Findings Citing § 200.303

2025-031 Strengthen Controls over Matching, Earmarking, and Period of Performance Compliance Requirements: Matching, Level of Effort, Earmarking Period of Performance Internal Control Impact: Material Weakness Compliance Impact: None Federal Awarding Agency: U.S. Department of Transportation Pass-Through Entity: None AL Numbers and Titles: 20.600 – State and Community Highway Safety 20.616 – National Priority Safety Programs Federal Award Numbers: 69A37525300004020GA0 (Year: 2025), 69A3752530000405BGAL (Year: 2025), 69A3752530000405CGA0 (Year: 2025), 69A3752530000405DGAM (Year: 2025), 69A3752530000405EGAA (Year: 2025), 69A3752530000405FGA1 (Year: 2025), 69A3752530000405GGA0 (Year: 2025), 69A3752530000405HGA0 (Year: 2025) Questioned Costs: None Identified Description: The Georgia Department of Public Safety should improve internal controls over matching, earmarking, and period of performance requirements to ensure expenditures meet required matching and earmarking percentages and are incurred within the required timeframes. Background Information: The Highway Safety Act of 1966 established the Highway Safety Cluster (HSC) as a formula grant for states to save lives and prevent injuries due to road traffic crashes. Funding is apportioned to State and Territorial Highway Safety Offices using statutory apportionment formulas and requirements. To receive funding, states must have an approved Triennial Highway Safety Plan and an approved Annual Grant Application that details planned projects. The Georgia Department of Public Safety (DPS) is required to maintain adequate internal controls over federal awards, including the matching, earmarking, and period of performance requirements for each federal award. Proper tracking allows the entity to ensure that expenditures meet appropriate matching and earmarking percentages and are incurred within the allowable timeframes in compliance with grant requirements. Criteria: As a recipient of federal awards, the DPS is required to establish, document and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Condition: Our audit of the HSC programs revealed there was no evidence of internal controls implemented over the matching, earmarking, and period of performance compliance requirements. Cause: For the matching and earmarking requirements, management has a process in place to calculate and track the required percentages; however, documentation supporting the calculations and tracking was not maintained. In addition, for the period of performance requirement, management did not establish and document an internal process to independently monitor grant activity and ensure expenditures occurred within the allowable period of performance. Effect: Without proper internal controls in place, there is an increased risk of noncompliance with the matching, earmarking, and period of performance requirements. Recommendation: We recommend that the DPS: • Establish and document processes and procedures associated with the matching, earmarking, and period of performance requirements; • Incorporate additional oversight, training, and/or staff to ensure staff are knowledgeable about applicable requirements; and • Retain sufficient documentation of internal control activities performed. Views of Responsible Officials: We concur with this finding.

2025-032 Improve Controls over Transparency Act Reporting Compliance Requirement: Reporting Internal Control Impact: Material Weakness Compliance Impact: Material Noncompliance Federal Awarding Agency: U.S. Department of Transportation Pass-Through Entity: None AL Numbers and Titles: 20.600 – State and Community Highway Safety 20.616 – National Priority Safety Programs Federal Award Numbers: 69A37525300004020GA0 (Year: 2025), 69A3752530000405BGAL (Year: 2025), 69A3752530000405CGA0 (Year: 2025), 69A3752530000405DGAM (Year: 2025), 69A3752530000405EGAA (Year: 2025), 69A3752530000405FGA1 (Year: 2025), 69A3752530000405GGA0 (Year: 2025), 69A3752530000405HGA0 (Year: 2025) Questioned Costs: None Identified Description: The Georgia Department of Public Safety should improve internal controls to ensure that subaward information associated with the Federal Funding Accountability and Transparency Act is reported appropriately and timely. Background Information: The Highway Safety Act of 1966 established the Highway Safety Cluster (HSC) as a formula grant for states to save lives and prevent injuries due to road traffic crashes. Funding is apportioned to State and Territorial Highway Safety Offices using statutory apportionment formulas and requirements. To receive funding, states must have an approved Triennial Highway Safety Plan and an approved Annual Grant Application that details planned projects. Funds associated with the HSC program are provided to the Georgia Department of Public Safety (DPS) for allocation to eligible subrecipients. Because the DPS subgrants program funds to various entities, the DPS must comply with the Federal Funding Accountability and Transparency Act of 2006 (FFATA). The FFATA requirements were signed into law on September 26, 2006 in an effort to give the American public access to information on how their tax dollars are being spent. This information, including information associated with the use of HSC program funds, is accessible via the USAspending.gov website. Criteria: As a recipient of federal awards, the DPS is required to establish, document and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Under the FFATA (Public Law 109-282), as codified in Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, recipients of grants or cooperative agreements, including the DPS who make first-tier subawards of $30,000 or more are required to register in the System for Award Management (SAM.gov). Subaward data, such as the subaward date, subawardee Unique Entity Identifier number, amount of subaward, subaward obligation/action date, date of report submission, and subaward number, are submitted through SAM.gov and accessible to the general public through the USAspending.gov website. Condition: Our examination of reporting requirements associated with HSC revealed that the DPS failed to submit subaward data to SAM.gov. Therefore, all first-tier subawards of $30,000 or more, and the associated subaward data, was not reflected on the USAspending.gov website as required. Cause: Through discussion with management, it was noted that there was a lack of clarity regarding the DPS’s responsibility for completing the FFATA reporting requirements. In addition, the DPS did not have a designated individual assigned to perform and oversee the FFATA reporting process. As a result, the required subaward information was not reported on SAM.gov in accordance with applicable requirements. Effect: The deficiencies noted in the FFATA reporting process resulted in noncompliance with federal regulations. Without effective controls in place to ensure compliance with federal reporting requirements, the transparency objective associated with the FFATA requirements was not achieved as the general public was unable to review expenditure data associated with the State of Georgia’s HSC programs. Recommendation: We recommend that the DPS: • Establish and document processes and procedures associated with the FFATA reporting requirements; • Incorporate additional oversight, training, and/or staff to aid in the identification of subawards to be reported and the reporting of appropriate data elements, as applicable, in a timely manner; and • Maintain documentation of subaward agreements and the determination of whether each subaward should be entered into SAM.gov in compliance with the FFATA reporting requirements. Views of Responsible Officials: We concur with this finding.

2025-033 Improve Controls over the Procurement Process Compliance Requirement: Procurement and Suspension and Debarment Internal Control Impact: Significant Deficiency Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of the Treasury Pass-Through Entity: None AL Number and Title: 21.027 – COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Federal Award Number: SLFRP1029 (Year: 2023) Questioned Costs: None Identified Repeat of Prior Year Finding: 2024-037 Description: The Georgia Department of Human Services should improve internal controls to ensure that they are complying with the State of Georgia’s Procurement Policy. Background Information: The Coronavirus State Fiscal Recovery Fund, (CSLFRF), provides direct payments to states, US territories, Tribal governments, metropolitan cities, counties, and non-entitlement units of local government to: 1. Respond to the public health emergency with respect to Coronavirus Disease 2019 (COVID-19) or its negative economic impacts, including by providing assistance to households, small businesses, nonprofits, and impacted industries, such as tourism, travel, and hospitality; 2. Respond to workers performing essential work during the COVID-19 public health emergency by providing premium pay to eligible workers of the recipient that perform essential work or by providing grants to eligible employees that have eligible workers who are performing essential work; 3. Provide government services, to the extent of the reduction in revenue of the eligible entities due to the COVID-19 public health emergency relative to revenues collected in the most recent full fiscal year of the eligible entities prior to the emergency; and 4. Make necessary investments in water, sewer, or broadband infrastructure. In August 2022, the Governor’s Office of Planning and Budget (OPB) dedicated more than $1 billion of CSLFRF federal funds to the Department of Human Services (DHS) to establish the Cash Assistance program. The Cash Assistance program provided one-time cash assistance of up to $350 for active enrollees of the Medicaid, PeachCare for Kids, Supplemental Nutrition Assistance Program, and/or Temporary Assistance for Needy Families government benefit programs in response to the negative economic impacts of the COVID-19 public health emergency. Criteria: As a recipient of federal awards, the DHS is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. The DHS is also required to comply with the procurement standards set forth in 2 CFR 200.317 through 2 CFR 200.327 of the Uniform Guidance. Pursuant to 2 CFR 200.317, “When conducting procurement transactions under a Federal award, a State… must follow the same policies and procedures it uses for procurements with non-Federal funds.” As a state agency, the DHS adheres to the State of Georgia Procurement Manual issued by the Department of Administrative Services (DOAS). Per the State of Georgia Procurement Manual, all contract extensions must occur in writing and require the supplier’s consent. The State Procurement Department’s (SPD) prior consent to the contract extension may also be required depending on the type of extension. Condition: Our examination of compliance with Procurement and Suspension and Debarment regulations for the Cash Assistance program revealed that the DHS did not follow the State of Georgia’s ongoing contract management process for the continuation of services. The DHS was also unable to provide a written notice of extension or amendment to continue services and was unable to provide documentation of written permission from the SPD. Cause: Through discussion with the DHS management, the DHS relied on the contractor to replace cash assistance cards that were lost or undeliverable in the prior year under the original terms of the contract rather than extending or amending the contract. Effect: Without a valid contract extension or amendment, federal funds may be used in a manner that is not in compliance with federal provisions and the Georgia Procurement Manual. Recommendation: The DHS should improve internal controls as they relate to the procurement and contracting processes to ensure that all contract extensions or amendments follow the processes established in the Georgia Procurement Manual. Views of Responsible Officials: DHS concurs with the finding.

2025-019 Improve Controls over Eligibility Determinations Compliance Requirement: Eligibility Internal Control Impact: Significant Deficiency Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of Health and Human Services Pass-Through Entity: None AL Number and Title: 93.558 – Temporary Assistance for Needy Families Federal Award Numbers: 2101GATANF (2021), 2201GATANF (2022), 2301GATANF (2023), 2401GATANF (2024), 2501GATANF (2025) Questioned Costs: $2,379 Description: The Department of Human Services should improve internal controls and monitoring over eligibility requirements to ensure that only eligible individuals receive benefits from the Temporary Assistance for Needy Families Program. Background Information: The Department of Human Services (DHS) delivers a wide range of services designed to promote self-sufficiency, safety, and well-being for all Georgians. In delivering these services, the DHS is awarded funding associated with the Temporary Assistance for Needy Families (TANF) program. The TANF program was designed to provide time-limited assistance to needy families with children so that the children can be cared for in their own homes or in the homes of relatives; to end dependence of needy parents on government benefits by promoting job preparation, work, and marriage; to prevent and reduce the incidence of out-of-wedlock pregnancies, including establishing prevention and reduction goals; and to encourage the formation and maintenance of two-parent families. The TANF program has specific eligibility requirements that must be satisfied by beneficiaries to receive TANF assistance. As part of the application process, applicants are required to complete and submit various forms to document eligibility information, including the Form 354, Expense Statement, which is used to verify income for the purpose of determining initial and ongoing eligibility for TANF benefits. Criteria: As a recipient of federal awards, the DHS is required to establish, document, and maintain effective internal control over federal awards that provide reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) Section 200.303 – Internal Controls. Eligibility determination requirements for the TANF program are addressed in Section 1300 of the DHS TANF Policy Manual. In accordance with provisions reflected in the TANF Policy Manual, benefits should only be paid to recipients who meet applicable eligibility criteria. Condition: Our audit of the TANF program revealed deficiencies in the performance of eligibility determinations. The DHS paid TANF benefits totaling $12,200,599 to 5,338 beneficiaries during the period under review. A sample of 40 individual case files was randomly selected for testing using a nonstatistical sampling method. Auditors performed procedures to determine if eligibility determinations were performed appropriately. Testing revealed that three case files did not include the required Form 354. Therefore, these individuals were deemed to be ineligible for benefits and overpaid by a total of $2,379. Questioned Costs: Upon testing a sample of $102,055 of TANF benefits payments, known questioned costs of $2,379 were identified for benefit payments to ineligible TANF recipients. Using the total population amount of $12,200,599, we project the likely questioned costs to be approximately $284,408. Cause: Through discussion with the DHS, management stated that high staff turnover resulted in increased training demands and caused delays in case processing and caseload management. In addition, established policies and procedures were not consistently followed, which resulted in errors in case processing. Effect: The deficiencies in eligibility determinations resulted in noncompliance with federal regulations. Also, grant provisions allow the grantor to penalize the DHS for noncompliance by suspending or terminating the award or withholding future awards. In addition, the DHS may be providing TANF benefits to ineligible individuals and claiming federal reimbursement for unallowable expenditures. Recommendation: We recommend that DHS: • Follow established processes and procedures associated with TANF eligibility determinations. • Clearly define roles and responsibilities for personnel involved in the eligibility process to ensure compliance with TANF rules and regulations; and • Incorporate additional oversight, training, and/or staff to aid in the applicant intake and case management process to ensure that only eligible individuals receive benefits. We also recommend that management consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Views of Responsible Officials: DHS concurs with the finding.

2025-025 Improve Controls over Transparency Act Reporting Compliance Requirement: Reporting Internal Control Impact: Material Weakness Compliance Impact: Material Noncompliance Federal Awarding Agency: U.S. Department of Health and Human Services Pass-Through Entity: None AL Number and Title: 93.667 – Social Services Block Grant Federal Award Numbers: 2301GASOSR (Year: 2023), 2401GASOSR (Year: 2024), 2501GASOSR (Year: 2025) Questioned Costs: None Identified Description: The Georgia Department of Human Services and the Georgia Department of Behavioral Health and Developmental Disabilities should improve internal controls over required Federal Funding Accountability and Transparency Act reporting to ensure that information is reported appropriately and timely. Background Information: The Social Services Block Grant (SSBG) is a flexible funding source that allows states and territories to tailor social service programming to their population’s needs. Through the SSBG, states provide essential social services that help achieve a myriad of goals to reduce dependency and promote self-sufficiency; protect children and adults from neglect, abuse, and exploitation; and help individuals who are unable to take care of themselves to stay in their homes or to find the best institutional arrangements. Funds associated with the SSBG program are provided by the Georgia Department of Human Services (DHS) to the Georgia Department of Behavioral Health and Developmental Disabilities (DBHDD) for allocation to eligible subrecipients. Because the DBHDD subgrants program funds to various entities, the DBHDD must comply with the Federal Funding Accountability and Transparency Act of 2006 (FFATA). The FFATA requirements were signed into law on September 26, 2006 in an effort to give the American public access to information on how their tax dollars are being spent. This information, including information associated with the use of the SSBG program funds, is accessible via the USAspending.gov website. Criteria: As a recipient of federal awards, the DBHDD is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Under the FFATA (Public Law 109-282), as codified in Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, recipients of grants or cooperative agreements, including DBHDD who make first-tier subawards of $30,000 or more are required to register in the System for Award Management (SAM.gov). Subaward data, such as the subaward date, subawardee Unique Entity Identifier number, amount of subaward, subaward obligation/action date, date of report submission, and subaward number, are submitted through SAM.gov and accessible to the general public through the USAspending.gov website. Condition: Our examination of reporting requirements associated with the SSBG program revealed that the DBHDD failed to submit subaward data to SAM.gov. Therefore, all first-tier subawards of $30,000 or more, and the associated subaward data, were not reflected on the USAspending.gov website as required. Cause: Through discussion with the DBHDD and the DHS management, it was noted that the Memorandum of Understanding (MOU) between the entities for the state pass-through of SSBG program funds did not outline specific responsibility for reporting the first-tier subawards of $30,000 or more. The DBHDD did not provide the DHS with information related to the subawards of $30,000 or more and the associated subaward data. In addition, staff turnover resulted in internal control processes and procedures not being followed in regard to FFATA reporting. Effect: The deficiencies noted in the FFATA reporting process resulted in noncompliance with federal regulations. Without effective controls in place to ensure compliance with federal reporting requirements, the transparency objective associated with the FFATA requirements was not achieved as the general public was unable to review all expenditure data associated with the State of Georgia’s SSBG program. Recommendation: We recommend that the DHS and the DBHDD: • Implement and document processes and procedures associated with the FFATA reporting requirements. • Incorporate additional oversight, training, and/or staff to aid in the identification of subawards to be reported and the reporting of appropriate data elements, as applicable, in a timely manner. • Maintain documentation of subaward agreements and the determination of whether each subaward should be entered into SAM.gov in compliance with the FFATA reporting requirements. • Update the MOU between the DHS and the DBHDD to include clear role responsibilities between the entities related to FFATA reporting requirements. Views of Responsible Officials: DBHDD agrees with this finding

2025-020 Improve Controls over Eligibility Determinations Compliance Requirement: Eligibility Internal Control Impact: Material Weakness Compliance Impact: Material Noncompliance Federal Awarding Agency: U.S. Department of Health and Human Services Pass-Through Entity: None AL Number and Title: 93.767 – Children’s Health Insurance Program Federal Award Numbers: 2405GA5021 (Year: 2024); 2505GA5021 (Year: 2025) Questioned Costs: $260 Repeat of Prior Year Finding: 2024-027 Description: The Department of Community Health and Department of Human Services did not have adequate controls in place to ensure that the required continuing eligibility determinations were performed. Background Information: The Department of Community Health (DCH) administers the Children’s Health Insurance Program (CHIP) that provides child medical coverage to low-income families who exceed Medicaid income limits. CHIP is a large public assistance program in Georgia with federal and state funds totaling approximately $761 million for fiscal year 2025. Eligibility for the CHIP program is determined by the Division of Family and Children Services (DFCS), a division within the Department of Human Services (DHS), which has offices in each of the 159 counties in the State of Georgia. Once eligibility information has been obtained, the DFCS enters the individual into the Georgia Gateway eligibility system, and an approval or denial notice is generated. The Georgia Medicaid Management Information System (GAMMIS) is updated through the Georgia Gateway interface when eligibility for a member is approved. When eligibility is denied, the DFCS sends the denial notice to the DCH, which triggers the removal of the denied member from GAMMIS. Additionally, children covered by public or private health, Third Party Liability (TPL), insurance are ineligible for coverage under CHIP. Criteria: As recipients of federal awards, both the DCH and the DHS are required to establish, document, and maintain effective internal controls over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) Section 200.303 – Internal Controls. Chapter 2200, Basic Eligibility Criteria, of the DFCS Medicaid Policy Manual outlines the eligibility determination requirements for CHIP members. Specifically, Section 30 addresses requirements associated with TPLs, and Section 55 addresses age requirements for participation in Family Medicaid. In accordance with these provisions, claims should only be paid on behalf of recipients who meet the eligibility criteria. Condition: Our audit of the CHIP program revealed deficiencies in the performance of eligibility determinations. During fiscal year 2025, the DCH paid CHIP benefits totaling $725,407,936 for 1,382,228 claims transactions. We used a nonstatistical sampling method to select a random sample of 40 benefit payments from this population and tested the sample to determine if eligibility determinations were performed appropriately. Upon completing this testing, it was determined that two members were covered by TPL insurance and therefore, should have been deemed ineligible for benefits. Questioned Costs: Known questioned costs of $260 were identified for benefit payments to the two ineligible CHIP members. The Federal and State share of questioned cost is approximately $198 and $62, respectively. Using the total population amount of $725,407,936, we project the likely questioned costs to be approximately $60,913,280. The Federal and State share of likely questioned costs is approximately $46,434,193 and $14,479,087, respectively. Cause: The processes that the DFCS performed did not ensure the correct eligibility determinations were made for all CHIP members. The DCH monitoring was not effective over eligibility information contained in the Georgia Gateway and GAMMIS systems. Effect: The deficiencies in eligibility determinations resulted in material noncompliance with federal regulations. Also, grant provisions allow the grantor to penalize the DCH for noncompliance by suspending or terminating the award or withholding future awards. In addition, the DCH may be providing CHIP benefits to ineligible individuals and claiming federal reimbursement for unallowable expenditures. Recommendation: The DCH and DHS management should strengthen oversight of the DFCS eligibility determinations for CHIP members to ensure they are being performed as required. Specifically, we recommend that: • The DCH management should review and improve their procedures for monitoring eligibility, and provide training as necessary to responsible staff; and • The DHS management should continue to provide training associated with these compliance requirements to all staff. We also recommend management consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Views of Responsible Officials: DHS concurs with the finding.

2025-018 Improve Controls over Medicaid Eligibility Determinations for Ex Parte Members Compliance Requirement: Eligibility Internal Control Impact: Significant Deficiency Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of Health and Human Services Pass-Through Entity: None AL Number and Title: 93.778 – Grants to States for Medicaid Federal Award Numbers: 2405GA5MAP (Year: 2024); 2505GA5MAP (Year: 2025) Questioned Costs: $5,247 Repeat of Prior Year Finding: 2024-028 Description: The Department of Community Health and Department of Human Services did not have effective internal controls in place to ensure the required continuing Medicaid eligibility determinations were performed for Supplemental Security Income Ex Parte members. Background Information: The Department of Community Health (DCH) administers the State’s Medicaid program that provides payments for medical assistance to low-income individuals. Medicaid is one of Georgia’s largest public assistance programs with federal and state funds totaling approximately $18 billion for fiscal year 2025. Eligibility for the Medicaid program is determined by the Division of Family and Children Services (DFCS), a division within the Department of Human Services (DHS), which has offices in each of the 159 counties in the State of Georgia. Individuals who are eligible for Supplemental Security Income (SSI) are also eligible for the Medicaid benefits, and those whose SSI benefits are terminated or denied by the Social Security Administration are SSI Ex Parte members for the Medicaid program. For those members, the DCH makes temporary determinations of continued eligibility under a new Ex Parte Medicaid Class of Assistance in the Georgia Medicaid Management Information System (GAMMIS). The DFCS is responsible for performing a Continuing Medicaid Determination (CMD) for each new SSI Ex Parte member. The DFCS uses the daily Ex Parte Determination Reports generated by GAMMIS to identify the new SSI Ex Parte members that require a CMD. GAMMIS also generates monthly Ex Parte Non-Confirmation Reports, which identify all entries from the Ex Parte Determination Reports that are over 30-days old and have not yet been acted upon. When a CMD is complete, the DFCS enters the individual in the Georgia Gateway eligibility system, and an approval or denial notice is generated. GAMMIS is updated through the Georgia Gateway interface when eligibility for a member is approved. When eligibility is denied, the DFCS sends the denial notice to the DCH, which triggers the removal of the denied member from GAMMIS. Criteria: As recipients of federal awards, both the DCH and the DHS are required to establish, document, and maintain effective internal controls over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) Section 200.303 – Internal Controls. The eligibility determination requirements for SSI Ex Parte members are addressed in Chapter 2700, Section 50 - DCH Reports - Ex Parte Lists of the DHS Medicaid Manual. In accordance with provisions reflected in the Medicaid Manual, the DFCS is required to perform eligibility determinations of those members whose SSI benefits are terminated or denied. Condition: Our audit of the Medicaid program revealed deficiencies in the performance of eligibility determinations for SSI Ex Parte members. During fiscal year 2025, the DCH paid Medicaid SSI Ex Parte members benefits totaling $51,119,147 for 9,082 members. We used a nonstatistical sampling method to select a random sample of 60 Ex Parte benefit payments from this population and tested the sample to determine if eligibility determinations were performed appropriately. The following deficiencies were identified: • 45 members were denied by the DFCS in Georgia Gateway but remained active in GAMMIS in error. • GAMMIS reflected one member as deceased; however, benefit payments continued to be made. • Eligibility determinations were not performed for six members tested. Questioned Costs: Known questioned costs of $5,247 were identified for benefit payments to the 52 ineligible SSI Ex Parte members. The Federal and State share of questioned cost is approximately $3,464 and $1,783, respectively. Using the total population amount of $51,119,147, we project the likely questioned costs to be approximately $30,958,586. The Federal and State share of likely questioned costs is approximately $20,438,675 and $10,519,911, respectively. Cause: The processes that the DFCS performed did not ensure the required eligibility determinations were made for all SSI Ex Parte members. Also, while the DCH has systems in place to automate the eligibility process, the Georgia Gateway and GAMMIS systems were not properly interfaced. This resulted in a failure to effectively update member eligibility data between the two platforms. Effect: The deficiencies in eligibility determinations resulted in noncompliance with federal regulations. Also, grant provisions allow the grantor to penalize the DCH for noncompliance by suspending or terminating the award or withholding future awards. In addition, the DCH may be providing Medicaid benefits to ineligible individuals and claiming federal reimbursement for unallowable expenditures. Recommendation: The DCH and DHS management should strengthen oversight of the DFCS eligibility determinations for SSI Ex Parte members to make certain they are being performed timely and accurately. Specifically, management should: • Dedicate the necessary resources to ensure that the Georgia Gateway and GAMMIS systems are interfaced properly; • Review settings within GAMMIS to prevent payments associated with deceased individuals; • Oversee a reconciliation process between members with completed CMDs to members listed on the daily and monthly Ex Parte Determination Reports; and • Continue to provide training associated with these compliance requirements to all staff. We also recommend that management consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Views of Responsible Officials: We concur with this finding.

2025-021 Improve Controls over Medicaid Eligibility Determinations for Non-SSI Members Compliance Requirement: Eligibility Internal Control Impact: Significant Deficiency Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of Health and Human Services Pass-Through Entity: None AL Number and Title: 93.778 – Grants to States for Medicaid Federal Award Numbers: 2405GA5MAP (Year: 2024); 2505GA5MAP (Year: 2025) Questioned Costs: $187 Description: The Department of Community Health and Department of Human Services did not have effective internal controls in place to ensure the required continuing Medicaid eligibility determinations were performed for Non-Supplemental Security Income members. Background Information: The Department of Community Health (DCH) administers the State’s Medicaid program that provides payments for medical assistance to low-income individuals. Medicaid is one of Georgia’s largest public assistance programs with federal and state funds totaling approximately $18 billion for fiscal year 2025. Eligibility for the Medicaid program is determined by the Division of Family and Children Services (DFCS), a division within the Department of Human Services (DHS), which has offices in each of the 159 counties in the State of Georgia. Once eligibility information has been obtained, the DFCS enters the individual in the Georgia Gateway eligibility system, and an approval or denial notice is generated. The Georgia Medicaid Management Information System (GAMMIS) is updated through the Georgia Gateway interface when eligibility for a member is approved. When eligibility is denied, the DFCS sends the denial notice to the DCH, which triggers the removal of the denied member from GAMMIS. Criteria: As recipients of federal awards, both the DCH and the DHS are required to establish, document, and maintain effective internal controls over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) Section 200.303 – Internal Controls. The eligibility determination requirements for Non-Supplemental Security Income (Non-SSI) members are addressed in Chapter 2200, Section 55 – Age (Family Medicaid) of the DHS Medicaid Manual. In accordance with provisions reflected in the Medicaid Manual, claims should only be paid on behalf of recipients who meet the eligibility criteria. Condition: Our audit of the Medicaid program revealed deficiencies in the performance of eligibility determinations for Non-SSI members. During fiscal year 2025, the DCH paid Medicaid Non-SSI members benefits totaling $9,047,815,777 for 6,111,754 claims transactions. We used a nonstatistical sampling method to select a random sample of 33 Non-SSI benefit payments from this population and tested the sample to determine if eligibility determinations were performed appropriately. The following deficiencies were identified: • One member was erroneously determined to be eligible because the incorrect pay frequency was used in the income rate determination. • One member was a newborn at the time that eligibility was determined, and the required Social Security Number documentation was not updated once the child reached one year of age. • One member’s eligibility was limited to the Public Health Emergency (PHE) period, but their renewal was extended beyond the authorized timeframe. Questioned Costs: Known questioned costs of $187 were identified for benefit payments to the three ineligible Non-SSI members. The Federal and State share of questioned cost is approximately $123 and $64, respectively. Using the total population amount of $9,047,815,777, we project the likely questioned costs to be approximately $270,771,946. The Federal and State share of likely questioned costs is approximately $178,780,013 and $91,991,933, respectively. Cause: The processes that the DFCS performed did not ensure the required eligibility criteria were met. Additionally, the process did not ensure PHE-related eligibility was terminated as required. Furthermore, the DCH monitoring process was not adequate to identify data fields that were incomplete or not current in the transmission between the Georgia Gateway and GAMMIS systems. Effect: The deficiencies in eligibility determinations resulted in noncompliance with federal regulations. Also, grant provisions allow the grantor to penalize the DCH for noncompliance by suspending or terminating the award or withholding future awards. In addition, the DCH may be providing Medicaid benefits to ineligible individuals and claiming federal reimbursement for unallowable expenditures. Recommendation: The DCH and DHS management should strengthen oversight of the DFCS eligibility determinations for Non-SSI members to make certain they are being performed accurately. Specifically, we recommend that: • The DHS management should implement review procedures that ensure data is entered correctly; • The DHS and DCH management should implement monitoring procedures that target incomplete required data elements; • The DHS and DCH management should implement monitoring procedures over waiver recipients prior to the end of the waiver period to ensure correct determinations are made; and • The DHS management should continue to provide training associated with these compliance requirements to all staff. We also recommend that management consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Views of Responsible Officials: DHS concurs with the finding.

2025-023 Improve Controls over Earmarking Requirements Compliance Requirement: Matching, Level of Effort, Earmarking Internal Control Impact: Material Weakness Compliance Impact: Material Noncompliance Federal Awarding Agency: U.S. Department of Health and Human Services Pass-Through Entity: None AL Numbers and Titles: 93.958 – Block Grants for Community Mental Health Services 93.958 – COVID-19 – Block Grants for Community Mental Health Services Federal Award Numbers: B09SM085388 (Year: 2021), B09SM087284 (Year: 2021), B09SM087352 (Year: 2023) Questioned Costs: $2,872,330 Description: The Georgia Department of Behavioral Health and Developmental Disabilities should improve internal controls to ensure that earmarking requirements associated with federal programs are met. Background Information: The Community Mental Health Services Block Grant (MHBG) program was created to provide funds to states and territories to enable them to carry out their respective plans for providing comprehensive community-based mental health services for adults with serious mental illness and children with serious emotional disturbances. MHBG program funds are allocated to individual states based upon a formula. This funding is provided to the Georgia Department of Behavioral Health and Development Disabilities (DBHDD) and may be distributed by the DBHDD to cities, counties, or service providers within the State of Georgia to carry out activities associated with the state plan. In carrying out the state plan and providing community mental health services, the DBHDD must meet specific earmarking requirements to ensure that MHBG funds are used for specifically designated purposes or activities. Therefore, the DBHDD is responsible for implementing adequate controls to ensure that earmarking requirements are met and earmarked funds are accurately recorded, monitored, and reported. Criteria: As a recipient of federal awards, the DBHDD is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Provisions included in Title 42 of the U.S. Code (USC) §300x-9(c)(1) require states to “expend not less than 10 percent of the amount the State receives… each fiscal year to support evidence-based programs that address the needs of individuals with early serious mental illness, including psychotic disorders, regardless of the age of the individual at onset.” Provisions included in Title 42 USC §300x-9(c)(2) provide that “in lieu of expending 10 percent of the amount the State receives…, a State may elect to expend not less than 20 percent of such amount by the end of such succeeding fiscal year.” Further, provisions included in Title 42 USC §300x-9(d)(1) require states to “expend at least 5 percent of the amount the State receives… each fiscal year to support evidenced-based programs that address the crisis care needs of individuals with serious mental illnesses and children with serious emotional disturbances, which may include individuals (including children and adolescents) experiencing mental health crises demonstrating serious mental illness or serious emotional disturbance, as applicable.” Provisions included in Title 42 USC §300x-9(d)(3) provide that “in lieu of expending 5 percent of the amount the State receives…, a State may elect to expend not less than 10 percent of such amount to support such programs by the end of two consecutive fiscal years.” Condition: Upon review of award documentation associated with the MHBG program, auditors identified three MHBG awards for which closeout procedures were performed during the fiscal year under review. Therefore, these awards were specifically tested to ensure that earmarking requirements were met with regards to administrative expenses, evidence-based programs that address early serious mental illness, and evidenced-based programs that address crisis care. The following deficiencies were noted upon testing the earmarking requirements for award number B09SM085388, which was awarded a total of $30,385,390: • The DBHDD was required to expend at least 10 percent of amounts received, or $3,038,539, to support evidenced-based programs that address early serious mental illness. The DBHDD only expended $1,685,479 for this purpose. Therefore, the DBHDD should have expended an additional $1,353,060 to meet this earmarking requirement. • The DBHDD was required to expend at least 5 percent of amounts received, or $1,519,270, to support evidenced-based programs that address crisis care. However, no funds were expended for this purpose, and the DBHDD did not meet this earmarking requirement. Questioned Costs: Known questioned costs of $2,872,330 were identified for funding that should have been expended to satisfy earmarking requirements but was expended for other purposes. Cause: Per discussions with the DBHDD management, the complexity of administering multiple supplemental grant awards, along with the termination of one award prior to the original liquidation date, contributed to inconsistent monitoring of earmarking requirements. As a result, communication gaps and coordination challenges arose between program and finance management. Effect: The deficiencies noted with MHBG earmarking requirements resulted in noncompliance with federal regulations. Also, grant provisions allow the grantor to penalize the DBHDD for noncompliance by suspending or terminating the award or withholding future awards. Recommendation: We recommend that the DBHDD strengthen controls over earmarking requirements by ensuring established policies and procedures are consistently followed. Management should also enhance monitoring procedures over grant awards with multiple supplemental awards to ensure earmarked funds are accurately tracked and expended in accordance with applicable requirements. In addition, management should provide training to program and finance staff to improve coordination between departments, understanding of earmarking requirements, and timely identification of issues. We also recommend that management consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Views of Responsible Officials: DBHDD agrees with the finding.

2025-022 Improve Controls over Transparency Act Reporting Compliance Requirement: Reporting Internal Control Impact: Material Weakness Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of Health and Human Services Pass-Through Entity: None AL Numbers and Titles: 93.788 – Opioid STR 93.958 – Block Grants for Community Mental Health Services 93.958 – COVID-19 – Block Grants for Community Mental Health Services 93.959 – Block Grants for Prevention and Treatment of Substance Abuse 93.959 – COVID-19 – Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers: H79TI085741 (Year: 2022), H79TI087737 (Year: 2024), B09SM089617 (Year: 2024), B09SM084001 (Year: 2021), B09SM085388 (Year: 2021), B09SM090335 (Year 2025), B08TI083934 (Year: 2021), B08TI085799 (Year: 2023), B08TI087031 (Year: 2024), B08TI083530 (Year: 2021), B08TI088098 (Year: 2025) Questioned Costs: None Identified Repeat of Prior Year Findings: 2024-030, 2023-023, 2022-025 Description: The Georgia Department of Behavioral Health and Developmental Disabilities should improve internal controls over required Federal Funding Accountability and Transparency Act reporting to ensure that information is reported appropriately and timely. Background Information: The Block Grants for Community Mental Health Services Block Grant (MHBG) program was created to provide funds to states and territories to enable them to carry out their respective plans for providing comprehensive community-based mental health services for adults with serious mental illness and children with serious emotional disturbances. MHBG program funds are allocated to individual states based upon a formula. This funding may be distributed to cities, counties, or service providers within each state to carry out activities associated with the state plan. The objective of the Substance Abuse Prevention and Treatment Block Grant (SABG) program is to provide funds to states, territories, and one Indian tribe for the purpose of planning, carrying out, and evaluating activities to prevent and treat, Substance Abuse (SA) and other related activities as authorized by the statute. The objective of the Opioid STR (OSTR) program is to provide funds to states and Tribes for the purpose of addressing the opioid crisis within their communities. OSTR program funds are for carrying out activities that supplement opioid-related activities and these activities are undertaken by the state agency that administers the SABG program. Funds associated with the MHBG, SABG, and OSTR programs are provided to the Georgia Department of Behavioral Health and Developmental Disabilities (DBHDD) for allocation to eligible entities, including local health agencies, community-based organizations, and other public or private entities, through subgrants. Because the DBHDD subgrants MHBG, SABG, and OSTR program funds to various entities, the DBHDD must comply with the Federal Funding Accountability and Transparency Act of 2006 (FFATA). The FFATA requirements were signed into law on September 26, 2006 in an effort to give the American public access to information on how their tax dollars are being spent. This information, including information associated with the use of MHBG, SABG, and OSTR program funds, is accessible via the USAspending.gov website. Criteria: As a recipient of federal awards, the DBHDD is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Under the FFATA (Public Law 109-282), as codified in Title 2 CFR Part 170, Reporting Subaward and Executive Compensation Information, recipients of grants or cooperative agreements, including the DBHDD, who make first-tier subawards of $30,000 or more are required to register in the System for Award Management (SAM.gov). Subaward data, such as the subaward date, subawardee Unique Entity Identifier number, amount of subaward, subaward obligation/action date, date of report submission, and subaward number, are submitted through SAM.gov and accessible to the general public through the USAspending.gov website. Condition: Our audit of the MHBG, SABG, and OSTR programs revealed there was no evidence of review and approval or a comparable internal control over the FFATA reports. Additionally, upon performing testing over FFATA reporting, auditors noted the following deficiencies: • From a population of 99 first-tier subawards or subaward modifications of $30,000 or more associated with the MHBG program, a sample of 15 subawards or subaward modifications totaling $3,185,584 was randomly selected for testing using a non-statistical sampling method. Auditors examined documentation to determine if the subrecipient’s information was properly reported on the USAspending.gov website. Testing revealed that all 15 subawards or subaward modifications tested were not reported timely. • From a population of 279 first-tier subawards or subaward modifications of $30,000 or more associated with the SABG program, a sample of 40 subawards or subaward modifications totaling $9,156,749 was randomly selected for testing using a non-statistical sampling method. Auditors examined documentation to determine if the subrecipient’s information was properly reported on the USAspending.gov website. Testing revealed that 37 subawards or subaward modifications totaling $8,303,493 were not reported timely. • From a population of 48 first-tier subawards or subaward modifications of $30,000 or more associated with the OSTR program, a sample of seven subawards or subaward modifications totaling $2,607,200 was randomly selected for testing using a non-statistical sampling method. Auditors examined documentation to determine if the subrecipient’s information was properly reported on the USAspending.gov website. Testing revealed that one subaward or subaward modification totaling $550,700 was reported under the incorrect federal award identification number and five subawards or subaward modifications totaling $2,015,000 were not reported timely. Cause: Formal internal control processes for FFATA reporting were established but not implemented correctly during the fiscal year under review. As a result, noncompliance occurred with respect to FFATA reporting. Effect: The deficiencies noted in the FFATA reporting process resulted in noncompliance with federal regulations. Without effective controls in place to ensure compliance with federal reporting requirements, the transparency objective associated with the FFATA requirements may not be achieved as the general public was unable to review timely expenditure data associated with the State of Georgia’s MHBG, SABG, and OSTR programs. Recommendation: We recommend that the DBHDD: • Implement and document established processes and procedures associated with the FFATA reporting requirements. • Incorporate additional oversight, training, and/or staff to aid in the identification of subawards to be reported and the reporting of appropriate data elements, as applicable, in a timely manner; and • Review, update, and maintain documentation of subaward agreements and the determination of whether each subaward should be entered into SAM.gov in compliance with the FFATA reporting requirements. Views of Responsible Officials: DBHDD agrees with this finding.

2025-024 Improve Controls over Earmarking Requirements Compliance Requirement: Matching, Level of Effort, Earmarking Internal Control Impact: Significant Deficiency Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of Health and Human Services Pass-Through Entity: None AL Numbers and Titles: 93.959 – Block Grants for Prevention and Treatment of Substance Abuse 93.959 – COVID-19 – Block Grants for Prevention and Treatment of Substance Abuse Federal Award Numbers: B08TI083934 (Year: 2021, B08TI083530 (Year: 2021), B08TI085799 (Year: 2023) Questioned Costs: $3,015,691 Description: The Georgia Department of Behavioral Health and Developmental Disabilities should improve internal controls to ensure that earmarking requirements associated with federal programs are met. Background Information: The objective of the Substance Abuse Prevention and Treatment Block Grant (SABG) program is to provide funds to states, territories, and one Indian tribe for planning, carrying out, and evaluating activities to prevent, treat, and provide recovery services for Substance Abuse (SA) and other related activities as authorized by the statute. SABG program funding is provided to the Georgia Department of Behavioral Health and Development Disabilities (DBHDD) to carry out these activities. In carrying out these activities, the DBHDD must meet specific earmarking requirements to ensure that SABG funds are used for specifically designated purposes or activities. Therefore, the DBHDD is responsible for implementing adequate controls to ensure that earmarking requirements are met and earmarked funds are accurately recorded, monitored, and reported. Criteria: As a recipient of federal awards, the DBHDD is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Provisions included in Title 45 CFR Sections 96.124 (b)(1) require states to “expend not less than 20 percent for programs for individuals who do not require treatment for substance abuse, which programs – (i) educate and counsel the individuals on such abuse; and (ii) provide for activities to reduce the risk of such abuse by the individuals.” Further, provisions included in Title 42 of the U.S. Code §300x-24(b) define designated states as “any State whose rate of cases of acquired immune deficiency syndrome is 10 or more such cases per 100,000 individuals (as indicated by the number of such cases reported to and confirmed by the Director of the Centers for Disease Control and Prevention for the most recent calendar year for which such data are available)” and require designated states to expend not less than two percent and not more than five percent of the SABG award amount to carry out one or more projects to make available to individuals early intervention services for human immunodeficiency virus (EIS HIV) at the sites where the individuals are undergoing substance abuse treatment. Condition: Upon review of award documentation associated with the SABG program, auditors identified three SABG awards for which closeout procedures were performed during the fiscal year under review. Therefore, these awards were specifically tested to ensure that earmarking requirements associated with primary prevention programs for individuals who do not require treatment, carrying out one or more projects to make available to individuals EIS HIV, and administration expenses had been satisfied. The following deficiencies were noted: • For award number B08TI083934, which totaled $38,820,318, the DBHDD was required to expend at least 20 percent of the award amount, or $7,764,064, to support primary prevention programs for individuals who do not require treatment. The DBHDD only expended $5,781,988 for this purpose. Therefore, the DBHDD should have expended an additional $1,982,076 to meet this earmarking requirement. • For award number B08TI085799, $58,922,488 of the total award was subject to EIS HIV earmarking requirements. The DBHDD was required to expend a maximum of five percent of the adjusted award amount, or $2,946,124, to carry out one or more projects to make available to individuals EIS HIV. However, the DBHDD expended $3,675,943 for this purpose, exceeding the maximum amount by $729,819. • For award number B08TI083530, which totaled $50,518,974, the DBHDD was required to expend a maximum of five percent of the award amount, or $2,525,949 to carry out one or more projects to make available to individuals EIS HIV. However, the DBHDD expended $2,829,745 for this purpose, exceeding the maximum amount by $303,796. Questioned Costs: Known questioned costs of $3,015,691 were identified for funding that was expended in excess of earmarking requirements or should have been expended to satisfy earmarking requirements but was expended for other purposes. Cause: Per discussions with DBHDD management, the complexity of administering multiple supplemental grant awards, along with the termination of one award prior to its liquidation date, contributed to inconsistent monitoring of earmarking requirements. As a result, communication gaps and coordination challenges arose between program and finance management. Effect: The deficiencies noted with SABG earmarking requirements resulted in noncompliance with federal regulations. Also, grant provisions allow the grantor to penalize the DBHDD for noncompliance by suspending or terminating the award or withholding future awards. Recommendation: We recommend that the DBHDD strengthen controls over earmarking requirements by ensuring established policies and procedures are consistently followed. Management should also enhance monitoring procedures over grant awards with multiple supplemental awards to ensure earmarked funds are accurately tracked and expended in accordance with applicable requirements. In addition, management should provide training to program and finance staff to improve coordination between departments, understanding of earmarking requirements, and timely identification of issues. We also recommend that management consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Views of Responsible Officials: DBHDD agrees with this finding.

2025-034 Improve Controls over Indirect Cost Rate Plan Compliance Requirement: Allowable Costs/Cost Principles Internal Control Impact: Material Weakness Compliance Impact: Material Noncompliance Federal Awarding Agencies: U.S. Social Security Administration Pass-Through Entities: None AL Number and Title: 96.001 – Social Security Disability Insurance Federal Award Numbers: 2504GADI00 (Year: 2025), 2404GADI00 (Year: 2024) Questioned Costs: $4,363,991 Description: The Georgia Vocational Rehabilitation Agency did not have a federally approved negotiated indirect cost rate agreement in place with its cognizant Federal agency for the fiscal period under audit. Background Information: The Social Security Disability Insurance (DI) program was established in 1954 under Title II of the Social Security Act and provides benefits to disabled wage earners and their families in the event the family wage earner becomes disabled. The Georgia Vocational Rehabilitation Agency (GVRA) works with the U.S. Social Security Administration (SSA) to make disability determinations for Georgia citizens and ultimately disburses DI program funding to eligible recipients. In performing this work, the GVRA incurs both direct and indirect costs. Under federal regulations, indirect costs charged to the DI program should be based on a rate approved by the cognizant federal agency, SSA, as evidenced by a written agreement. Criteria: As a recipient of federal awards, the GVRA is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Additionally, provisions included in the Uniform Guidance, Appendix VII to Part 200 – States and Local Government and Indian Tribe Indirect Cost Proposals, Section D1(b) state, “A governmental department or agency… that receives more than $35 million in direct Federal funding during its fiscal year must submit its indirect cost rate proposal to its cognizant agency for indirect costs.” Section D(1)(d) further explains that “Indirect cost proposals must be developed (and, when required, submitted) within six months after the close of the governmental unit’s fiscal year, unless an exception is approved by the cognizant agency for indirect costs.” Condition: Our audit of the DI program included a review of indirect cost expenditures charged to the program. Our review revealed that the indirect cost rate plan utilized was related to fiscal year 2015 and was not federally approved for the fiscal year under review. Therefore, unallowable indirect costs totaling $4,363,991 were calculated using this unapproved indirect cost rate plan and recorded through four journal entries during the year under review. Questioned Cost: Known questioned costs of $4,363,991 were identified for expenditures that were not supported by a federally approved indirect cost rate plan. These known questioned costs related to expenditures that were not tested as part of a sample, and therefore, should not be projected to a population to determine likely questioned costs. Cause: Because the GVRA is administratively attached to the Georgia Department of Human Services, the GVRA management faced challenges determining the appropriate cognizant Federal agency with whom to communicate and confusion associated with which indirect cost plan to implement for the fiscal year under review. Therefore, for fiscal year 2025, the GVRA followed the methodology from the most recently approved indirect cost rate plan, which was from fiscal year 2015. Effect: The deficiencies noted in the indirect cost process resulted in noncompliance with federal regulations and questioned costs. Without effective controls in place, there is an increased risk of federal funds being expended for unallowable purposes and untimely detection and correction of noncompliance. Also, grant provisions allow the grantor to penalize the GVRA for noncompliance by suspending or terminating the award or withholding future awards. Recommendation: Management should improve controls over indirect costs to ensure an indirect cost rate proposal is developed and submitted to the cognizant Federal agency for negotiation and approval within six months of each fiscal year end. Additionally, the GVRA management should incorporate additional oversight, training, and/or staffing within the indirect cost rate proposal process. We also recommend that management consult with the grantor to discuss whether the questioned costs identified in the audit should be repaid. Views of Responsible Officials: GVRA believes its internal controls and cost allocation practices are aligned with established standard operating procedures. In early 2024, GVRA engaged with an accounting firm specializing in governmental cost allocation, to develop a Cost Allocation Plan reflective of the agency’s unique organizational structure, grant reporting requirements, and federal oversight. Given that GVRA’s federal funding is administered under the oversight of three separate federal agencies, the Cost Allocation Plan is subject to a formal, multi-agency review and approval process. GVRA’s established procedures require coordinated engagement with each federal cognizant agency and its parent agency to ensure documented compliance with all applicable statutory, regulatory, and oversight requirements. In late 2024, final revisions to the federal Uniform Guidance regarding the “de minimis” indirect cost rate were issued, providing GVRA the opportunity to simplify its cost allocation methodology and meet its federal compliance obligations under the updated standard. GVRA received written email approval from the Social Security Administration (SSA) to continue utilizing its current cost allocation methodology until a negotiated indirect cost rate is established. GVRA has undergone audit review by both SSA and the Rehabilitation Services Administration (RSA) under the current methodology, with no findings or questioned costs reported. Additionally, the current Georgia Department of Audits and Accounts (DOAA) audit has continued to review funds administered under this approach. Auditor’s Concluding Remarks: As noted above, the indirect cost plan presented for audit was drafted in 2015 and did not reflect the required evidence of approval by the grantor. Given that the plan was outdated and appeared to be unapproved, we reaffirm our finding and will review the status of the finding during our next audit.

Reference Number: 2025-002 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Department of Elementary and Secondary Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.555, 10.582 Award Number and Year: 254MA303N1099 (10/1/2024-9/30/2025) 254MA303N1199 (10/1/2024-9/30/2025) 254MA300L1603 (10/1/2024-9/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information in SAM.gov. Context: Twelve of forty subawards selected for testing were not reported in SAM.gov. The Department did not complete any FFATA reporting after FSRS reporting transitioned to SAM.gov in March 2025 resulting in subaward reporting not being completed for subawards issued after February 2025. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department did not update its procedures and controls regarding subaward reporting after FSRS reporting transitioned to SAM.gov in March 2025. Effect: Subawards were not reported to FSRS. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately to SAM.gov no later than the end of the month following the month of issuance of each subaward. If the Department is unable to complete reporting in SAM.gov, it should follow up with the Service Desk and consult with their federal award contacts for assistance and guidance. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-003 Prior Year Finding: 2024-007 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: 24A55WP000063 (7/1/2024 – 9/30/2027), 23555DV000008 (10/1/2022 – 12/31/2024), 23555DV000005 (7/1/2023 - 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information in accordance with FFATA requirements. Context: Nine of nine subawards selected for testing were not reported in accordance with FFATA reporting requirements. Specifically, we noted the following: • 6 of 9 subawards were not reported within the required timeframe. These subawards were not reported until after they were selected for testing by the auditors. Two subawards were due to be reported by 11/30/2024 and four subawards were due to be reported by 2/28/2025. These subawards were reported on 11/21/2025, which was subsequent to when the requests to review the reports were made by the auditors. • 3 of 9 subaward modifications were not reported. These modifications included two increases to the original subaward of less than $30,000 and one decrease to the original subaward of less than $30,000. The original subawards were greater than $30,000 requiring any modifications to the subaward, regardless of the dollar value, to be reported. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely nor that subaward modifications less than $30,000 were reported. Effect: The Department omitted subaward amendments from FFATA reporting and did not report other subawards until after they were selected by auditors for testing. Auditors note that the Department’s corrective action plan from the prior audit had not yet been fully implemented in FY 2025. Questioned costs: None. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should implement procedures and internal controls to ensure that all required subawards and subaward modifications are reported no later than the end of the month following the month of issuance. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-004 Prior Year Finding: 2024-009 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: 2355DV000008-01-00 (10/1/2022 – 12/31/2024) 24555DV000087 (10/1/2023 – 12/31/2025) 25555DV000114 (10/1/2024 – 9/30/2025) Compliance Requirement: Reporting – VETS-402(A/B) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: VETS-402 (A/B), Expenditure Detail Report – This expenditure and staff utilization report separately identifies Jobs for Veterans State Grant-expenditures each quarter and year-to-date as a supplement to the DVOP and LVER SF 425, Federal Financial Reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Reports submitted by the Executive Office of Labor and Workforce Development (the Department) did not agree with supporting documentation. Context: Five of five reports selected for testing did not agree with supporting documentation. Numerous variances were noted in multiple sections of the reports filed for the 12/31/2024 and 3/31/2025 quarters. • For the 12/31/2024 reports, variances were noted in the following line items: o Section B: Allocations by Activity specific to Local Veterans Employment Representatives and Management and Administrative Costs o Section C: Outlays and Obligations by Activity specific to Line C.1 Disabled Veterans Outreach Program (DVOP) for funded DVOP positions, DVOP salaries paid, total DVOP outlays, and DVOP unliquidated obligations, Line C.3 Local Veterans Employment Representatives (LVER) for funded LVER positions, LVER salaries paid, LVER benefits paid, and total LVER outlay and Line C.5 Management and Administrative Costs for management and administrative outlays and management and administrative unliquidated obligations. • For the 3/31/2025 reports, variances were noted in the following line items: o Section C: Outlays and Obligations by Activity specific to Line C.1 Disabled Veterans Outreach Program (DVOP) for funded DVOP positions, DVOP unliquidated obligations and Line C.3 Local Veterans Employment Representatives (LVER) for LVER salaries paid, LVER benefits paid, and total LVER outlay line items. Cause: The Department’s procedures were not sufficient to ensure that reports agreed with supporting documentation. Internal controls did not prevent or detect the errors. Auditors noted that the Department has not completed implementation of their corrective action plan from the prior year. Effect: Numerous line items in quarterly reports tested did not agree with supporting documentation. Questioned costs: Undetermined. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. Procedures and internal controls over reporting should be sufficient to ensure that reports are accurate and agree with supporting documentation. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-005 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: 23A55WP000005 (7/1/2023 – 9/30/2026) 24A55WP000063 (7/1/2024 – 9/30/2027) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Four of forty timesheets selected for testing charged costs to the program based on budgeted rates instead of actual time worked per employee timesheets. Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). Specifically, we noted the following: • 2 of 40 employee timesheets selected for testing did not use combination codes and the employees’ time was defaulted to a budgeted grant allocation rather than the employees’ actual time and effort on the program. • 2 of 40 employee timesheets selected for testing had a bilingual differential and were missing combination codes. The payment was not based on the employee’s timesheet but instead was based on a budgeted percentage of time. One employee’s time was overcharged by 25% and the other was overcharged by 40%. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Questioned costs: $5,389, the amount overcharged to the program based on budgeted time rather than actual time recorded on employee timesheets. Recommendation: The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-006 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Employment Service Cluster Assistance Listing Number: 17.207, 17.801 Award Number and Year: 23A55WP000005 (7/1/2023 – 9/30/2026) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s); in this case, Employment Service and Unemployment Insurance Programs (Employment Service Cluster). Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: One of seven ETA 9130 reports selected for testing did not agree with supporting documentation. Specifically, unliquidated obligations reported for program FES2024 in the 6/30/2024 quarter did not agree to underlying records. Cause: The Department’s procedures were not sufficient to ensure that the ETA 9130 report was accurate and agreed with supporting documentation. Internal controls did not prevent or detect the error. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-007 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) Compliance Requirement: Reporting – ETA 2112, UI Financial Transaction Summary Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 2112, UI Financial Transaction Summary (OMB No. 1205-0154) – Per ET Handbook 401, 5th Edition, Form ETA 2112 is a monthly summary of transactions in a state unemployment fund which consists of the Clearing Account, Unemployment Trust Fund (UTF) Account, and Benefit Payment Account. All payments by employers (and employees where applicable) into a state unemployment fund for contributions, payments in lieu of contributions, and special assessments should be accounted for in the report. Penalty and interest should be reported if deposited into the clearing account and transferred to the UTF. Funds received from the Federal Employees Compensation Account (FECA) and the Extended Unemployment Compensation Account (EUCA) as advances or reimbursements for Federal benefit obligations paid through the benefit payment account should be identified and reported in appropriate line items. All funds deposited into, transferred, or paid from the state unemployment fund (the state clearing account, the state account in the UTF, and the state benefit payment account) should be reflected on the ETA 2112 except for payments/benefits paid under the Alternative Trade Adjustment Assistance (ATAA) and Trade Adjustment Assistance (TAA) programs. Form ETA 2112 provides a summary of data pertaining to state unemployment insurance (UI) tax collections, regular benefits paid, Federal and state shares of extended benefits paid, Federal temporary program benefits paid, and other transactions affecting the UTF. In addition, it reflects specific areas where adjustments are indicated to determine the adequacy of resources available for regular unemployment benefit payments. Data from this form are also used with data from other statistical reports to study trends in financial aspects of the UI program and as a basis for solvency studies. This report is due the 1st day of the second month following the month of reference. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 2112, UI Financial Transaction Summary reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Four ETA 2112 reports were selected for testing. For 2 of the 4 reports tested, we noted the following exceptions: • For 1 of the 4 reports tested, the incorrect amount was reported on Line 28 (Other Sources #4) for Item D. Clearing Account. The report was overstated by $56,283. • For 1 of the 4 reports tested, the amounts on Line 11 (Net UI Contributions), Line 19 (Reimb Local Govt/Indian Tribes) and Line 21 (Reimbursement Non-Profit) under Item D. Clearing Account did not agree to supporting documentation. While the total amount agrees overall, each individual line item does not reconcile to the supporting documentation. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that ETA 2112 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Recommendation: The Department should review its procedures to ensure that ETA 2112 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-008 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) Compliance Requirement: Reporting – ETA 2208A – Quarterly UI Above-Base Report Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: ETA 2208A, Quarterly UI Above-Base Report (OMB No. 1205-0132) – Quarterly report of staff years worked and paid by program category. Reports are due no later than 30 days after the end of each quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 2208A – Quarterly UI Above-Base Reports submitted by the Executive Office of Labor and Workforce Development (Department) contained multiple data entry and calculation errors. Context: Three ETA 2208A reports were selected for testing for each of the 9/30/2024 and 12/31/2024 quarters for a total of six ETA 2208A reports tested. The ETA 2208A is commonly referred to as the “UI‑3,” which is the legacy name for the report. Exceptions were identified in 2 of the 6 reports selected for testing. Specifically, we noted the following: • For 1 of 3 reports selected for the 9/30/2024 quarter, the incorrect number was input on "Line 1 Initial Claims" of the ETA UI-3 Additional Benefits report. The total workload reported was 232 and should have been 268. In addition, "Line 2 weeks claims" for the UI-3 Additional Benefits report was incorrectly reported. The number on the underlying support was 3,661 and the reported total workload was 3,361. • For 1 of 3 reports selected for the 12/31/2024 quarter, the incorrect number was input on "Line 1 Initial Claims" of the UI-3 Additional Benefits report. The total workload reported was 233 and should have been 305. In addition, the underlying support for “Line 1. Initial Claims” reported total workload of 1 for Unemployment Compensation for Federal Employees for the month of December 2024, but should have been reported as 0. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that ETA 2208A reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Recommendation: The Department should review and update its reporting procedures and controls to ensure that ETA 2208A reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-009 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) Compliance Requirement: ETA 9052 – Nonmonetary Determination Time Lapse Detection Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it takes states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant non-monetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department was unable to provide documentation that the ETA 9052 – Nonmonetary Determination Time Lapse Detection report was submitted timely. Context: Four monthly ETA 9052 reports were selected for testing. Specifically, we noted the following: • For 1 of 4 reports selected for testing, the Department was unable to provide support that the report was submitted timely. The report for the month of May 2025 had a submission due date of June 20, 2025. The Department did not maintain a copy of the original report and auditors were unable to verify the submission date. After the original submission, the Department discovered a reporting error caused by a system transition, and the Department submitted a revised report on July 22, 2025. Questioned costs: Undetermined. Cause: The Department’s internal controls were insufficient to ensure that copies of submitted reports were retained. Effect: The untimely submission of required federal reports resulted in noncompliance with federal reporting requirements. Recommendation: The Department should review and update its reporting procedures and controls to ensure that ETA 9052 - Nonmonetary Determination Time Lapse Detection reports are submitted timely and that copies of report submissions are maintained and are readily available for audit. Reports should be reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-010 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 24A55UI00054 (10/1/2023 – 12/31/2026) Compliance Requirement: Reporting – ETA 9130, Financial Status Report, UI Programs Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: ETA 9130, Financial Status Report, UI Programs (OMB No. 1205-0461) – The ETA 9130 report is used to report program and administrative expenditures. All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UI Projects (administration and benefits). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130, Financial Status Reports for UI Programs submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Eight ETA 9130 reports were selected for testing. For 1 of the 8 reports tested, we noted the following exception: • Expenditures related to the Interdepartmental Service Agreements (ISA) object class were not included in “Line G Federal Share of Unliquidated Obligations” of the report. The supporting documentation for the report included the object class ISA in the amount of federal share of unliquidated obligations; however, this was not included in the report. Questioned costs: Undetermined. Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Recommendation: The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-011 Prior Year Finding: 2024-005 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) Compliance Requirement: Special Tests and Provisions – UI Benefit Payments Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL’s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is exempted from such requirement (20 CFR section 602.22). BAM estimates error rates, number of claims improperly paid or denied, and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA’s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): • a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; • 95 percent of cases must be completed within 90 days of the week ending date of the batch; • a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) did not complete BAM case investigations within the time limits established in the ET Handbook No. 395. Context: Sixty cases were selected for testing. The Department did not meet the required time limits for closing cases within 90 days. We noted that 92% of cases tested (55 of 60 cases) were closed within 90 days, which is less than the required 95%. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met the required BAM investigation time limits for closing cases. Auditors note that the Department’s corrective action plan from the prior audit had not yet been fully implemented in FY 2025. Effect: Noncompliance with BAM case investigation time limits could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. We recommend the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely in accordance with the time limits established in the ET Handbook No. 395. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-012 Prior Year Finding: 2024-006 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) 23A60UR000009 (1/1/2023 – 9/30/2025) 24A60UR000073 (1/1/2024 – 9/30/2026) 25A60UR000122 (1/1/2025 – 6/30/2027) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. RESEA-related performance reports are due on the 20th day of the second month following the end of the reporting quarter. A state UI staff member must review these reports for accuracy each calendar quarter and prior to submission, in addition to being reviewed by the RESEA program lead (if a different staff member). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not review performance reports prior to submission. Context: The Department lacks a formalized process for validating the accuracy of quarterly performance reports. Consequently, there was no documentation available to confirm that these reports were reviewed prior to submission. Questioned costs: Undetermined. Cause: The Department’s procedures and controls were not sufficient to ensure it met RESEA program and reporting requirements. The Department does not have a formal process to validate the accuracy of quarterly performance reports. Auditors note that the Department’s corrective action plan from the prior audit had not yet been fully implemented in FY 2025. Effect: The Department was unable to demonstrate that it was operating the RESEA program in accordance with federal requirements. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. We recommend the Department review and enhance procedures and controls to ensure that RESEA program requirements are met. We further recommend the Department develop a formal process to review quarterly performance reports for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-013 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372292255A25 (10/1/2021 – 12/31/2024) UI393282355A25 (10/1/2022 – 12/31/2025) 23A55UI039328 (10/1/2022 – 12/31/2025) 24A55UI00054 (10/1/2023 – 12/31/2026) 25A55UI000099 (10/1/2024 – 12/31/2027) Compliance Requirement: Special Tests and Provisions: UI Program Integrity – Overpayments Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: States are (1) required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments, and (2) states are prohibited from providing relief from charges to an employer’s Unemployment Insurance (UI) account when overpayments are the result of the employer’s failure to respond timely or adequately to a request for information. States may continue to waive recovery of overpayments in certain situations and must continue to offer the individual a fair hearing prior to recovery. In addition, states may approve “blanket waivers” where individuals are eligible for payment under an unemployment benefit program for a given week, but through no fault of the individual, they were paid incorrectly under either the PUA or PEUC program at a higher WBA, or specific to PUA, when, through no fault of the individual, the state paid the individual a minimum WBA based on DUA guidance other than UIPL No. 03-20 (UIPL No. 20-21, section 4.d.ii). Program requirements for overpayments include the State must identify the basis for the overpayment consistent with its written procedures. An overpayment memorandum is created summarizing the details of the overpayment and submitted to UI cross-match staff or claims deputy for review. Upon review, the overpayment is established, and a Deputy Decision or WVUC-B-14-J Overpayment Determination is generated and sent to the claimant. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) was not in compliance with program requirements for recovering overpayments. Context: Sixty overpayment claims were selected for testing. For 10 of 60 claims selected for testing we noted multiple errors were identified regarding overpayments documentation and recovery. Specifically, we noted the following: • For 5 of 60 claims, the claim was the result of a claimant error related to fault or fraud. The claimant was not being charged interest on the overpayment as required. • For 3 of 60 claims, the incorrect cause of the overpayment was reported in the system. • For 1 of 60 claims, there was a penalty balance charged to the claimant although the overpayment was not the result of fault or fraud. Questioned costs: Undetermined. Cause: The Department’s procedures and controls are not sufficient to ensure that overpayments are recovered in accordance with program requirements. Staff are not adequately trained in proper handling of overpayment documentation and recovery. Effect: Failure to recover overpayments in accordance with federal requirements compromises the integrity and sustainability of the UI program. Unrecovered overpayments reduce funds available to pay legitimate benefits, increase the risk of fraud and improper payments, and undermine compliance with federal program standards. Recommendation: The Department should perform staff training and strengthen its procedures and controls to ensure overpayments are identified, recorded, and recovered in a timely manner and in full compliance with federal requirements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-014 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster, Employment Service Cluster Assistance Listing Number: 17.258, 17.259, 17.278, 17.207, 17.801 Award Number and Year: AA-38535-22-55-A-25 (4/1/2022 – 6/30/2025) 23A55AW000048 (7/1/2023 – 6/30/2026) 23A55AY000020 (4/1/2023 – 6/30/2026) 23A55WP000005 (7/1/2023 – 9/30/2026) 24A55WP000063 (7/1/2024 – 9/30/2027) 25A55WP000139 (7/1/2025 - 9/30/2028) 24A55WG000092 ((7/1/2024 – 9/30/2027) 23A55WG000028 (7/1/2023 – 9/30/2026) ES387362255A25 (7/1/2022 - 9/30/2025) 25555DV000114 (10/1/2024 - 9/30/2025) 24555DV000087 (10/1/2023 - 12/31/2025) 23555DV000008 (10/1/2022 - 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles – Indirect Costs Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR Part 200, Appendix V, all costs and other data used to distribute costs included in the central service cost allocation plan should be supported by formal accounting and other records that will support the propriety of the costs assigned to Federal awards. Per 2 CFR Part 200, Appendix VII C.1.b., where a governmental unit's department or agency has several major functions which benefit from its indirect costs in varying degrees, the allocation of indirect costs may require the accumulation of such costs into separate cost groupings which then are allocated individually to benefitted functions by means of a base which best measures the relative degree of benefit. The indirect costs allocated to each function are then distributed to individual Federal awards and other activities included in that function by means of an indirect cost rate(s). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) was unable to provide documentation supporting the calculation of its internal negotiated indirect cost rate (NICR) which was approved by the U.S. Department of Labor and was in effect for FY 2025. Context: WIOA Cluster: For 32 of 40 reimbursement requests selected for testing, the Department applied the approved internal NICR in effect for FY 2025. Auditors recalculated the NICR using supporting documentation provided by the Department and determined that the rate was 6.60% but the rate submitted to and approved by the U.S. Department of Labor was 4.19%. The Department was unable to provide documentation for how the 4.19% rate was calculated. Employment Service Cluster: For 32 of 40 reimbursement requests selected for testing, the Department applied the approved internal NICR in effect for FY 2025. Auditors recalculated the NICR using supporting documentation provided by the Department and determined that the rate was 6.60% but the rate submitted to and approved by the U.S. Department of Labor was 4.19%. The Department was unable to provide documentation for how the 4.19% rate was calculated. Cause: The Department’s procedures and internal controls were not operating effectively to ensure that it properly calculated its NICR nor that it maintained appropriate documentation supporting the rate calculation. The department indicated the lack of supporting documentation for the 4.19% rate was due to staff turnover. Effect: The rate supported by documentation was 6.60%, but the rate submitted to the U.S. Department of Labor was 4.19%, resulting in the Department receiving lower indirect cost reimbursement than it was entitled to. Questioned costs: None. The approved indirect cost rate was properly applied, but was lower than the rate calculated using supporting documentation. Recommendation: The Department should review and enhance its procedures and internal controls regarding the calculation of its negotiated indirect cost rate and for maintaining documentation supporting the rate calculation. This documentation should be readily available for audit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-015 Prior Year Finding: 2024-010 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AW000097 (7/1/2024 – 6/30/2027) AA-38535-22-55-A-25 (4/1/2022 – 6/30/2025) 24A55AT000067 (7/1/2024 – 6/30/2027) 24A55AY000057 (4/1/2024 – 6/30/2027) 23A55AY000020 (4/1/2023 – 6/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Executive Office of Labor and Workforce Development (Department) did not report subaward information timely and did not have evidence of review and approval of FFATA reports prior to report submission. Context: Ten subawards were selected for testing and several of these subawards were modified after the initial award, for a total of fourteen subaward transactions tested. Nine of fourteen subaward transactions tested were not reported in accordance with FFATA requirements. Specifically, we noted the following: • 9 of 14 subaward transactions were not reported timely. The subaward transactions were reported from one to seven months after the due date. • For 2 of 14 subaward transactions, the Department was unable to produce documentation supporting review and approval of the FFATA reports prior to submission. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subaward transactions were reported timely nor that the FFATA report submissions were reviewed and approved prior to submission. Auditors note that the Department’s corrective action plan from the prior audit had not yet been fully implemented in FY 2025. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department’s procedures and internal controls should ensure that all required FFATA report submissions are reviewed, approved and subsequently reported timely no later than the end of the month following the month of issuance of the subaward or subaward modification. Documentation of implemented controls should be readily available for audit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-016 Prior Year Finding: 2024-011 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 23A55AT000036 (7/1/2023 – 6/30/2026) 24A55AW000097 (7/1/2024 – 6/30/2027) AA-38535-22-55-A-25 (4/1/2022 – 6/30/2025) 24A55AT000067 (7/1/2024 – 6/30/2027) 23A55AW000048 (7/1/2023 – 6/30/2026) Compliance Requirement: Reporting – ETA 9130 – Financial Report Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Report – All ETA grantees are required to submit quarterly financial reports for each grant award they receive. Reports are required to be prepared using the specific format and instructions for the applicable program(s): Employment Service and Unemployment Insurance Programs (Employment Service Cluster) and Workforce Innovation and Opportunity Act (WIOA) instructions for the following: Statewide Adult; Workforce Statewide Youth; Statewide Dislocated Worker; Local Adult; Local Youth; and Local Dislocated Worker. A separate ETA 9130 is submitted for each of these categories. Funds reserved and set aside for PFP contract strategies are required to be reported on ETA 9130 basic reports for each ESC or WIOA fund source utilized. Reports are due 45 days after the end of the reporting quarter. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: ETA 9130 financial reports submitted by the Executive Office of Labor and Workforce Development (Department) did not agree to supporting documentation. Context: Nine ETA 9130 reports were selected for testing, which included three reports for the Adult program, four reports for the Dislocated Worker program, and two reports for the Youth program. For 7 of the 9 reports tested, exceptions were noted for several line items on each report. Specifically, we noted the following exceptions: • 3 of 3 reports for the Adult program did not agree to supporting documentation. The discrepancies were found in the following line items: o Federal share of expenditure o Total administration expenditures o Federal share unobligated obligations o Total program income earned o Program income expended in accordance with the addition method • 3 of 4 reports for the Dislocated Worker program did not agree to support documentation. The discrepancies were found in the following line items: o Federal share of expenditure o Total administration expenditures o Federal share unobligated obligations o Total program income earned o Program income expended in accordance with the addition method o Real property proceeds expended • 1 of 2 reports for the Youth program did not agree to supporting documentation. The discrepancies were found in the following line items: o Recapture funds expended o Program income expended in accordance with the addition method Cause: The Department’s procedures were not sufficient to ensure that ETA 9130 reports were accurate and agreed with supporting documentation. Internal controls did not prevent or detect the errors. Auditors note that the Department’s corrective action plan from the prior audit had not yet been fully implemented in FY 2025. Effect: Incorrect data was reported which could misrepresent the State’s financial performance in the program. Questioned costs: Undetermined. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should review its procedures to ensure that ETA 9130 reports are accurate and agree with supporting documentation. We further recommend that internal controls are enhanced to ensure that reports are reviewed for accuracy prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-017 Prior Year Finding: 2024-013 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AW000097 (7/1/2024 – 6/30/2027) 23A55AW000048 (7/1/2023 – 6/30/2026) AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) charged budgeted personnel costs to the program instead of actual costs due to errors coding employee timesheets. Context: Two of sixty timesheets selected for testing charged costs to the program based on budgeted rates instead of actual time worked per employee timesheets. Combination codes are used by employees to allocate and certify hours worked to Federal grants and employees’ supervisors are required to perform a line-item review of hours spent on each grant before approving timesheets. If a timesheet is approved without the use of combination codes, the system defaults to budgeted grant allocations entered into the Labor Cost Management (LCM) module of the Massachusetts Management Accounting and Reporting System (MMARS). For these two transactions, the employee had a bilingual differential and was missing combination codes. Payment was not based on the employee timesheets of 55% worked on the program but instead was based on a budgeted percentage of time of 100%. The program was therefore overcharged by 45% for the bilingual differential portion of the employee payroll. Cause: The Department’s controls were not operating effectively to ensure that time and effort reporting was performed in accordance with federal requirements. Auditors note that the Department’s corrective action plan from the prior audit had not yet been fully implemented in FY 2025. Effect: Noncompliance occurred as payroll charges allocated to the grants were not reflective of actual activity for which the employees were compensated. Questioned costs: $72, the amount overcharged to the program for the pay period tested for the bilingual differential. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should update its procedures and controls and perform additional training over time and effort reporting to ensure that payroll costs charged to the program are based on actual time and effort and a combination code that is allowable under the program. The Department should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-018 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: 24A55AW000097 (7/1/2024 – 6/30/2027) 23A55AW000048 (7/1/2023 – 6/30/2026) AA-38535-22-55-A-25 (7/1/2022 – 6/30/2025) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Earmarking Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR § 200.430 (a), costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; (2) Follows an appointment made in accordance with a non-Federal entity's laws or rules or written policies and meets the requirements of Federal statute, where applicable; and (3) Is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. Per 2 CFR § 200.430 (i), charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: • Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated, • Be incorporated into the official records of the non-Federal entity, • Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities, • Encompass both federally assisted, and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy, • Comply with the established accounting policies and practices of the non-Federal entity, • Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Earmarking – Statewide Activities: The governor shall reserve not more than 15 percent of each of the amounts allotted to the state Adult, Dislocated Worker, and Youth Activities for a fiscal year to carry out statewide activities under 29 USC 3164(b) or statewide employment and training activities for adults or dislocated workers under 29 USC 3174(a) (29 USC 3163(a), 128 Stat. 1502). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (the Department) does not have procedures to ensure it does not exceed the 15% limit for statewide activities. Context: The Department does not have controls in place to track or monitor the Governor's Discretionary Funds (GDF) to ensure expenditures charged against this allotment, whether through direct timesheets or payroll adjustments, do not exceed the required 15% limit across all programs within the WIOA Cluster. Cause: The Department lacks sufficient procedures or controls to ensure that it does not exceed the 15% limit for statewide activities. Effect: Failure to track or monitor the GDF could result in the Department exceeding the 15% limit for statewide activities. Questioned costs: None noted. The Department did not exceed the 15% limit. Recommendation: We recommend the Department develop procedures and controls to ensure expenditures coded to the GDF from timesheets or manual adjustments do not exceed the 15% limit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-019 Prior Year Finding: 2024-014 Federal Agency: U.S. Department of Labor State Agency: Executive Office of Labor and Workforce Development Federal Program: WIOA Cluster Assistance Listing Number: 17.258, 17.259, 17.278 Award Number and Year: AA-38535-22-55-A-25 (4/1/2022 – 6/30/2025) 23A55AY000020 (4/2/2023 – 6/30/2026) 23A55AT000036 (7/1/2023 – 6/30/2026) 23A55AW000048 (7/1/2023 – 6/30/2026) 24A55AY000057 (4/1/2024 – 6/30/2027) 24A55AT000067 (7/1/2024 – 6/30/2027) 24A55AW000097 (7/1/2024 – 6/30/2027) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Labor and Workforce Development (Department) omitted required federal award information from subawards it issued to their subrecipients. Context: For six of six subawards selected for testing, the subaward agreement did not include the federal award date for when the Federal agency awarded the funds to the prime recipient. Cause: The Department’s procedures and internal controls were not sufficient to ensure that subawards included all required information in accordance with 2 CFR section 200.332. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program information and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance internal controls and procedures to ensure that required information is included in its subawards. In its FY 2024 corrective action plan, the Department indicated that it had revised its documented internal controls and procedures to correct the prior year finding. We recommend that the Department revisit its procedures and controls and update as needed to ensure that the federal award date is included in all subaward agreements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Department of Elementary and Secondary Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund COVID-19 – American Rescue Plan-Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210025 (1/6/2021 – 3/31/2025) S425U210025 (3/4/2021 – 3/28/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Elementary and Secondary Education (Department) did not report subaward information in accordance with FFATA requirements. Context: Twelve of forty subawards selected for testing were not reported timely. The subawards were reported from 1 day to 423 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported no later than the end of the month following the month of issuance. Effect: Subawards were not reported timely in accordance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately no later than the end of the month following the month of issuance of each subaward. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Aging and Independence Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2201MAOAPH (10/1/2021 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2201MAOANS (10/1/2021 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) 2301MAOAPH (10/1/2022 - 9/30/2025) 2301MAOASS (10/1/2022 - 9/30/2024) 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOACM (10/1/2023 - 9/30/2025) 2401MAOAHD (10/1/2023 - 9/30/2025) 2501MAOANS (10/1/2024 - 9/30/2026) 2501MAOASS (10/1/2024 - 9/30/2026) 2501MAOACM (10/1/2024 - 9/30/2026) 2501MAOAHD (10/1/2024 - 9/30/2026) Compliance Requirement: Reporting - Financial Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Standard Form 425 - The submission of interim federal financial reports (FFR) will be on a quarterly, semi-annual, or annual basis, as directed by the Federal agency. A final FFR shall be submitted at the completion of the award agreement. The following reporting period end dates shall be used for interim reports: 3/31, 6/30, 9/30, or 12/31. For final FFRs, the reporting period end date shall be the end date of the project or grant period. Quarterly and semi-annual interim reports shall be submitted no later than 30 days after the end of each reporting period. Annual reports shall be submitted no later than 90 days after the end of each reporting period. Final reports shall be submitted no later than 90 days after the project or grant period end date. Administration for Community Living (ACL)/Administration of Aging (AoA) Title III Supplemental Form to SF-425: Final reports should be marked on the supplemental when a final has been submitted in the current and/or prior reporting periods. State Agencies are required to complete the Supplemental Form to the SF-425 Title III. States which are a Single State Planning and Service Area and do not have Area Agencies on Aging (AAA) are also required to complete the ACL/AoA Supplemental Form with each submission. This includes all lines and columns, except where a line is specifically designated for an Area Agency on Aging (AAA). The totals for each Part should total back to the ITEM on the SF425 form. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Aging and Independence (Department) failed to submit Federal Financial Reports (FFRs) and Title III Supplemental Form to SF-425 as required by the program. Context: Eleven of fourteen FFRs required to be submitted by the Department during FY 2025 were not submitted. The Department submitted reports only for awards 2201MAOACM, 2201MAOAHD, and 2201MAOASS. Three of four Title III Supplemental Form to SF-425 required to be submitted by the Department during FY 2025 were not submitted. The Department only submitted a report related to 2022. Questioned costs: Undetermined. Cause: The Department does not have procedures or internal controls to ensure that FFRs and Title III Supplemental Form to SF-425 are submitted as required by the program. Effect: FFRs were not submitted for approximately 80% of the grant awards issued to the Department and Title III Supplemental Form to SF-425 were not submitted for approximately 75% of the open grant years. Recommendation: We recommend the Department develop procedures and internal controls to ensure that it submits reports for all grant awards it receives for the program, in accordance with its grant agreements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-022 Prior Year Finding: 2024-016 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Aging and Independence Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2201MAOAPH (10/1/2021 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2201MAOANS (10/1/2021 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) 2301MAOAPH (10/1/2022 - 9/30/2025) 2301MAOASS (10/1/2022 - 9/30/2024) 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOACM (10/1/2023 - 9/30/2025) 2401MAOAHD (10/1/2023 - 9/30/2025) 2501MAOANS (10/1/2024 - 9/30/2026) 2501MAOASS (10/1/2024 - 9/30/2026) 2501MAOACM (10/1/2024 - 9/30/2026) 2501MAOAHD (10/1/2024 - 9/30/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Aging and Independence (Department) did not report subaward information per FFATA requirements. Context: The Department informed auditors that no subawards were reported. Therefore, a sample was unavailable for testing. Cause: The Department does not have procedures or controls regarding subaward reporting in accordance with FFATA requirements. Auditors noted that the Department’s corrective action plan from the prior audit had not been completed. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. We recommend the Department develop procedures and internal controls to ensure that all required subawards are reported timely and accurately no later than the end of the month following the month of issuance of each subaward. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-023 Prior Year Finding: 2024-018 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Aging and Independence Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2201MAOAPH (10/1/2021 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2201MAOANS (10/1/2021 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) 2301MAOAPH (10/1/2022 - 9/30/2025) 2301MAOASS (10/1/2022 - 9/30/2024) 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOACM (10/1/2023 - 9/30/2025) 2401MAOAHD (10/1/2023 - 9/30/2025) 2501MAOANS (10/1/2024 - 9/30/2026) 2501MAOASS (10/1/2024 - 9/30/2026) 2501MAOACM (10/1/2024 - 9/30/2026) 2501MAOAHD (10/1/2024 - 9/30/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Aging and Independence (Department) issued subawards that did not contain all required federal award information, and it failed to properly monitor subrecipients. Context: Exceptions were found for eight of eight subawards selected for testing. Subawards were missing one or more required federal award identification elements and were not properly monitored. Specifically, we noted the following: • 4 of 8 subawards were missing one or more required award identification elements including the Federal Award Date, the Federal Award Identification Number (FAIN), the name of the Federal agency, the Assistance Listing number (ALN) and the federal award title, the dollar amount made available under each ALN, and the federal award project description as required by the Federal Funding Accountability and Transparency Act (FFATA). • 2 of 8 subrecipients selected for testing were not properly monitored by the Department. The Department was unable to provide documentation that it had proper monitoring procedures in place nor that monitoring procedures were followed for these subrecipients. • For 1 of 8 subrecipients, the Department did not obtain a copy of the subrecipient’s annual single audit report. Therefore, the Department did not verify that its annual single audit had been conducted, nor did it issue a management decision on audit findings. Questioned costs: Undetermined. Cause: The Department’s procedures and internal controls were not sufficient to ensure that the Department provided all required federal information to subrecipients at the time of the subaward nor that subrecipient monitoring was completed in accordance with the requirements of the federal programs. Auditors noted that the Department’s corrective action plan from the prior audit had not been completed. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should review and enhance internal controls and procedures to ensure that it includes all required information in the subaward agreements. We also recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal programs. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Aging and Independence Federal Program: Aging Cluster Assistance Listing Number: 93.044, 93.045, 93.053 Award Number and Year: 2101MASSC6 (4/1/2021 - 9/30/2024) 2101MAHDC6 (4/1/2021 - 9/30/2024) 2101MACMC6 (4/1/2021 - 9/30/2024) 2201MAOASS (10/1/2021 - 9/30/2024) 2201MAOAPH (10/1/2021 - 9/30/2024) 2201MAOAHD (10/1/2021 - 9/30/2024) 2201MAOANS (10/1/2021 - 9/30/2024) 2201MAOACM (10/1/2021 - 9/30/2024) 2301MAOACM (10/1/2022 - 9/30/2024) 2301MAOAHD (10/1/2022 - 9/30/2024) 2301MAOAPH (10/1/2022 - 9/30/2025) 2301MAOASS (10/1/2022 - 9/30/2024) 2401MAOANS (10/1/2023 - 9/30/2025) 2401MAOASS (10/1/2023 - 9/30/2025) 2401MAOACM (10/1/2023 - 9/30/2025) 2401MAOAHD (10/1/2023 - 9/30/2025) 2501MAOANS (10/1/2024 - 9/30/2026) 2501MAOASS (10/1/2024 - 9/30/2026) 2501MAOACM (10/1/2024 - 9/30/2026) 2501MAOAHD (10/1/2024 - 9/30/2026) Compliance Requirement: Matching Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Matching requirements for Title III Supportive Services and Nutrition Services and American Rescue Plan Supportive Services and Nutrition Services Grants include the following: • State and Area Agencies – Area Plan Administration: State and area agencies, in the aggregate, must contribute at least 25 percent of the costs of administration of area plans. For States, since this match is computed based on the aggregate of all area agencies in the state. • Service Provision: All services, whether provided by the State Agency, an Area Agency, or other service providers (excluding any ombudsman services provided under the authority of 42 USC 3024 (d)(1)(D)) must be funded with a nonfederal match of at least 15 percent. One-third of the required 15 percent match must come from state sources, and this percentage must be met on a statewide basis. Funds for ombudsman services provided under the authority of 42 USC 3024 (d)(1)(B) are not required to be matched. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Aging and Independence (Department) did not review its calculation of matching requirements for accuracy. Context: The Department’s calculation of match for Area Plan Administration and for Service Provision were not reviewed for accuracy prior to submission. Auditors determined that the calculations did not agree to supporting documentation. These variances did not affect the total match calculated and the Department met compliance related to the program’s overall required match. Questioned costs: None noted. The Department’s overall match requirement was met. Cause: The Department’s internal controls were not sufficient to ensure that calculations of its matching requirements were reviewed for accuracy prior to submission. Effect: Failure to review matching requirement calculations could result in potential errors going undetected and the Department might not meet its matching requirements. Recommendation: We recommend the Department review and enhance its internal controls regarding review and approval of program matching calculations to ensure that they are accurate and agree to supporting documentation. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-025 Prior Year Finding: 2024-019 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 6 NH23IP922629 (7/1/2019-6/30/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information in accordance with FFATA requirements. Context: Eight of eight subawards were not reported to SAM.gov until after they were selected for testing by auditors. The subawards were issued from 7/1/2024 through 3/31/2025 but were not reported until 1/22/2026 after they were selected for testing during the FY 2025 audit. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has not implemented its corrective action plan from the prior audit. It does not have sufficient procedures and internal controls to ensure that all required subawards are reported timely and accurately. Effect: Subawards were not reported to SAM.gov until after they were selected for testing by auditors. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit. It should establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to SAM.gov no later than the end of the month following the month of issuance of each subaward. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-026 Prior Year Finding: 2024-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000518 (8/1/2022 – 7/31/2027) 24NU51CK000343 (8/1/2024 – 7/31/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not report subaward information in accordance with FFATA requirements. Context: Eight of eight subawards were not reported to SAM.gov until after they were selected for testing by auditors. The subawards were issued in May 2024 but were not reported until January 2026 after they were selected for testing during the FY 2025 audit. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department has not implemented its corrective action plan from the prior audit. The Department does not have sufficient procedures and internal controls to ensure that all required subawards are reported timely and accurately. Effect: Subawards were not reported to SAM.gov until after they were selected for testing by auditors. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit. It should establish procedures and internal controls to ensure that all required subawards are reported timely and accurately to SAM.gov no later than the end of the month following the month of issuance of each subaward. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-027 Prior Year Finding: 2024-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases COVID-19 – Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000518 (8/1/2022 – 7/31/2027) 24NU51CK000343 (8/1/2024 – 7/31/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not properly monitor subrecipients and the Department omitted required federal award information from subawards. Context: Eight subawards issued to eight subrecipients were selected for testing. Specifically, we noted the following exceptions: • For eight of eight subrecipients selected for testing, the Department did not adequately monitor the subrecipients. It did not obtain a copy of the subrecipients’ annual single audit report. Therefore, the Department did not verify that the annual single audits had been conducted, nor did it issue a management decision on any audit findings. • For eight of eight subawards selected for testing, the Federal Award Identification Number (FAIN) was omitted from the subaward agreements. Cause: The Department’s procedures were not sufficient to ensure that subrecipients were properly monitored, nor that subawards included all required information. Internal controls did not detect or prevent the errors. The Department had not completed implementation of its corrective action plan from the prior year. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: None. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. We recommend the Department review and enhance its internal controls and procedures to ensure subrecipient monitoring is performed in compliance with the requirements of the federal program. The Department should review and enhance internal controls and procedures to ensure that it includes all required information in the subaward agreements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-028 Prior Year Finding: 2024-021 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases, COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000518 (8/1/2022 – 7/31/2027) 24NU51CK000343 (8/1/2024 – 7/31/2025) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Non-federal entities are required to submit Financial and Performance Measure Reports in accordance with the terms and conditions of the Federal award. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not review and approve quarterly Core Base Grant financial reports or COVID Core Base Grant financial reports prior to submission. Context: Four quarterly reports were selected for testing, comprising of two Core Base Grant Financial Reports and two COVID Core Base Grant financial. For two of the four reports tested, there was no evidence of review and approval prior to submission. Questioned costs: Undetermined. Cause: The Department has not completed implementation of the corrective action plan from the prior audit. The Department's internal controls were not sufficient to ensure that quarterly financial reports were reviewed prior to submission. Effect: Failure to review and approve reports prior to submission could allow reporting errors to be undetected. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior audit. We recommend that the Department review and enhance its internal controls to ensure financial reports are reviewed and approved prior to submission. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Children and Families Federal Program: Adoption Assistance Assistance Listing Number: 93.659 Award Number and Year: 2501MAADPT (10/1/2023 – 9/30/2024) 2401MAADPT (10/1/2024 – 9/30/2025) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Adoption assistance subsidy payments may be paid on behalf of a child if eligibility requirements are met. Requirements include the following: (1) Categorical Eligibility - Applicable and Non-Applicable Children – An applicable child is a child for whom an adoption assistance agreement was entered into in fiscal year (FY) 2010 or later and who meets the applicable age requirement (differs over a multi fiscal year phase-in period beginning in FY 2010), or a child who has been in foster care under the responsibility of the Title IV-E agency for at least 60 consecutive months, or a sibling to either such child if both are to have the same adoption placement (42 USC 673(e)(2) and (e)(3)). (2)(f) The prospective adoptive parent(s) and any other adult living in the home who has resided in the provider home in the preceding five years must satisfactorily have met a child abuse and neglect registry check. This requirement became effective on October 1, 2006, unless the state requires legislation to implement the requirement, in which case a delayed implementation is permitted until the first quarter of the state’s regular legislative session following the close of the first regular session beginning after October 1, 2006. The requirement applies to foster care maintenance payments for calendar quarters beginning on or after that date. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Children and Families (Department) was unable to provide documentation supporting participant eligibility in the form of a signed subsidy agreement and was unable to provide documentation that child abuse and neglect registry checks were performed for out-of-state adoptive family homes. Context: Forty participants were selected for testing and the following exceptions were noted: • For 1 of 40 participants, the Department was unable to provide a copy of the original signed subsidy agreement. The legalization date was 5/17/2013 but the original signed agreement was unavailable. The child is still receiving a subsidy, and the Department was able to provide the two most recent signed subsidy renewal letters from 2022 and 2024. The subsidy renewal letter is signed by the adoptive parent confirming the child is currently residing in the home, the parent is legally responsible for the child, and the parent provides financial support for the child. The Department uses iFamilyNet as their statewide case management system. iFamilyNet includes the signed subsidy agreement date; however, we were unable to verify the accuracy of that date without a copy of the original signed subsidy agreement. • For 2 of 40 participants, the Department was unable to provide documentation that a child abuse and neglect registry check was completed as part of the application or license approvals for homes in which the adoptive parent(s) previously lived out-of-state. These homes were originally licensed in 2006 and 2013, respectively and these homes received subsidies during FY 2025. The homes are currently closed and are no longer receiving subsidies subsequent to June 30, 2025. Cause: The Department’s procedures and internal controls were not sufficient to ensure that participant eligibility documentation was maintained and that child abuse and neglect registry checks were performed. For the missing registry checks, at the time these homes were licensed, the Department did not have a formal process to request or document out of state child welfare registry checks. Effect: Claims may have been paid on behalf of an ineligible participant and children may have been placed in homes that were ineligible to participate in the program. Questioned costs: Undetermined. Recommendation: The Department should enhance its procedures and internal controls to ensure it maintains documentation of participant eligibility and child abuse and neglect registry checks, and that this documentation is readily available for audit. We also recommend the Department enhance the renewal letter to include the reaffirmation of the original subsidy agreement date by the participant. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Children’s Health Insurance Program (CHIP) Assistance Listing Number: 93.767 Award Number and Year: 2405MA5021 (10/1/2023 – 9/30/2025) 2505MA5021 (10/1/2024 – 9/30/2026) Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility (Screening and Enrollment) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: To be allowable, Children’s Health Insurance Program (CHIP) costs must be covered by the state plan or CMS approved waivers/demonstrations. Providers receiving payments under the program must meet eligibility requirements. To receive CHIP payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the CHIP program (42 CFR 457.990); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state. CHIP-managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. Providers who have been barred from participation by the OIG exclusion list are not eligible to be enrolled in the CHIP program (42 CFR 457.990, 42 CFR 455 Subpart E). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (the Department) did not properly document CHIP provider eligibility. Context: Sixty providers were selected for testing and the following exceptions were noted: • For 6 of 60 providers selected for testing, a revalidation letter was not provided or generated. The Department indicated that it did not have a process to generate revalidation letters for dental providers. • For 5 of 60 providers selected for testing, the Department was unable to provide documentation that a revalidation of the provider’s eligibility was performed within the required 5-year cycle for dental providers. • 3 of 60 providers selected for testing were not revalidated prior to the latest revalidation in 2024. The providers’ enrollment dates were more than 10 years prior to the 2024 revalidation date, which indicates a minimum of two revalidations were not completed for these dental providers as required. • For 3 of 60 providers selected for testing, the Department was unable to provide a copy of the provider agreement. • For 2 of 60 providers selected for testing, sanction verifications were not completed for all individuals listed on the disclosure forms. • For 1 of 60 providers selected for testing, the provider agreement was not countersigned. All of the above exceptions noted related to dental providers. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation that providers were eligible to perform services under the program. Internal controls did not prevent or detect the errors. Effect: Failure to properly document provider eligibility could allow payments to be made to ineligible providers. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the providers were eligible nor if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it maintains documentation that claims are paid only to eligible providers and that documentation is readily available for audit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-033 Prior Year Finding: 2024-034 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP25, XIX-MAP24 Compliance Requirement: Allowable Activities/Allowable Costs Special Tests and Provisions – Provider Eligibility and Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: To be allowable, Medicaid costs for medical services must be (1) covered by the state plan or CMS approved waivers/demonstrations; (2) reviewed by the state consistent with the state’s documented procedures and system for determining medical necessity of claims; (3) properly coded; and (4) paid at the rate allowed by the state plan. Furthermore, beneficiaries must be eligible (or presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Additionally, Medicaid costs must be net of beneficiary cost-sharing obligations and applicable credits (e.g., insurance, recoveries from other third parties who are responsible for covering the Medicaid costs, and drug rebates), paid to eligible providers, and only provided on behalf of eligible individuals. In order to receive Medicaid payments, providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the Medicaid program (42 CFR 431.107 and 447.10; and Section 1902(a)(9) of the Act (42 USC 1396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR Part 455, Subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. States must also follow guidance issued in the Medicaid Provider Enrollment Compendium (MPEC) to enroll providers into their Medicaid programs. Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR Part 442). The standards may be modified in the state plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) did not properly perform or document provider eligibility determinations. Context: Sixty providers were selected for testing of provider eligibility and provider health and safety standards. The following exceptions were noted: • For 3 of 60 providers selected for testing, the Department was unable to provide documentation that a revalidation of the provider’s eligibility and verification of the provider’s health and safety standards was performed within the required 5-year cycle. • For 1 of 60 providers selected for testing, the Department was unable to provide a provider agreement. • For 1 of 60 providers selected for testing, the provider was not revalidated prior to the latest revalidation in 2024. The provider’s enrollment date was more than 10 years prior to the 2024 revalidation date, which indicates a minimum of two revalidations were not completed for this provider as required. • For 2 of 60 providers selected for testing, a revalidation letter was not provided or generated. The Department indicated that it did not have a process to generate revalidation letters for dental providers. All of the above exceptions noted related to dental providers. Cause: The Department’s procedures were not sufficient to ensure it maintained documentation that providers were eligible to perform services under the program and were in compliance with health and safety standards. Internal controls did not prevent or detect the errors. Effect: Failure to properly document provider eligibility and compliance with health and safety standards could allow payments to be made to ineligible providers. Questioned costs: Undetermined. Due to a lack of information, auditors were unable to determine if the providers were eligible or if ineligible costs were incurred. Recommendation: The Department should enhance its procedures and internal controls to ensure it maintains documentation that claims are paid only to eligible providers and that documentation is readily available for audit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-034 Prior Year Finding: 2024-035 Federal Agency: U.S. Department of Health and Human Services State Agency: Executive Office of Health and Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: XIX-MAP25, XIX-MAP24 Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility, per federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). States must monitor the accuracy of eligibility determinations by establishing a Medicaid Eligibility Quality Control (MEQC) program to reduce erroneous expenditures in conjunction with the Payment Error Rate Measurement (PERM) Program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Executive Office of Health and Human Services (Department) was unable to provide documentation verifying participant eligibility. Context: For one of sixty participants selected for testing, support for income verification was not maintained. The Department indicated that manual income verification documentation had been dropped off at a local office but was unable to provide it to auditors for testing. Cause: The Department’s procedures were not sufficient to ensure that participant eligibility documentation was maintained. Effect: Claims were paid on behalf of an ineligible participant. Questioned costs: $38, the claim amount paid for the participant. Recommendation: The Department should enhance its procedures and internal controls to ensure it maintains documentation of participant eligibility and that this documentation is readily available for audit. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-035 Prior Year Finding: 2024-036 Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Public Health (DPH) Federal Program: Opioid-STR Assistance Listing Number: 93.788 Award Number and Year: 1H79TI085778 (9/30/2021 – 9/29/2024) 5H79TI085778 (9/30/2022 – 9/29/2024) 6H79TI085778 (9/30/2023 – 9/30/2025) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a) - Requirements for Pass-Through Entities states, in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR section 200.332(e) and (g), pass-through entities must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must review financial and performance reports, ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward, issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity, resolve audit findings specifically related to the subaward, and verify that a subrecipient is audited as required by Subpart F. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Health (Department) did not properly monitor subrecipients and the Department omitted required federal award information from subawards. Context: Thirteen subawards issued to thirteen subrecipients were selected for testing. Specifically, we noted the following exceptions: • 1 of 13 subawards was missing the Federal Award Identification Number (FAIN). • For 2 of 13 subrecipients selected for testing, the Department did not adequately monitor the subrecipients. The Department did not obtain a copy of the subrecipients’ annual single audit report. Therefore, the Department did not verify that the annual single audits had been conducted, nor did it issue a management decision on audit findings. Cause: The Department had not yet fully implemented its corrective action plan from the prior year. Effect: Excluding required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program requirements and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to conduct adequate subrecipient monitoring may result in a failure of the Department to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by Department personnel on a timely basis. Questioned costs: None. Recommendation: We recommend the Department complete its corrective action plan from the prior year. The Department should verify that its internal controls and procedures are sufficient to ensure subrecipient monitoring is performed in compliance with the requirements of the federal program and that all required information is included in subaward agreements. Views of responsible officials: There is no disagreement with the finding.

Reference Number: 2025-036 Prior Year Finding: 2024-038 Federal Agency: U.S. Department of Homeland Security State Agency: Massachusetts Emergency Management Agency Federal Program: Disaster Grants – Public Assistance (Presidentially Declared Disasters), COVID-19 - Disaster Grants – Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4496-DR (2020) FEMA-4651-DR (2022) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Massachusetts Emergency Management Agency (Department) did not report subawards timely or accurately in accordance with FFATA requirements. Context: Seventeen of the twenty-six subawards selected for testing were not reported timely or accurately. The following exceptions were noted: • 11 of 26 subawards, totaling $29,413,324, were not reported timely. The reports were submitted from seven days to four months late. • 4 of 26 subawards, totaling $3,354,238, were not reported to FSRS. 2 subaward amendments related to de-obligations were not reported. The total of the amendments was a reduction of $169,193. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures and controls were not sufficient to ensure that subawards were reported timely and accurately. The Department had not completed implementation of its corrective action plan from the prior year. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should review and enhance its procedures and internal controls to ensure that all required subawards are reported timely and accurately to SAM.gov no later than the end of the month following the month of issuance of each subaward. Views of responsible officials: There is no disagreement with the finding.

Finding 2025 - 002 – Reporting (Internal Control Over Compliance) Impact Aid Applications Significant Deficiency Condition: We did not receive back up documentation to support the Children with Disabilities figures on both the Elementary and High School Impact Aid applications. Questioned Costs: None Criteria: Uniform Guidance, 2 CFR section 200.303 (Internal Controls), effective internal controls require the entity to establish and implement written policies and procedures. These policies must ensure that disbursements are supported by adequate documentation, demonstrating proper authorization, accuracy, and compliance with applicable laws and regulations. Cause: Lack of retention of documents used to support the figures that were presented in the Elementary and High School Impact Aid applications. Although the review and approval of the Impact Aid applications was noted as being performed, the lack of retention of supporting documentation relating to the applications does not support reperformance. Effect: The School District was not in compliance with Uniform Guidance, which could lead to sanctions by the funding agencies. Recommendation: We recommend the entity strengthen internal controls over the review of the impact aid application and the retention of documents used to complete the Impact Aid applications. Views of Responsible Officials: Please refer to the Corrective Action Plan for management’s views and planned corrective action.

Finding 2025 - 002 – Reporting (Internal Control Over Compliance) Impact Aid Applications Significant Deficiency Condition: We did not receive back up documentation to support the Children with Disabilities figures on both the Elementary and High School Impact Aid applications. Questioned Costs: None Criteria: Uniform Guidance, 2 CFR section 200.303 (Internal Controls), effective internal controls require the entity to establish and implement written policies and procedures. These policies must ensure that disbursements are supported by adequate documentation, demonstrating proper authorization, accuracy, and compliance with applicable laws and regulations. Cause: Lack of retention of documents used to support the figures that were presented in the Elementary and High School Impact Aid applications. Although the review and approval of the Impact Aid applications was noted as being performed, the lack of retention of supporting documentation relating to the applications does not support reperformance. Effect: The School District was not in compliance with Uniform Guidance, which could lead to sanctions by the funding agencies. Recommendation: We recommend the entity strengthen internal controls over the review of the impact aid application and the retention of documents used to complete the Impact Aid applications. Views of Responsible Officials: Please refer to the Corrective Action Plan for management’s views and planned corrective action.

Inadequate Internal Controls over Grant-Funded Equipment Maintenance and Inventory and Noncompliance with Biennial Inventory Count Requirement Name of Federal agency: U.S. Department of the Interior Name of applicable pass-through entity: State of Alaska, Department of Community and Economic Development Federal program: National Petroleum Reserve – Alaska Assistance listing number: 15.439 Federal Award Number(s): Various Federal award period: July 1, 2024 - June 30, 2025 Criteria: According to 2 CFR 200.313(d)(2), a physical inventory of the property must be taken and the results reconciled with property records at least once every two years and 2 CFR 200.313(d)(4) states that adequate maintenance procedures must be developed to keep the property in good condition. Additionally, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Condition Found: The Borough was unable to provide sufficient and appropriate evidence, including complete documentation, to demonstrate compliance with the biennial physical inventory requirement for grant funded equipment under the Equipment and Real Property Management compliance requirements. Specifically, no documentation was available to support whether a physical inventory was conducted in FY2024, and the FY2025 inventory was incomplete. Additionally, there was not a control designed to ensure equipment maintenance was performed as scheduled. Cause: While the Borough had an established general policy regarding physical inventory counts and equipment maintenance, the policy lacked sufficient detail to ensure consistent implementation. Specifically, the policy did not clearly define roles and responsibilities for conducting inventory counts, establish procedures for performing the inventory counts and the timing of such counts, or identify the individuals responsible for reviewing and approving inventory results and maintenance logs. In addition, organizational changes during FY2024, including the separation of the Administration and Finance departments, contributed to a breakdown in the continuity of inventory management functions. Staff turnover and a lack of training for new employees further contributed to the insufficient execution of required inventory management procedures. Possible Asserted Effect: Failure to establish effective internal controls over the biennial inventory count and maintenance requirements increases the risk that grant-funded equipment may be lost, misappropriated, or not properly accounted for, which could result in questioned costs, inaccurate financial reporting, and noncompliance with federal award requirements. Questioned Costs: None Repeat Finding: A similar finding was not reported in the prior year audit. Statistical Sampling: The sample was not intended to be, and was not, a statistically valid sample. Recommendation: We recommend the Borough establish internal controls to ensure biennial inventory counts for grant-funded equipment are properly conducted, documented, and formally reconciled with the property records and to ensure equipment is kept in good condition. Views of Responsible Officials: Management concurs with the finding. In response, management will continue to implement additional controls to strengthen compliance with equipment and real property management requirements, including improvements to inventory procedures, documentation practices, and oversight. The Department of Finance will work in coordination with the Department of Administration to provide training to all relevant departments on federal guidelines and compliance requirements related to assets purchased with federal grant funds. Management will continue to monitor these controls and take further corrective action, as necessary, to ensure ongoing compliance with applicable federal requirements.

Ref. No. Finding / Noncompliance Questioned Costs 2025-001 Deficiencies in Personnel File Documentation -0- State and Federal Funds: Federal Agencies: U.S. Department of Homeland Security U.S. Department of Transportation U.S. Department of Treasury U.S. Housing and Human Development Pass-through Agency: N/A Federal Program Title: All Federal Programs ALN Number: N/A Compliance Requirement: Documentation Type of Finding: Material Noncompliance Reporting and Material Weakness Responsible Official: Finance Director Condition: During the audit of personnel records funded by State and Federal grants, it was identified that significant portion of the sampled employee files were incomplete. Specifically, essential documentation-such as Medical History, Birth Certificate, Withholding Exemption Certificate, Oath and Possession, Drug Free Orientation and other required Governmental Certifications were missing from the physical and digital archives. Criteria: Under the Uniform Guidance (2 CFR § 200.303), the Department of Transportation and Public Works (DTOP) is required to establish and maintain effective internal controls over federal awards to provide reasonable assurance that the entity is managing the awards in compliance with federal statutes and regulations. Cause: This deficiency stems from the mass transfer of personnel under the "Ley de Movilidad" (Mobility Law). These employees were transferred with the internal control standards of their original agency (PREPA), which do not align with the documentation requirements of the central government for federally funded programs. Despite being reported in prior year audits, management has failed to standardize these records or implement an effective corrective action plan to integrate these files into DTOP’s internal control system.Effect (or Risk): The lack of standardized documentation prevents the agency from certifying that all employees paid with federal funds meet eligibility and compliance requirements. This recurrent deficiency exposes the Department to: • Questioned Costs: Potential disallowance of payroll expenditures and requirements to refund federal agencies. • Administrative Sanctions: Increased oversight or penalties from federal awarding agencies due to the failure to resolve prior audit findings. • Audit Risk Status: Risk of losing "low-risk auditee" status, leading to more extensive and frequent audits. Recommendation: We recommend that management: 1. Establish a special task force within the Human Resources Department to conduct a 100% internal audit of files for all personnel transferred from PREPA. 2. Set a formal deadline for these employees to complete and submit all required documentation under DTOP’s internal control policies. 3. Formalize a Corrective Action Plan (CAP) that includes specific milestones to ensure this prior year finding is fully resolved within the current fiscal year.

Program: Education Stabilization Fund Federal Assistance Listing Number: 84.425U, 84.425W Federal Agency: U.S. Department of Education Pass-Through Agency: Cochise County, Arizona Grantor Number: Not applicable Questioned Costs: $-0- Type of Finding: Noncompliance (Other Matter), significant deficiency in internal control Compliance Requirement: N. Special Tests and Provisions – Wage Requirements Condition/Context: During our testing of the one contractor funded under the Education Stabilization Fund program, we noted that the District did not obtain or review certified payroll reports from contractors to verify compliance with federal prevailing wage requirements. As a result, the District could not demonstrate that contractors complied with required wage provisions for the sampled projects. Criteria or Specific Requirement: Federal regulations require that contractors and subcontractors performing work on federally funded construction projects pay laborers and mechanics wages at rates not less than those prevailing on similar projects in the locality. These requirements are established under the Davis-Bacon Act and incorporated into federal grant compliance requirements under 2 CFR Part 200. Adequate monitoring of compliance with these wage requirements is required to ensure that workers are being paid correctly per 29 CFR 5.5 compliance provisions. Per 2 CFR section 200.303(a), a non-Federal entity must establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Cause: The district did not have established procedures to ensure that certified payroll documentation was obtained and reviewed for federally funded construction projects. District personnel were not aware that federal wage requirements applied to the project. Effect: Failure to ensure compliance with federal prevailing wage requirements may result in laborers and mechanics being paid less than required wage rates. This noncompliance could result in questioned costs, repayment of federal funds, or other sanctions by the awarding agency. Repeat Finding: No. Recommendation: We recommend the District implement policies and procedures to ensure effective monitoring of compliance with Federal wage rate requirements. This includes obtaining required wage determinations prior to project commencement, including wage requirements in contract documents, and collecting certified payroll reports from contractors. Views of Responsible Officials: The District concurs with this recommendation and will review its procedures over monitoring of wage rate requirements under the Davis Bacon Act.