Context: The Department does not have controls in place to track or monitor the Governor's Discretionary Funds (GDF) to ensure expenditures charged against this allotment, whether through direct timesheets or payroll adjustments, do not exceed the required 15% limit across all programs within the WIOA Cluster. Cause: The Department lacks sufficient procedures or controls to ensure that it does not exceed the 15% limit for statewide activities. Effect: Failure to track or monitor the GDF could result in the Department exceeding the 15% limit for statewide activities. Questioned costs: None noted. The Department did not exceed the 15% limit. Recommendation: We recommend the Department develop procedures and controls to ensure expenditures coded to the GDF from timesheets or manual adjustments do not exceed the 15% limit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-019 Prior Year Finding: 2024-014 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (4/1/2022 – 6/30/2025) 23A55AY000020 (4/2/2023 – 6/30/2026) 23A55AT000036 (7/1/2023 – 6/30/2026) 23A55AW000048 (7/1/2023 – 6/30/2026) 24A55AY000057 (4/1/2024 – 6/30/2027) 24A55AT000067 (7/1/2024 – 6/30/2027) 24A55AW000097 (7/1/2024 – 6/30/2027) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued to their subrecipients. Context: For six of six subawards selected for testing, the subaward agreement did not include the federal award date for when the Federal agency awarded the funds to the prime recipient. Cause: The Department’s procedures and internal controls were not sufficient to ensure that subawards included all required information in accordance with 2 CFR section 200.332. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program information and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. In its FY 2024 corrective action plan, the Department indicated that it had revised its documented internal controls and procedures to correct the prior year finding. We recommend that the Department revisit its procedures and controls and update as needed to ensure that the federal award date is included in all subaward agreements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund COVID-19 – American Rescue Plan-Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/6/2021 – 3/31/2025) S425U210025 (3/4/2021 – 3/28/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information in accordance with FFATA requirements. Context: Twelve of forty subawards selected for testing were not reported timely. The subawards were reported from 1 day to 423 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported no later than the end of the month following the month of issuance. Effect: Subawards were not reported timely in accordance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately no later than the end of the month following the month of issuance of each subaward. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Aging and Independence Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2201MAOAPH (10/1/2021 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2201MAOANS (10/1/2021 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) 2301MAOAPH (10/1/2022 - 9/30/2025) 2301MAOASS (10/1/2022 - 9/30/2024) 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOACM (10/1/2023 - 9/30/2025) 2401MAOAHD (10/1/2023 - 9/30/2025) 2501MAOANS (10/1/2024 - 9/30/2026) 2501MAOASS (10/1/2024 - 9/30/2026) 2501MAOACM (10/1/2024 - 9/30/2026) 2501MAOAHD (10/1/2024 - 9/30/2026) Compliance Requirement: Reporting - Financial Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Standard Form 425 - The submission of interim federal financial reports (FFR) will be on a quarterly, semi-annual, or annual basis, as directed by the Federal agency. A final FFR shall be submitted at the completion of the award agreement. The following reporting period end dates shall be used for interim reports: 3/31, 6/30, 9/30, or 12/31. For final FFRs, the reporting period end date shall be the end date of the project or grant period. Quarterly and semi-annual interim reports shall be submitted no later than 30 days after the end of each reporting period. Annual reports shall be submitted no later than 90 days after the end of each reporting period. Final reports shall be submitted no later than 90 days after the project or grant period end date. Administration for Community Living (ACL)/Administration of Aging (AoA) Title III Supplemental Form to SF-425: Final reports should be marked on the supplemental when a final has been submitted in the current and/or prior reporting periods. State Agencies are required to complete the Supplemental Form to the SF-425 Title III. States which are a Single State Planning and Service Area and do not have Area Agencies on Aging (AAA) are also required to complete the ACL/AoA Supplemental Form with each submission. This includes all lines and columns, except where a line is specifically designated for an Area Agency on Aging (AAA). The totals for each Part should total back to the ITEM on the SF425 form. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Aging and Independence (Department) failed to submit Federal Financial Reports (FFRs) and Title III Supplemental Form to SF-425 as required by the program. Context: Eleven of fourteen FFRs required to be submitted by the Department during FY 2025 were not submitted. The Department submitted reports only for awards 2201MAOACM, 2201MAOAHD, and 2201MAOASS. Three of four Title III Supplemental Form to SF-425 required to be submitted by the Department during FY 2025 were not submitted. The Department only submitted a report related to 2022. Questioned costs: Undetermined. Cause: The Department does not have procedures or internal controls to ensure that FFRs and Title III Supplemental Form to SF-425 are submitted as required by the program. Effect: FFRs were not submitted for approximately 80% of the grant awards issued to the Department and Title III Supplemental Form to SF-425 were not submitted for approximately 75% of the open grant years. Recommendation: We recommend the Department develop procedures and internal controls to ensure that it submits reports for all grant awards it receives for the program, in accordance with its grant agreements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-022 Prior Year Finding: 2024-016 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Aging and Independence Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2201MAOAPH (10/1/2021 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2201MAOANS (10/1/2021 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) 2301MAOAPH (10/1/2022 - 9/30/2025) 2301MAOASS (10/1/2022 - 9/30/2024) 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOACM (10/1/2023 - 9/30/2025) 2401MAOAHD (10/1/2023 - 9/30/2025) 2501MAOANS (10/1/2024 - 9/30/2026) 2501MAOASS (10/1/2024 - 9/30/2026) 2501MAOACM (10/1/2024 - 9/30/2026) 2501MAOAHD (10/1/2024 - 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Aging and Independence (Department) did not report subaward information per FFATA requirements. Context: The Department informed auditors that no subawards were reported. Therefore, a sample was unavailable for testing. Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Auditors noted that the Department’s corrective action plan from the prior audit had not been completed. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately no later than the end of the month following the month of issuance of each subaward. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-023 Prior Year Finding: 2024-018 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Aging and Independence Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2201MAOAPH (10/1/2021 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2201MAOANS (10/1/2021 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) 2301MAOAPH (10/1/2022 - 9/30/2025) 2301MAOASS (10/1/2022 - 9/30/2024) 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOACM (10/1/2023 - 9/30/2025) 2401MAOAHD (10/1/2023 - 9/30/2025) 2501MAOANS (10/1/2024 - 9/30/2026) 2501MAOASS (10/1/2024 - 9/30/2026) 2501MAOACM (10/1/2024 - 9/30/2026) 2501MAOAHD (10/1/2024 - 9/30/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Aging and Independence (Department) issued subawards that did not contain all required federal award information, and it failed to properly monitor subrecipients. Context: Exceptions were found for eight of eight subawards selected for testing. Subawards were missing one or more required federal award identification elements and were not properly monitored. Specifically, we noted the following: • 4 of 8 subawards were missing one or more required award identification elements including the Federal Award Date, the Federal Award Identification Number (FAIN), the name of the Federal agency, the Assistance Listing number (ALN) and the federal award title, the dollar amount made available under each ALN, and the federal award project description as required by the Federal Funding Accountability and Transparency Act (FFATA). • 2 of 8 subrecipients selected for testing were not properly monitored by the Department. The Department was unable to provide documentation that it had proper monitoring procedures in place nor that monitoring procedures were followed for these subrecipients. • For 1 of 8 subrecipients, the Department did not obtain a copy of the subrecipient’s annual single audit report. Therefore, the Department did not verify that its annual single audit had been conducted, nor did it issue a management decision on audit findings. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls were not sufficient to ensure that the Department provided all required federal information to subrecipients at the time of the subaward nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Auditors noted that the Department’s corrective action plan from the prior audit had not been completed. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should review and enhance internal controls and procedures to ensure that it includes all required information in the subaward agreements. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Aging and Independence Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2201MAOAPH (10/1/2021 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2201MAOANS (10/1/2021 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) 2301MAOAPH (10/1/2022 - 9/30/2025) 2301MAOASS (10/1/2022 - 9/30/2024) 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOACM (10/1/2023 - 9/30/2025) 2401MAOAHD (10/1/2023 - 9/30/2025) 2501MAOANS (10/1/2024 - 9/30/2026) 2501MAOASS (10/1/2024 - 9/30/2026) 2501MAOACM (10/1/2024 - 9/30/2026) 2501MAOAHD (10/1/2024 - 9/30/2026) Compliance Requirement: Matching Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Matching requirements for Title III Supportive Services and Nutrition Services and American Rescue Plan Supportive Services and Nutrition Services Grants include the following: • State and Area Agencies – Area Plan Administration: State and area agencies, in the aggregate, must contribute at least 25 percent of the costs of administration of area plans. For States, since this match is computed based on the aggregate of all area agencies in the state. • Service Provision: All services, whether provided by the State Agency, an Area Agency, or other service providers (excluding any ombudsman services provided under the authority of 42 USC 3024 (d)(1)(D)) must be funded with a nonfederal match of at least 15 percent. One-third of the required 15 percent match must come from state sources, and this percentage must be met on a statewide basis. Funds for ombudsman services provided under the authority of 42 USC 3024 (d)(1)(B) are not required to be matched. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Aging and Independence (Department) did not review its calculation of matching requirements for accuracy. Context: The Department’s calculation of match for Area Plan Administration and for Service Provision were not reviewed for accuracy prior to submission. Auditors determined that the calculations did not agree to supporting documentation. These variances did not affect the total match calculated and the Department met compliance related to the program’s overall required match. Questioned costs: None noted. The Department’s overall match requirement was met. Cause: The Department’s internal controls were not sufficient to ensure that calculations of its matching requirements were reviewed for accuracy prior to submission. Effect: Failure to review matching requirement calculations could result in potential errors going undetected and the Department might not meet its matching requirements. Recommendation: We recommend the Department review and enhance its internal controls regarding review and approval of program matching calculations to ensure that they are accurate and agree to supporting documentation. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-025 Prior Year Finding: 2024-019 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 6 NH23IP922629 (7/1/2019-6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information in accordance with FFATA requirements. Context: Eight of eight subawards were not reported to SAM.gov until after they were selected for testing by auditors. The subawards were issued from 7/1/2024 through 3/31/2025 but were not reported until 1/22/2026 after they were selected for testing during the FY 2025 audit. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has not implemented its corrective action plan from the prior audit. It does not have sufficient procedures and internal controls to ensure that all required subawards are reported timely and accurately. Effect: Subawards were not reported to SAM.gov until after they were selected for testing by auditors. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit. It should establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to SAM.gov no later than the end of the month following the month of issuance of each subaward. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-026 Prior Year Finding: 2024-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000518 (8/1/2022 – 7/31/2027) 24NU51CK000343 (8/1/2024 – 7/31/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information in accordance with FFATA requirements. Context: Eight of eight subawards were not reported to SAM.gov until after they were selected for testing by auditors. The subawards were issued in May 2024 but were not reported until January 2026 after they were selected for testing during the FY 2025 audit. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has not implemented its corrective action plan from the prior audit. The Department does not have sufficient procedures and internal controls to ensure that all required subawards are reported timely and accurately. Effect: Subawards were not reported to SAM.gov until after they were selected for testing by auditors. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit. It should establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to SAM.gov no later than the end of the month following the month of issuance of each subaward. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-027 Prior Year Finding: 2024-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000518 (8/1/2022 – 7/31/2027) 24NU51CK000343 (8/1/2024 – 7/31/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not properly monitor subrecipients and the Department omitted required federal award information from subawards. Context: Eight subawards issued to eight subrecipients were selected for testing. Specifically, we noted the following exceptions: • For eight of eight subrecipients selected for testing, the Department did not adequately monitor the subrecipients. It did not obtain a copy of the subrecipients’ annual single audit report. Therefore, the Department did not verify that the annual single audits had been conducted, nor did it issue a management decision on any audit findings. • For eight of eight subawards selected for testing, the Federal Award Identification Number (FAIN) was omitted from the subaward agreements. Cause: The Department’s procedures were not sufficient to ensure that subrecipients were properly monitored, nor that subawards included all required information. Internal controls did not detect or prevent the errors. The Department had not completed implementation of its corrective action plan from the prior year. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: None. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. We recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal program. The Department should review and enhance internal controls and procedures to ensure that it includes all required information in the subaward agreements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-028 Prior Year Finding: 2024-021 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases, COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000518 (8/1/2022 – 7/31/2027) 24NU51CK000343 (8/1/2024 – 7/31/2025) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Non-federal entities are required to submit Financial and Performance Measure Reports in accordance with the terms and conditions of the Federal award. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not review and approve quarterly Core Base Grant financial reports or COVID Core Base Grant financial reports prior to submission. Context: Four quarterly reports were selected for testing, comprising of two Core Base Grant Financial Reports and two COVID Core Base Grant financial. For two of the four reports tested, there was no evidence of review and approval prior to submission. Questioned costs: Undetermined. Cause: The Department has not completed implementation of the corrective action plan from the prior audit. The Department's internal controls were not sufficient to ensure that quarterly financial reports were reviewed prior to submission. Effect: Failure to review and approve reports prior to submission could allow reporting errors to be undetected. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit. We recommend that the Department review and enhance its internal controls to ensure financial reports are reviewed and approved prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Children and Families Federal Program: Adoption Assistance Assistance Listing Number: 93.659 Award Number and Year: 2501MAADPT (10/1/2023 – 9/30/2024) 2401MAADPT (10/1/2024 – 9/30/2025) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Adoption assistance subsidy payments may be paid on behalf of a child if eligibility requirements are met. Requirements include the following: (1) Categorical Eligibility - Applicable and Non-Applicable Children – An applicable child is a child for whom an adoption assistance agreement was entered into in fiscal year (FY) 2010 or later and who meets the applicable age requirement (differs over a multi fiscal year phase-in period beginning in FY 2010), or a child who has been in foster care under the responsibility of the Title IV-E agency for at least 60 consecutive months, or a sibling to either such child if both are to have the same adoption placement (42 USC 673(e)(2) and (e)(3)). (2)(f) The prospective adoptive parent(s) and any other adult living in the home who has resided in the provider home in the preceding five years must satisfactorily have met a child abuse and neglect registry check. This requirement became effective on October 1, 2006, unless the state requires legislation to implement the requirement, in which case a delayed implementation is permitted until the first quarter of the state’s regular legislative session following the close of the first regular session beginning after October 1, 2006. The requirement applies to foster care maintenance payments for calendar quarters beginning on or after that date. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Children and Families (Department) was unable to provide documentation supporting participant eligibility in the form of a signed subsidy agreement and was unable to provide documentation that child abuse and neglect registry checks were performed for out-of-state adoptive family homes. Context: Forty participants were selected for testing and the following exceptions were noted: • For 1 of 40 participants, the Department was unable to provide a copy of the original signed subsidy agreement. The legalization date was 5/17/2013 but the original signed agreement was unavailable. The child is still receiving a subsidy, and the Department was able to provide the two most recent signed subsidy renewal letters from 2022 and 2024. The subsidy renewal letter is signed by the adoptive parent confirming the child is currently residing in the home, the parent is legally responsible for the child, and the parent provides financial support for the child. The Department uses iFamilyNet as their statewide case management system. iFamilyNet includes the signed subsidy agreement date; however, we were unable to verify the accuracy of that date without a copy of the original signed subsidy agreement. • For 2 of 40 participants, the Department was unable to provide documentation that a child abuse and neglect registry check was completed as part of the application or license approvals for homes in which the adoptive parent(s) previously lived out-of-state. These homes were originally licensed in 2006 and 2013, respectively and these homes received subsidies during FY 2025. The homes are currently closed and are no longer receiving subsidies subsequent to June 30, 2025. Cause: The Department’s procedures and internal controls were not sufficient to ensure that participant eligibility documentation was maintained and that child abuse and neglect registry checks were performed. For the missing registry checks, at the time these homes were licensed, the Department did not have a formal process to request or document out of state child welfare registry checks. Effect: Claims may have been paid on behalf of an ineligible participant and children may have been placed in homes that were ineligible to participate in the program. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it maintains documentation of participant eligibility and child abuse and neglect registry checks, and that this documentation is readily available for audit. We also recommend the Department enhance the renewal letter to include the reaffirmation of the original subsidy agreement date by the participant. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Children’s Health Insurance Program (CHIP) Assistance Listing Number: 93.767 Award Number and Year: 2405MA5021 (10/1/2023 – 9/30/2025) 2505MA5021 (10/1/2024 – 9/30/2026) Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility (Screening and Enrollment) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: To be allowable, Children’s Health Insurance Program (CHIP) costs must be covered by the state plan or CMS approved waivers/demonstrations. Providers receiving payments under the program must meet eligibility requirements. To receive CHIP payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the CHIP program (42 CFR 457.990); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state. CHIP-managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. Providers who have been barred from participation by the OIG exclusion list are not eligible to be enrolled in the CHIP program (42 CFR 457.990, 42 CFR 455 Subpart E). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (the Department) did not properly document CHIP provider eligibility. Context: Sixty providers were selected for testing and the following exceptions were noted: • For 6 of 60 providers selected for testing, a revalidation letter was not provided or generated. The Department indicated that it did not have a process to generate revalidation letters for dental providers. • For 5 of 60 providers selected for testing, the Department was unable to provide documentation that a revalidation of the provider’s eligibility was performed within the required 5-year cycle for dental providers. • 3 of 60 providers selected for testing were not revalidated prior to the latest revalidation in 2024. The providers’ enrollment dates were more than 10 years prior to the 2024 revalidation date, which indicates a minimum of two revalidations were not completed for these dental providers as required. • For 3 of 60 providers selected for testing, the Department was unable to provide a copy of the provider agreement. • For 2 of 60 providers selected for testing, sanction verifications were not completed for all individuals listed on the disclosure forms. • For 1 of 60 providers selected for testing, the provider agreement was not countersigned. All of the above exceptions noted related to dental providers. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation that providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Failure to properly document provider eligibility could allow payments to be made to ineligible providers. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the providers were eligible nor if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it maintains documentation that claims are paid only to eligible providers and that documentation is readily available for audit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-033 Prior Year Finding: 2024-034 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP25, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly perform or document provider eligibility determinations. Context: Sixty providers were selected for testing of provider eligibility and provider health and safety standards. The following exceptions were noted: • For 3 of 60 providers selected for testing, the Department was unable to provide documentation that a revalidation of the provider’s eligibility and verification of the provider’s health and safety standards was performed within the required 5-year cycle. • For 1 of 60 providers selected for testing, the Department was unable to provide a provider agreement. • For 1 of 60 providers selected for testing, the provider was not revalidated prior to the latest revalidation in 2024. The provider’s enrollment date was more than 10 years prior to the 2024 revalidation date, which indicates a minimum of two revalidations were not completed for this provider as required. • For 2 of 60 providers selected for testing, a revalidation letter was not provided or generated. The Department indicated that it did not have a process to generate revalidation letters for dental providers. All of the above exceptions noted related to dental providers. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation that providers were eligible to perform services under the program and were in compliance with health and safety standards. Internal controls did not prevent or detect the errors. Effect: Failure to properly document provider eligibility and compliance with health and safety standards could allow payments to be made to ineligible providers. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the providers were eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it maintains documentation that claims are paid only to eligible providers and that documentation is readily available for audit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-034 Prior Year Finding: 2024-035 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP25, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation verifying participant eligibility. Context: For one of sixty participants selected for testing, support for income verification was not maintained. The Department indicated that manual income verification documentation had been dropped off at a local office but was unable to provide it to auditors for testing. Cause: The Department’s procedures were not sufficient to ensure that participant eligibility documentation was maintained. Effect: Claims were paid on behalf of an ineligible participant. Questioned costs: $38, the claim amount paid for the participant. Recommendation: The Department should enhance its procedures and internal controls to ensure it maintains documentation of participant eligibility and that this documentation is readily available for audit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-035 Prior Year Finding: 2024-036 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI085778 (9/30/2021 – 9/29/2024) 5H79TI085778 (9/30/2022 – 9/29/2024) 6H79TI085778 (9/30/2023 – 9/30/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not properly monitor subrecipients and the Department omitted required federal award information from subawards. Context: Thirteen subawards issued to thirteen subrecipients were selected for testing. Specifically, we noted the following exceptions: • 1 of 13 subawards was missing the Federal Award Identification Number (FAIN). • For 2 of 13 subrecipients selected for testing, the Department did not adequately monitor the subrecipients. The Department did not obtain a copy of the subrecipients’ annual single audit report. Therefore, the Department did not verify that the annual single audits had been conducted, nor did it issue a management decision on audit findings. Cause: The Department had not yet fully implemented its corrective action plan from the prior year. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program requirements and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: None. Recommendation: We recommend the Department complete its corrective action plan from the prior year. The Department should verify that its internal controls and procedures are sufficient to ensure subrecipient monitoring is performed in compliance with the requirements of the federal program and that all required information is included in subaward agreements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-036 Prior Year Finding: 2024-038 Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency Federal Program: Disaster Grants – Public Assistance (Presidentially Declared Disasters), COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (2020) FEMA-4651-DR (2022) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Massachusetts Emergency Management Agency (Department) did not report subawards timely or accurately in accordance with FFATA requirements. Context: Seventeen of the twenty-six subawards selected for testing were not reported timely or accurately. The following exceptions were noted: • 11 of 26 subawards, totaling $29,413,324, were not reported timely. The reports were submitted from seven days to four months late. • 4 of 26 subawards, totaling $3,354,238, were not reported to FSRS. 2 subaward amendments related to de-obligations were not reported. The total of the amendments was a reduction of $169,193. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely and accurately. The Department had not completed implementation of its corrective action plan from the prior year. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to SAM.gov no later than the end of the month following the month of issuance of each subaward. Views of responsible officials: There is no disagreement with the finding.

Finding 2025 - 002 – Reporting (Internal Control Over Compliance) Impact Aid Applications Significant Deficiency Condition: We did not receive back up documentation to support the Children with Disabilities figures on both the Elementary and High School Impact Aid applications. Questioned Costs: None Criteria: Uniform Guidance, 2 CFR section 200.303 (Internal Controls), effective internal controls require the entity to establish and implement written policies and procedures. These policies must ensure that disbursements are supported by adequate documentation, demonstrating proper authorization, accuracy, and compliance with applicable laws and regulations. Cause: Lack of retention of documents used to support the figures that were presented in the Elementary and High School Impact Aid applications. Although the review and approval of the Impact Aid applications was noted as being performed, the lack of retention of supporting documentation relating to the applications does not support reperformance. Effect: The School District was not in compliance with Uniform Guidance, which could lead to sanctions by the funding agencies. Recommendation: We recommend the entity strengthen internal controls over the review of the impact aid application and the retention of documents used to complete the Impact Aid applications. Views of Responsible Officials: Please refer to the Corrective Action Plan for management’s views and planned corrective action.

Finding 2025 - 002 – Reporting (Internal Control Over Compliance) Impact Aid Applications Significant Deficiency Condition: We did not receive back up documentation to support the Children with Disabilities figures on both the Elementary and High School Impact Aid applications. Questioned Costs: None Criteria: Uniform Guidance, 2 CFR section 200.303 (Internal Controls), effective internal controls require the entity to establish and implement written policies and procedures. These policies must ensure that disbursements are supported by adequate documentation, demonstrating proper authorization, accuracy, and compliance with applicable laws and regulations. Cause: Lack of retention of documents used to support the figures that were presented in the Elementary and High School Impact Aid applications. Although the review and approval of the Impact Aid applications was noted as being performed, the lack of retention of supporting documentation relating to the applications does not support reperformance. Effect: The School District was not in compliance with Uniform Guidance, which could lead to sanctions by the funding agencies. Recommendation: We recommend the entity strengthen internal controls over the review of the impact aid application and the retention of documents used to complete the Impact Aid applications. Views of Responsible Officials: Please refer to the Corrective Action Plan for management’s views and planned corrective action.

Inadequate Internal Controls over Grant-Funded Equipment Maintenance and Inventory and Noncompliance with Biennial Inventory Count Requirement Name of Federal agency: U.S. Department of the Interior Name of applicable pass-through entity: State of Alaska, Department of Community and Economic Development Federal program: National Petroleum Reserve – Alaska Assistance listing number: 15.439 Federal Award Number(s): Various Federal award period: July 1, 2024 - June 30, 2025 Criteria: According to 2 CFR 200.313(d)(2), a physical inventory of the property must be taken and the results reconciled with property records at least once every two years and 2 CFR 200.313(d)(4) states that adequate maintenance procedures must be developed to keep the property in good condition. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Condition Found: The Borough was unable to provide sufficient and appropriate evidence, including complete documentation, to demonstrate compliance with the biennial physical inventory requirement for grant funded equipment under the Equipment and Real Property Management compliance requirements. Specifically, no documentation was available to support whether a physical inventory was conducted in FY2024, and the FY2025 inventory was incomplete. Additionally, there was not a control designed to ensure equipment maintenance was performed as scheduled. Cause: While the Borough had an established general policy regarding physical inventory counts and equipment maintenance, the policy lacked sufficient detail to ensure consistent implementation. Specifically, the policy did not clearly define roles and responsibilities for conducting inventory counts, establish procedures for performing the inventory counts and the timing of such counts, or identify the individuals responsible for reviewing and approving inventory results and maintenance logs. In addition, organizational changes during FY2024, including the separation of the Administration and Finance departments, contributed to a breakdown in the continuity of inventory management functions. Staff turnover and a lack of training for new employees further contributed to the insufficient execution of required inventory management procedures. Possible Asserted Effect: Failure to establish effective internal controls over the biennial inventory count and maintenance requirements increases the risk that grant-funded equipment may be lost, misappropriated, or not properly accounted for, which could result in questioned costs, inaccurate financial reporting, and noncompliance with federal award requirements. Questioned Costs: None Repeat Finding: A similar finding was not reported in the prior year audit. Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend the Borough establish internal controls to ensure biennial inventory counts for grant-funded equipment are properly conducted, documented, and formally reconciled with the property records and to ensure equipment is kept in good condition. Views of Responsible Officials: Management concurs with the finding. In response, management will continue to implement additional controls to strengthen compliance with equipment and real property management requirements, including improvements to inventory procedures, documentation practices, and oversight. The Department of Finance will work in coordination with the Department of Administration to provide training to all relevant departments on federal guidelines and compliance requirements related to assets purchased with federal grant funds. Management will continue to monitor these controls and take further corrective action, as necessary, to ensure ongoing compliance with applicable federal requirements.

Ref. No. Finding / Noncompliance Questioned Costs 2025-001 Deficiencies in Personnel File Documentation -0- State and Federal Funds: Federal Agencies: U.S. Department of Homeland Security U.S. Department of Transportation U.S. Department of Treasury U.S. Housing and Human Development Pass-through Agency: N/A Federal Program Title: All Federal Programs ALN Number: N/A Compliance Requirement: Documentation Type of Finding: Material Noncompliance Reporting and Material Weakness Responsible Official: Finance Director Condition: During the audit of personnel records funded by State and Federal grants, it was identified that significant portion of the sampled employee files were incomplete. Specifically, essential documentation-such as Medical History, Birth Certificate, Withholding Exemption Certificate, Oath and Possession, Drug Free Orientation and other required Governmental Certifications were missing from the physical and digital archives. Criteria: Under the Uniform Guidance (2 CFR § 200.303), the Department of Transportation and Public Works (DTOP) is required to establish and maintain effective internal controls over federal awards to provide reasonable assurance that the entity is managing the awards in compliance with federal statutes and regulations. Cause: This deficiency stems from the mass transfer of personnel under the "Ley de Movilidad" (Mobility Law). These employees were transferred with the internal control standards of their original agency (PREPA), which do not align with the documentation requirements of the central government for federally funded programs. Despite being reported in prior year audits, management has failed to standardize these records or implement an effective corrective action plan to integrate these files into DTOP’s internal control system.Effect (or Risk): The lack of standardized documentation prevents the agency from certifying that all employees paid with federal funds meet eligibility and compliance requirements. This recurrent deficiency exposes the Department to: • Questioned Costs: Potential disallowance of payroll expenditures and requirements to refund federal agencies. • Administrative Sanctions: Increased oversight or penalties from federal awarding agencies due to the failure to resolve prior audit findings. • Audit Risk Status: Risk of losing "low-risk auditee" status, leading to more extensive and frequent audits. Recommendation: We recommend that management: 1. Establish a special task force within the Human Resources Department to conduct a 100% internal audit of files for all personnel transferred from PREPA. 2. Set a formal deadline for these employees to complete and submit all required documentation under DTOP’s internal control policies. 3. Formalize a Corrective Action Plan (CAP) that includes specific milestones to ensure this prior year finding is fully resolved within the current fiscal year.

Program: Education Stabilization Fund Federal Assistance Listing Number: 84.425U, 84.425W Federal Agency: U.S. Department of Education Pass-Through Agency: Cochise County, Arizona Grantor Number: Not applicable Questioned Costs: $-0- Type of Finding: Noncompliance (Other Matter), significant deficiency in internal control Compliance Requirement: N. Special Tests and Provisions – Wage Requirements Condition/Context: During our testing of the one contractor funded under the Education Stabilization Fund program, we noted that the District did not obtain or review certified payroll reports from contractors to verify compliance with federal prevailing wage requirements. As a result, the District could not demonstrate that contractors complied with required wage provisions for the sampled projects. Criteria or Specific Requirement: Federal regulations require that contractors and subcontractors performing work on federally funded construction projects pay laborers and mechanics wages at rates not less than those prevailing on similar projects in the locality. These requirements are established under the Davis-Bacon Act and incorporated into federal grant compliance requirements under 2 CFR Part 200. Adequate monitoring of compliance with these wage requirements is required to ensure that workers are being paid correctly per 29 CFR 5.5 compliance provisions. Per 2 CFR section 200.303(a), a non-Federal entity must establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Cause: The district did not have established procedures to ensure that certified payroll documentation was obtained and reviewed for federally funded construction projects. District personnel were not aware that federal wage requirements applied to the project. Effect: Failure to ensure compliance with federal prevailing wage requirements may result in laborers and mechanics being paid less than required wage rates. This noncompliance could result in questioned costs, repayment of federal funds, or other sanctions by the awarding agency. Repeat Finding: No. Recommendation: We recommend the District implement policies and procedures to ensure effective monitoring of compliance with Federal wage rate requirements. This includes obtaining required wage determinations prior to project commencement, including wage requirements in contract documents, and collecting certified payroll reports from contractors. Views of Responsible Officials: The District concurs with this recommendation and will review its procedures over monitoring of wage rate requirements under the Davis Bacon Act.

Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Repeat Finding: No Criteria or Specific Requirement Lincoln Public Schools must comply with procurement standards set out at 2 CFR sections 200.303 and 200.318 through 200.326 within Uniform Guidance. Condition Lincoln Public Schools purchasing policy does not include all elements as outlined in 2 CFR sections 200.303 and 200.318 through 200.326 noted above. Questioned Costs None Context Although Lincoln Public Schools purchasing policies do not include all elements as outlined in 2 CFR sections 200.303 and 200.318 through 200.326, we did not identify transactions where contracts were awarded without proper justification in 1 of 1 procurement transactions tested. Cause Management was not aware of the procurement standards set out at 2 CFR sections 200.303 and 200.318 through 200.326 within Uniform Guidance. Effect Lincoln Public Schools is at risk for noncompliance with Federal grants as it relates to procurement. Repeat Finding No Recommendation We recommend that Lincoln Public Schools update its procurement policies to include all elements identified in 2 CFR sections 200.303 and 200.318 through 200.326. Views of Responsible Officials and Planned Corrective Action Management is working with our current auditors to update the Lincoln Public Schools procurement policies to be in compliance with the Uniform Guidance.

Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Continuum of Care Assistance Listing Number: 14.267 Federal Award Identification Number and Year: Multiple for FY2024-25 Award Period: July 1, 2024 through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed (2 CFR 200.430(g)). In addition, under 2 CFR 200.303, the non‑Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During our testing, we noted that LAHSA’s internal control designed to ensure payroll transactions were allowable was not consistently implemented. Questioned Costs: None Context: During our testing, it was noted that three out of forty timesheets were not approved prior to commencement of the audit. Cause: Appropriate personnel did not approve timesheets supporting payroll costs charged to the Continuum of Care program in a timely manner. Effect: LAHSA is not in compliance with maintaining an internal control over compliance for payroll costs charged to the Continuum of Care program. Repeat Finding: No Recommendation: We recommend that LAHSA implement procedures to ensure that timesheet approval is documented timely. Views of responsible officials: There is no disagreement with the audit finding.

GRANT COMMUNITY CONSOLIDATED SCHOOL DISTRICT 110 50-082-1100-04 SCHEDULE OF FINDINGS AND QUESTIONED COSTS Year Ending June 30, 2025 SECTION III - FEDERAL AWARD FINDINGS AND QUESTIONED COSTS 1. FINDING NUMBER:14 2025 - 004 2. THIS FINDING IS: X New Repeat from Prior year? Year originally reported? 3. Federal Program Name and Year: National School Lunch Program, School Breakfast Program 4. Project No.: 25-4210-00, 24-4210-00, 25-4220-00, 24-4220-00 5. AL No.: 10.555 & 10.553 6. Passed Through: Illinois State Board of Education 7. Federal Agency: U.S. Department of Agriculture 8. Criteria or specific requirement (including statutory, regulatory, or other citation) Per 2 CFR §200.303, non-federal entities must establish and maintain effective internal control over federal awards to provide reasonable assurance of compliance with federal statutes, regulations, and the terms and conditions of the award. Additionally, 7 CFR §210.8(a) requires school food authorities to establish internal controls to ensure the accuracy of meal counts prior to submitting monthly claims for reimbursement. 9. Condition Claims submitted for reimbursement did not reconcile with the District’s internally prepared monthly claim summary report. 10. Questioned Costs Total questioned costs equal $78,821.37. 11. Context The District participates in the National School Lunch Program (ALN 10.555) and the School Breakfast Program (ALN 10.553), which require accurate reporting of meal counts to determine reimbursement. Meal count claims are prepared monthly by a designated staff member and submitted to the state agency. However, the District’s independent review process for these claims is not functioning effectively. This lack of review contributed to errors in the reimbursement claims for October 2024, December 2024, and February 2025. 12. Effect The District submitted reimbursement claims that did not reconcile to its internally prepared monthly claim summary report, resulting in both underclaims & overclaims of meals. 13. Cause The District had a review process in place requiring a secondary review of meal count claims; however, the process was not functioning effectively. 14. Recommendation The District should strengthens internal controls over meal count claims prior to submission. 15. Management's response Management concurs with finding.

2025-007 - Lack of Documented Federal Policies and Procedures Finding Type: Material weakness in internal control over compliance. Criteria: The Uniform Guidance (2 CFR 200.303) requires that non-Federal entities establish and maintain effective internal control over Federal awards to provide reasonable assurance that the awards are managed in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Federal internal control guidance also contemplates that such controls be documented and maintained. Condition: The City did not maintain documented policies and procedures over its Federal awards as of June 30, 2025. No formal documentation was available to evidence the design and implementation of internal controls over compliance. Cause: This condition is the result of the City’s lack of formal procedures to document and maintain internal controls over compliance for Federal awards. Effect: As a result of this condition, the City did not maintain adequate internal control over compliance to provide reasonable assurance that Federal awards were managed in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Recommendation: The City should establish, document, and implement formal policies and procedures over Federal awards to ensure compliance with Uniform Guidance requirements. Management Response: See Corrective Action Plan.

Finding 2025-005: Reporting (Significant Deficiency) Federal Agency: National Institute of Health Federal Program: All of Us Research Program Assistance Listing Number: 93.368 Criteria: As noted in 2 CFR §200.303 "The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control Integrated Framework", issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted one instance in which there was no documented approval date of a report, and one instance in which the submission of a report was not timely in accordance with the award agreement. Cause: The Foundation does not have the appropriate internal controls in place to ensure that all internal reviews over reports are documented with a date of review. In addition, the Foundation is lacking internal controls to ensure that all reports are submitted timely in line with award agreement requirements. Effect or Potential Effect: Without proper dating of internal review and approval over reports, there exists the possibility that the review was not done prior to submission and information reported is inaccurate. Untimely submission of reports could result in withholding of funding. Questioned Costs: None noted as this compliance requirement is an administrative reporting requirement that does not impact cost eligibility. Context: Our audit procedures consisted of testwork performed over a sample of reports required to be submitted during the year under audit. We consider our sample to be representative of the population. The issue appears to be systematic in nature. Identification as a Repeat Finding: Refer to finding 2024-005. Recommendation: We recommend that the Foundation ensure that all approvals over performance and financial reporting are documented along with the date of review. In addition, we recommend the Foundation implement procedures to ensure that all reports are submitted within the specific timeframes specified in award agreements.

U.S. Department of Agriculture Community Facilities Loans and Grants - 10.766 Criteria or Specific Requirement – Special Test Per 2 CFR 200.303, the non-federal entities receiving federal awards (i.e ., auditee management) must establish and maintain internal control design to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Per the debt agreement, Section 4(d)1, the Hospital needs to accumulate $521,000 in debt reserve account deposits of $4,000 monthly until fully funded. Condition – During our test work over the USDA loan, we noted the Hospital did not make the required transfers to the debt reserve account from December 2024 to June 2025. Cause – Financial constraints and continued turnover within the accounting department of the Hospital. Effect or Potential Effect – The Hospital is not in compliance with their debt covenant and the USDA has the right to call the debt and make the entire loan balance immediately due and payable. Questioned Costs – None noted. Context – The Hospital has a waiver from the USDA in which the USDA granted permission for the Hospital to use the debt reserve account for debt service payments on the USDA loan up to December 2024. The USDA did not wish to further waive the requirement to make the monthly payments to the debt reserve account. Though, the Hospital and USDA entered into a workout agreement stating as long as the Hospital agreed to their conditions, they would not accelerate the amount due. Identification as a Repeat Finding, if applicable – Not applicable. Recommendation – We recommend the Hospital adhere to the conditions set forth by the USDA per the workout agreement, which includes making the monthly transfer of $4,000 to the debt reserve account. Views of Responsible Official and Planned Corrective Actions – Management agrees with finding. See corrective action plan.

U.S. Department of Health and Human Services Congressional Directives - 93.493 Award# CE152271 Criteria or Specific Requirement – Procurement and Suspension and Debarment subawards under covered transactions to parties that are suspended or debarred. “Covered transactions” include contracts for goods and services awarded under a non-procurement transaction (e.g ., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR Section 180.220. All non-procurement transactions entered into by a pass-through entity (i.e ., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR Section 180.215. Per 2 CFR 200.303, the non-federal entities receiving federal awards (i.e ., auditee management) establish and maintain internal control design to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition – The Hospital's Procurement Policy and Procedure is not in alignment with the requirements of 2 CFR Section 200.320. The policy does not document different procurement methods for documentation to be retained, etc. Additionally, formalized documentation supporting the Hospital is in compliance with policies and regulations supporting its procurement decisions did not exist. Lastly, there was no suspension and debarment check completed prior to purchases made with federal funds. Cause – The Hospital's procurement policies are not in accordance with the Uniform Guidance, nor are there controls in place to ensure policies are followed, and lastly, there are no controls to ensure suspension and debarment checks are performed on vendors receiving federal funds. Effect or Potential Effect – Federal funds could be used to make an unauthorized purchase including paying paying an entity that is suspended or debarred. Questioned Costs – None noted. Context – During fiscal year 2025, only one vendor was subject to procurement and suspension and debarment requirements and was therefore selected for testing. The Hospital expended $1,100,000 for goods goods and services from this vendor during the fiscal year. The Hospital was able to provide bid documentation related to vendor selection; however, the Hospital did not have formally documented written procurement policies addressing compliance with Uniform Guidance requirements, including procedures for suspension and debarment verification. As part of audit testing, it was noted that the vendor had not been evaluated for suspension or debarment at the time of procurement. A subsequent check performed during the audit indicated that the vendor was not suspended or debarred. Identification as a Repeat Finding, if applicable – Not applicable. Recommendation – Policies and procedures should be modified to ensure that procurement policies are in alignment with federal regulations, support for procurement decisions are maintained and suspension and debarment checks on vendors are performed prior to making purchases with federal funds and are in alignment with the Uniform Guidance requirements. Views of Responsible Official and Planned Corrective Actions – Management agrees with finding. See corrective action plan.

U.S. Department of Health and Human Services Congressional Directives - 93.493 Award# CE152271 Criteria or Specific Requirement – Reporting and Significant Deficiency Per 2 CFR 200.303, the non-federal entities receiving federal awards (i.e ., auditee management) establish and maintain internal control design to reasonably ensure compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition – During our test work over the Congressional Directive grant, we noted the Hospital did not maintain effective internal controls over reporting. Reports were prepared and submitted by a single individual without evidence of supervisory or independent review prior to submission. Cause – The Hospital's controls to ensure reports are filed timely and accurately were not operating effectively. Effect or Potential Effect - Without an established review process, there is an increased risk that required federal reports may contain errors, omissions, or noncompliant information, which may not be detected or corrected timely. Questioned Costs – None noted. Context – One federal financial report was required to be submitted and selected for testing. We noted there was no review process in place over the report submitted. While no material errors were identified during audit testing, the control deficiency increases the risk of noncompliance with federal reporting requirements. Identification as a Repeat Finding, if applicable – Not applicable. Recommendation – We recommend the Hospital incorporate a review and reconciliation process of the required reports to the underlying grant and accounting records. Views of Responsible Official and Planned Corrective Actions – Management agrees with finding. See corrective action plan.

Department of Education Federal Financial Assistance Listing # 84.365C, English Language Acquisition, Language Enhancement, and Academic Achievement Program for Limited English Proficient Children, 9/1/2023 – 8/31/2024 and 9/1/2024 – 8/31/2025 Activities Allowed or Unallowed and Allowable Costs/Cost Principles and Period of Performance Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria: The Organization is required to have procedures in place to ensure that federal awards are expended only for allowable costs in accordance with Subpart E – Cost Principles of the Uniform Guidance. Allowable costs are supported by appropriate documentation and correctly charged as to account, amount, and period. 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Condition: Indirect costs charged to the federal award did not agree to the underlying direct costs for the award for the fiscal year ended June 30, 2025. Cause: The Organization drew down indirect costs during the year ended June 30, 2025 for the period September 1, 2021 to June 30, 2025. Effect: Current year amounts drawn for indirect expense category were not correctly charged as to amount and period. Questioned Costs: Indirect costs drawn for the fiscal year ending June 30, 2025 for which compliance with the federal award could not be determined were $58,531. Context: There was one draw for indirect costs of $88,074 during the fiscal year ended June 30, 2025. Indirect costs relating to the underlying direct expenses for the fiscal year ending June 30, 2025 were $29,543. There were $58,531 of indirect costs drawn for which a determination was unable to be made as to compliance with the federal award. Recommendation: We recommend management continue to review procedures over the allocation of indirect costs and ensure indirect costs are being calculated on the underlying direct costs incurred in the year under audit. Views of Responsible Officials: Management is in agreement.

Eligibility Program Name: Summer Electronic Benefits Transfer Program for Children (Summer EBT) (Assistance Listing 10.646) Federal Award Agency: United States Department of Agriculture Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 244CT833N1175 Background The Department of Social Services (DSS) is the lead agency that administers the Summer EBT program and partners with the State Department of Education (SDE) to facilitate the program. DSS relies on the Integrated Management of Public Assistance for Connecticut (ImpaCT) system, the Connecticut Health Insurance Exchange (HIX) system, and third-party contractors when determining client eligibility. Additionally, SDE provides eligible client listings to DSS. DSS issues Summer EBT benefits to clients in multiple iterations. The department’s business systems and quality management divisions, and third-party contractors review the iterations. Each iteration requires a database change request prior to running the iteration. If the business systems division determines that it needs to make a change to the database change request, it will provide a formal approval. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Title 7 CFR Part 292.16(a)(5)(i) requires the state Summer EBT agency to establish a master issuance file which contains all information needed to identify eligible children, issue Summer EBT benefits, record the participation activity for each household, and supply all information necessary to fulfill reporting requirements. Condition Our inquiry about the Summer EBT client eligibility population disclosed that DSS did not track which agency was responsible for each client’s eligibility determination. The DSS business systems division did not approve four out of seven benefit iterations, totaling $993,840, and did not maintain sufficient documentation to support that it did not need to make a change to the database change request. Context DSS issued Summer EBT benefits in seven iterations totaling $30,362,441 during the fiscal year ended June 30, 2025. Questioned Costs $0 Effect DSS has reduced assurance over the accuracy and reliability of client eligibility determinations and oversight of Summer EBT benefit iterations. Cause The department’s current methods of combining multiple sets of Summer EBT issuance data files lacked sufficient controls to determine the source of client eligibility. The business systems division relied on quality management’s approval and did not maintain documentation to confirm that it made no changes to some database change requests. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls to identify the agency responsible for each client’s eligibility determination and document benefit iteration approvals for the Summer Electronic Benefits Transfer Program for Children. Views of Responsible Officials “The Department disagrees with this finding. Condition #1: Eligibility for the Summer EBT program is established through multiple pathways: receipt of Supplemental Nutrition Assistance Program (SNAP) benefits, Temporary Family Assistance (TFA), or HUSKY A coverage, and through applying for and receiving an eligibility determination for either the National School Lunch Program or the Summer EBT program itself. Determining eligibility is a shared responsibility between DSS and the State Department of Education (SDE), and children qualify through multiple pathways simultaneously. DSS maintains a record within its eligibility system and compiles reports of all eligible children. When eligibility is established through any additional means, the child’s record is then analyzed against all previous issuances to ensure duplicate participation and double issuance does not occur. Title 7 CFR Part 292.16 (a)(5)(i) requires the Summer EBT agency to establish a master issuance file which contains all information needed to identify eligible children, issue Summer EBT benefits, record the participation activity for each household and supply all information necessary to fulfill reporting requirements. The agency is not required to specify which program(s) were used to determine eligibility, which is reasonable given that there may be multiple overlapping avenues of eligibility. The implication that DSS is somehow not compliant or able to identify the source of eligibility is inaccurate. DSS can identify this information on an individual basis through reviewing the child’s receipt of SNAP, TFA, HUSKY A, or through its ongoing coordination and communication with SDE. Condition #2: It is not a requirement of the business systems division to request approval for each issuance. Each year the Department issues benefits for this program in a consistent manner. Since there were no changes to the process during the audit period, approval was not sought for the issuances. Business systems would only seek approval if there was a change to the process.” Auditors’ Concluding Comments Eligibility data at the summary and individual levels are both critical for an effective and efficient review of the program. The department could not provide documentation to substantiate that it used existing database change request scripts and approval by the business systems division was not necessary.

Special Tests and Provisions – EBT Card Security Program Name: Summer Electronic Benefits Transfer Program for Children (Summer EBT) (Assistance Listing 10.646) Federal Award Agency: United States Department of Agriculture Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 244CT833N1175 Background The Department of Social Services (DSS) provides Summer Electronic Benefits Transfer (EBT) benefits through EBT cards. The department’s financial services division tracks the status of returned EBT cards. The department’s mailroom staff are responsible for EBT card destruction. Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.303 requires the non-federal entity to establish and maintain effective internal control over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 7 CFR Part 292.16(h)(3)(i) requires the state Summer EBT agency to provide adequate security for EBT cards including secure storage, inventory control records, and periodic review and validation of inventory control records. Title 7 CFR Part 292.15(h)(1)(i) requires Summer EBT agencies to expunge Summer EBT benefits 122 calendar days after issuance. Condition Our review of the status of returned Summer EBT cards disclosed that DSS destroyed returned EBT cards and did not maintain a log to record client information, disposition date, and reason for destruction. Context DSS issued $7,243,933 in Summer EBT refunds during fiscal year 2025. The refund amount included lost, stolen, or damaged EBT cards as well as expunged benefits. DSS destroyed seven 500-card tubes of returned EBT cards. Questioned Costs We were unable to determine if there were questioned costs as DSS did not maintain disposition records for the returned EBT cards. Effect DSS has reduced assurance over the security and accountability of returned EBT cards. Cause DSS informed us that it did not maintain a log due to the large volume of returned EBT cards. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls to ensure that it consistently secures, tracks, and records returned cards for the Summer EBT program. Views of Responsible Officials “The Department agrees with this finding. However, the Department believes that there are proper internal controls to ensure the security of returned cards. There was no log maintained by the Department but the controls in place reduced the risk of benefits being used incorrectly to an acceptable level. The returned cards were destroyed, and all unused benefits were expunged.” Auditors’ Concluding Comments DSS did not implement sufficient internal controls for the Summer EBT card program compared to the department's other federal EBT card programs. DSS was unable to provide documentation to support which EBT cards it destroyed and that it expunged benefits on all cards prior to destruction.

Subrecipient Monitoring Program Name: Crime Victim Assistance (Assistance Listing 16.575) Federal Award Agency: Department of Justice Award Years: Federal Fiscal Years 2021, 2022, and 2023 Federal Award Numbers: 15POVC-21-GG-00615-ASSI, 15POVC-22-GG-00715-ASSI, and 15 POVC-23-GG-00433-ASSI Background The Crime Victim Assistance program provides financial support and various services and resources to crime victims, including crisis counseling, criminal justice support and advocacy, shelter, and therapy. The Judicial Branch provides grants to subrecipients to provide these services. Title 28 U.S Code of Federal Regulations (CFR) Part 94.118 provides that subrecipients shall contribute not less than 20% of the total cost of each project. Subrecipients shall derive these contributions from non-federal sources. Each subrecipient shall maintain records that clearly show the source and amount of the matching contributions.Criteria Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal control over federal awards that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Title 2 CFR Part 200.332(e) provides that the pass-through entity shall monitor subrecipient activities as necessary to ensure that they comply with federal statutes, regulations, and the terms and conditions of the subaward. Title 28 CFR Part 94.106 provides that the state administering agency shall conduct regular desk monitoring of all subrecipients as well as on-site monitoring of all subrecipients at least once every two years during the award period. The state shall maintain a copy of site visit results and other documents related to compliance. Title 2 CFR Part 200.306(b) provides that the pass-through entity must accept any cost sharing funds as part of the subrecipient’s contributions to a program when the funds are verifiable in the subrecipient’s records. Condition The Judicial Branch did not perform regular subrecipient desk reviews or site visits at least once every two years during the award period as required by federal regulations. The branch does not complete reviews until the award period ends. As a result, it did not promptly examine subrecipients’ underlying documentation such as invoices, timesheets, or support for expenditures or matching contributions. The branch’s monitoring process was limited to monthly reviews of budget-to-actual summaries. Context During the fiscal year ended June 30, 2025, the branch made $8,759,482 in reimbursements to 40 subrecipients.Questioned Costs $0Effect The Judicial Branch has limited assurance that subrecipients used federal funds for allowable activities and met the mandatory matching requirements. This could potentially lead to future disallowed costs and federal repayment obligations.Cause Due to a lack of adequate staffing, the Judicial Branch prioritized reviewing supporting documentation for prior award periods rather than the current period. Prior Audit Finding We have not previously reported this finding.Recommendation The Judicial Branch should strengthen internal controls to ensure it complies with federal subrecipient monitoring requirements for the Crime Victim Assistance program. Views of Responsible Officials “The Judicial Branch Office of Victim Services (OVS) agrees to strengthen its internal controls as described below to comply with federal subrecipient monitoring requirements for the Victims of Crime Act Assistance (VOCA) Program. In 2025, OVS performed site visits for four VOCA-funded programs and completed financial-desk reviews of monthly or quarterly financial reports for all programs. That year, OVS experienced personnel turnover in its three-employee Fiscal Services Unit, notably the separation from state service of a Program Manager and a Court Planner, who together performed OVS’ programmatic site visits of VOCA-funded programs. Also, there was a significant increase in workload resulting from OVS’ contributions to the 2024-2025 VOCA request-for-proposal process. In response, staff outside the unit contributed while managing other assigned duties, a Program Manager and Grants and Contract Specialist were hired to restore the unit to its three-employee configuration, the new employees received training on subrecipient monitoring policies and procedures, and a revised subrecipient site visit plan was developed and has begun being implemented. To strengthen internal controls, OVS has developed a revised site visit plan for the remaining VOCA-funded programs scheduled to receive site visits in 2025. April 15, 2026, is the anticipated date for OVS to complete the site visits. OVS has completed sending letters to the subrecipients operating the VOCA-funded programs. The letters request supporting documentation, which is programmatic and financial in nature, in accordance with OVS administrative policy and procedure. Also, the letters inform subrecipients that site visits will commence in accordance with a revised site visit plan.”

Activities Allowed or Unallowed – Individual Plans and Service Records Program Name: Money Follows the Person Rebalancing Demonstration (MFP) (Assistance Listing 93.791) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 1LICMS300142 Background The Department of Social Services (DSS) is the designated single state agency to administer the Money Follows the Person Rebalancing Demonstration (MFP) program. Connecticut administered certain aspects of MFP through several state agencies including the Department of Developmental Services (DDS). Criteria Title 2 U.S. Code of Federal Regulations (CFR) Part 200.403 provides that to be allowable under federal awards, costs should be adequately documented. Title 2 CFR Part 200.303 requires the non-federal entity to establish, document, and maintain effective internal controls over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Procedure No. I.C.1.PR.002.a. of the DDS Operation Manual states that DDS should obtain agreements and approvals for the individual plan during the planning process. The case manager should document who participated in the planning process and obtain signatures on the individual plan. Participants typically include the recipient, parent, guardian, advocate, case manager, support brokers, private agency designee, and other DDS staff. Condition Our review of 25 MFP benefit payments totaling $11,000, of which $8,250 was federally reimbursed, disclosed that DDS did not have signatures of agreement and approval for six individual plans. Additionally, DDS could not obtain service records from one medical provider to support one $46 payment, for which DSS received $35 in federal reimbursement. Context During the fiscal year ended June 30, 2025, DSS processed $4,978,654 in MFP benefit payments on behalf of 36 DDS recipients. DSS received $3,733,990 in federal reimbursement. The sample was not statistically valid. Questioned Costs $0 Effect The lack of signatures to indicate agreement and approval of an individual plan by relevant participants increases the risk of inadequate services for the recipient. DSS received federal reimbursement for an unallowed expenditure. Cause Lack of management oversight contributed to the condition. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Developmental Services should strengthen internal controls to ensure it obtains the required signatures for the individual plan for all Money Follows the Person Rebalancing Demonstration recipients. The Department of Social Services should conduct an audit of the medical provider in accordance with Section 17b-99 of the Connecticut General Statutes to ensure integrity of the Money Follows the Person Rebalancing Demonstration program. Views of Responsible Officials Response provided by the Department of Developmental Services: “DDS agrees with the finding. The errors were attributed to current manual processes and case management oversight regarding documenting signatures when individual plan (IP) meetings are held remotely rather than in-person. Most of the deficiencies (5 of 6) were isolated to one case manager. The MFP division is small with 3-4 case managers, causing a higher error rate when extrapolated against the sample size. The missing support service records have been forwarded to the Department of Administrative Services for research. There are plans to improve the individual plan process to enhance internal controls through automation. In the interim, case managers and case manager supervisors will be reminded of the IP signature requirements.” Response provided by the Department of Social Services: “The Department agrees with this finding and the response provided by the Department of Developmental Services. Additional research is needed to determine whether the missing documentation was the provider's responsibility or was due to a billing issue. The Department of Developmental Services is coordinating with the Department of Administrative Services to research this further.”

Eligibility Program Name: Money Follows the Person Rebalancing Demonstration (MFP) (Assistance Listing 93.791) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 1LICMS300142 Background The Department of Social Services (DSS) uses several systems to administer the Money Follows the Person Rebalancing Demonstration (MFP) program. The My Community Choices web portal is the primary system that maintains data about MFP applicants and participants, including client start and end dates. The DSS eligibility management system maintains client eligibility determinations for the program. The Medicaid Management Information System (MMIS) processes medical services payments and provides financial reports for federal reimbursement claims. Since the My Community Choices web portal does not interface with other systems, DSS staff must manually input client MFP program start and end dates into the DSS eligibility management system. The DSS eligibility management system interfaces with MMIS daily. Criteria Section 6071(b)(2) of Public Law 109-171 defines an eligible individual for the MFP demonstration project as a person who, immediately before beginning participation in the MFP demonstration project, resides in an inpatient facility, receives Medicaid benefits for inpatient services, continues to require the level of care provided in an inpatient facility, and who resides in a qualified residence beginning on the initial date of participation in the demonstration project. Section 6071(b)(7) of Public Law 109-171 defines qualified expenditures by the state under its MFP demonstration project as home and community-based long-term care services for an eligible individual participating in the MFP demonstration project. However, this is only with respect to services furnished during the 12-month period beginning with the individual's discharge date from an inpatient facility. Title 2 U.S. Code of Federal Regulations (CFR) Part 200.403 provides that to be allowable under federal awards, costs should conform to any limitations or exclusions set forth in the federal award. Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal controls over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. Title 42 CFR Part 431.420 requires the state to comply with the terms and conditions of the MFP demonstration project. MFP terms and conditions require the state to ensure the availability of adequate resources for implementation and monitoring of the demonstration project including tracking participant enrollment, maintaining eligibility systems, and administering effective transition coordination. MFP terms and conditions require the state to develop and amend an operational protocol that details how the state will adhere to statutory and program requirements. Section B of the MFP Operational Protocol includes the following policies and procedures. • Determining MFP eligibility includes ensuring an individual’s annualized cost of care in the community is equal to or less than the annualized rate paid for residing in an institution. • The state will not provide an administrative hearing to an applicant for denied services due to the applicant’s care plan exceeding the allowable cost of care in the community. • The state will suspend MFP participation and services during any inpatient stay. Suspended MFP participants may continue MFP participation upon discharge from the inpatient facility. Condition We reviewed 40 MFP claims, totaling $49,144, of which $36,858 was federally reimbursed, to determine if DSS properly granted eligibility. Our review disclosed the following: 1. DSS did not terminate MFP participation for two clients. DSS processed $918 for the selected claims for these clients. DSS processed $184,088 in additional claims in fiscal year 2025 and $270,274 in claims in prior fiscal years for periods when these clients were no longer eligible under the MFP program. DSS should have ended participation on April 5, 2018, and July 30, 2020, respectively. 2. DSS processed $7,724 of ineligible MFP expenses for two clients during inpatient hospital or nursing facility stays ranging from 14 to 21 days. DSS did not properly track MFP participation dates for these clients in its systems. Additionally, DSS did not properly track participation dates for a third client for seven days of hospitalization. 3. DSS approved two applicant care plans that exceeded the cost of institutional care by $1,530 (19%) and $3,507 (39%) per month. 4. DSS did not perform or document a comparative cost analysis for one client to demonstrate that care plan costs did not exceed nursing facility costs. Context During the fiscal year ended June 30, 2025, DSS processed $18,243,599 in payments on behalf of 824 MFP clients and received $13,682,699 in federal reimbursement. The sample was not statistically valid. Questioned Costs We computed questioned cost of $347,253 by applying the applicable federal financial participation rate to the ineligible expenditures. Questioned costs were $144,548 for fiscal year 2025 and $202,705 for prior fiscal years. Effect DSS provided MFP benefits to ineligible individuals. DSS received federal reimbursement for unallowed expenditures. Cause The My Community Choices web portal did not interface with DSS eligibility and financial systems. DSS relied on staff to manually input client participation start and end dates in multiple systems. Management oversight did not identify input errors of client participation dates. DSS management overrode applicant care plan costs. The MFP Operational Protocol has no written procedures to override program policies or federal regulations. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls to ensure that only eligible recipients receive Money Follows the Person Rebalancing Demonstration services in accordance with federal laws, award terms and conditions, and the Money Follows the Person Operational Protocol. Views of Responsible Officials “The Department agrees in part with this finding. Condition #1: DSS agrees that participation end dates were not updated timely due to cross-system manual entry limitations. Reconciliation procedures and supervisory oversight will be strengthened. Condition #2: DSS agrees that participation suspensions were not consistently reflected across systems due to timing delays. Monitoring and real-time reconciliation controls will be enhanced. Condition #3: DSS agrees approved costs exceeded institutional thresholds in limited cases. Variances were clinically justified, reviewed, and authorized. DSS will strengthen documentation and internal protocols to ensure clearer policy alignment. Condition #4: DSS agrees that the documentation was incomplete in one instance. Internal review standards will be reinforced to ensure comparative cost analyses are consistently documented. Please note, the Department will not be returning the questioned costs associated with this finding. According to federal regulations, recoveries based on eligibility errors can only be pursued when identified by programs operating under Centers for Medicare and Medicaid Services’ (CMS) Payment Error Rate Measurement program, per section 1903(u) of the Social Security Act and regulations at Title 42 CFR Part 431, Subpart Q.” Auditors’ Concluding Comments The Department of Social Services should amend its MFP Operational Protocol and seek approval from the Centers of Medicare and Medicaid Services if the department plans to continue to use management overrides of care plan costs.

Performance Reporting – Semi-Annual Progress Report and Special Reporting – MFP Work Plan Program Name: Money Follows the Person Rebalancing Demonstration (MFP) (Assistance Listing 93.791) Federal Award Agency: United States Department of Health and Human Services Award Years: Federal Fiscal Years 2024 and 2025 Federal Award Number: 1LICMS300142 Criteria The Money Follows the Person (MFP) Rebalancing Demonstration federal award requires the state to provide programmatic reports in accordance with Title 2 U.S. Code of Federal Regulations (CFR) Part 200.301. Title 2 CFR Part 200.301 requires the state to correlate financial data to performance accomplishments of the federal award. The state should also measure performance in a way that will help the United States Department of Health and Human Services (DHHS) and other non-federal entities to improve program outcomes, share lessons learned, and spread the adoption of promising practices. Title 2 CFR Part 200.303 requires the non-federal entity to establish and maintain effective internal controls over the federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the award. MFP terms and conditions require the state to submit a work plan that documents its progress on the use of initiatives designed to increase the use of home and community-based services rather than institutional long-term services and supports. MFP terms and conditions require the state to submit semi-annual progress reports that present the state’s analysis and the status of various operational areas in reaching the objectives of the demonstration. The semi-annual progress report documents the state’s progress in meeting MFP operational procedures and processes, transition benchmarks, and program goals for expanding and enhancing home and community-based services. Title 2 CFR Part 200.334 requires the state to retain financial and programmatic records to support reported information for three years from the date of submission. Condition Our review of the MFP work plan and semi-annual progress report for July 1 to December 31, 2024, disclosed that the Department of Social Services (DSS) did not maintain MFP program data to support figures reported for seven performance objectives in the work plan and 11 performance measures in the semi-annual progress report. Context DSS submitted two semi-annual progress reports and two work plans to DHHS during fiscal year 2025. The sample was not statistically valid. Questioned Costs $0 Effect DSS may have submitted an inaccurate work plan and progress report. DHHS may be using unreliable data to identify promising practices and make future federal program decisions. Cause DSS lacked adequate controls to document and retain MFP data. Prior Audit Finding We have not previously reported this finding. Recommendation The Department of Social Services should strengthen internal controls over performance and special reporting for the Money Follows the Person Rebalancing Demonstration to ensure it maintains data to support figures reported to the Department of Health and Human Services. Views of Responsible Officials “The Department agrees with this finding and is taking steps to strengthen internal controls over performance monitoring and special reporting for the Money Follows the Person (MFP) Rebalancing Demonstration. DSS is implementing a secure SharePoint repository to centrally maintain, organize, and track all documentation supporting the MFP Work Plan and the MFP Semi-Annual Report.”