Criteria: According to Uniform Guidance 2 CFR 200.303, the non-federal entity must establish and maintain effective internal controls over compliance for federal awards to provide reasonable assurance of compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Town was required to submit an annual project and expenditure report for the period of April 1, 2024 to March 31, 2025 by April 30, 2025. Condition: The amount of actual expenditures for the period 4/1/2024 - 3/31/2025, was $2,512,252; however, when completing the Project & Expenditure Report for the period ended March 31, 2025, the Town only reported actual expenditures of $1,771,014. Also the cumulative amount of expenditures that should have been reported was $3,396,464; however the Town only reported $2,655,227. In both cases the difference is $741,238. Cause: The reason for the $741,238 is due to the Town not reporting expenditures for the period of 1/1/2025 - 3/31/2025. In other words, the Town only reported expenditures covering 9 months of the reporting period. The Town’s internal controls over compliance were not sufficient to identify that the Project and Expenditure Report was omitting expenditures for the period of 1/1/2025 through 3/31/2025. Effect: Incorrect reporting can effect the administration of the program by the grantor. Questioned Costs: None. Recommendation: We recommend that the Town enhance their internal controls over the requirements of this program to ensure those preparing and reviewing the reports have the appropriate understanding and information needed to ensure completeness and accuracy of information being reported.
Type of Finding: Significant Deficiency in Compliance and Internal Control over Compliance Federal Agency: Department of Veterans Affairs Federal Program Name: Veterans Affairs Supportive Services for Veteran Families Program Assistance Listing Number: 64.033 Federal Award Identification Number and Year: 20-WA-146-25; 20-WA-146-LT Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: 20-WA-146-25: October 1, 2023 – September 30, 2026; 20-WA-146-LT: August 19, 2022 – September 30, 2026 Criteria or specific requirement: 2 CFR 200.303 requires recipients of federal funds to "establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statues, regulations, and terms and conditions of the Federal award." Condition: During testing of cash management and indirect costs, all 5 samples of reimbursement request invoices tested from the King County Division lacked evidence of approval by the Finance Director. The 3 additional samples tested from another Division had evidence of review on the invoices. Questioned costs: None. Context: Each Division implements different procedures and controls related to compliance. For the King County Division, the Finance Director was tasked with reviewing the monthly reimbursement request and the corresponding indirect cost calculations via her review of monthly financials. However, that review was not documented during the year therefore there was not any key control in place. The Director of Federal Compliance was the only one who prepares and request the drawdowns without any oversight; however, this did not result in noncompliance. Cause: There are different processes implemented across the various Divisions, which results in inconsistent application of compliance requirements and controls. Effect: Increased possibility of requesting reimbursement for costs that are unallowable to the program, and for misapplying the indirect cost rate due to human error. Repeat Finding: 2024-003 Recommendation: CLA recommends applying a consistent review process of reimbursement requests across all programs and Divisions, to the extent possible, to reduce the likelihood of missed application of controls in regard to cash management and indirect cost application. Views of responsible officials: There is no disagreement with the audit finding.
Finding 2025-079 Federal Program Name Child Care Development Fund (CCDF) Cluster (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services (HHS) State Agency Department of Public Health and Human Services (department) ALN # 93.575 and 93.596 Grant # 2101MTCDC6, 2101MTCSC6, 2301MTCCDD, 2401MTCCDD, 2501MTCCDD Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a)(1) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity. The report must be submitted no later than the end of the month following the month in which the obligation is made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2024 and 2025, the department's internal controls were insufficient to ensure all CCDF obligations of $30,000 or more were accurately and completely reported to the FFATA reporting system. As a result, required CCDF obligations were not reported, and some obligation amounts were over-reported. Context: We reviewed all obligations reported during the audit period against obligations made through subaward agreements and amendments to subrecipients. The department awarded approximately $11.4 million in CCDF obligations under 2 federal awards to 10 subrecipients. Based on our audit work, 15 FFATA reports should have been filed; instead, 704 were filed across five federal awards. Of the 704 reports filed, only one matched a current audit period obligation; this report contained mismatched subaward and federal award numbers. The department did not file 14 expected FFATA reports totaling $10,227,466. As the department indicated it was working during the audit period to correct prior-year errors, we also compared current-year reports to the prior-audit recommendation support. We identified six FFATA reports matching prior-year errors. All six had amounts underreported by $216,180. Additionally, while prior-year testing expected FFATA reports be filed with amounts split across two Federal Award Identification Number (FAIN), the reports were only filed for one FAIN. This is evidence the department has not properly addressed the prior audit finding. The number of instances and corresponding dollar amounts for the reporting errors discussed are summarized in the following table. Number Dollar Amount Transactions Tested 704 $182,929,549* Subawards Not Reported 14 $ 10,227,466 Report Not Timely Unable to test Subaward Amount Incorrect 6 $ 216,180 Subaward Missing Key Elements Not Tested Reported, Duplicate Transaction 436 $124,474,269 Reported, Transaction Under $30,000 Threshold None Identified * We were not able to agree all transactions to support for subawards issued or amended, thus are unable to fully quantify the subaward amount inaccurately reported above. We did not test timeliness of the reports submitted and matched to current-year or prior-year subawards due to the column in Sam.gov data changing upon transaction modification. While the department initially identified 10 entities with award documents for the audit period, subsequent work determined there were actually six subrecipients in fiscal year 2024, of which only two continued as subrecipients in fiscal year 2025. As a result, four of the originally identified entities were not subject to FFATA reporting requirements. Our analysis was conducted using FFATA reporting system data as of July 2025. We considered each transaction submitted, or omitted, by the department and compared information against executed subaward agreements from the audit period, as provided by the department. Any corrections the department made during fiscal year 2026 were not considered in our testing for this audit but will be considered during the fiscal year 2026 audit. We did not provide our detailed analysis to the department. However, we believe the department has all necessary information in its possession, such as the FFATA reporting system data and its issued and amended subawards, to ensure necessary corrections are made to the FFATA reporting system. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023, included finding 2023-068, which required the department to enhance internal controls over FFATA reporting and submit reports for the CCDF program as required by federal regulations. Effect: The department is not in compliance with FFATA reporting requirements. Insufficient internal controls resulted in missing and inaccurate subaward reporting. FFATA reporting provides transparency to federal grantor agencies and the public. The errors identified could mislead users of the reported data. Cause: The department uses a central contracting system to capture obligations, which includes both subrecipient and contractor relationships. The system is used to process payments and identify which obligations require FFATA reporting. However, the CCDF program uses a separate contracting system that was not considered for FFATA reporting. As a result, the central system did not identify subrecipient relationships or contain accurate and complete CCDF contract information needed to file required FFATA reports. Department personnel responsible for FFATA reporting indicated they are working with federal program staff to implement process changes to ensure FFATA reports are captured accurately and timely for subrecipients only. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure accurate and complete submission of FFATA reports for the Child Care Development Fund program. B. Submit FFATA reports for the Child Care Development Fund program in accordance with federal regulations. Views of Responsible Officials: The department partially concurs with the recommendation. The department agrees that internal control deficiencies existed in its FFATA subaward reporting processes during FY24-FY25 and that instances of noncompliance existed. The department disagrees with the quantified extent of exceptions because they have been unable to replicate the numbers and dollars presented in the finding context and they believe the auditor has not provided sufficient detail to address the identified errors. The department also points to ongoing processes to identify and correct duplicate and inaccurate records. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. While the department agrees with the need to improve internal controls and errors in FFATA reporting, management disagrees with the auditor’s quantification of the errors. We believe management has sufficient detail to address the finding because it has access to its subaward agreements as well as the information currently available in the federal FFATA reporting system. As such, our recommendation stands.
Finding 2025-002 Federal Program Name Child Nutrition Cluster (COVID-19) Federal Awarding Agency U.S. Department of Agriculture State Agency Office of Public Instruction (office) ALN # 10.553, 10.555, 10.556, 10.559, and 10.582 Grant # Not applicable to commodities portion of the cluster Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 7 CFR 250.12(b), requires the office to conduct a physical inventory at all storage facilities used by the office for commodities on an annual basis. The inventory must reconcile the physical and book inventories of the donated foods. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office’s controls were ineffective in documenting and resolving commodity inventory differences. The office tracks commodity inventory in the Montana Application and Payment System (MAPS). Commodity inventory is stored at a state warehouse that uses a separate inventory system. Each year, the office performs a physical count of commodity inventory. In both FY2024 and FY2025, differences existed among MAPS, the warehouse inventory system, and the physical count. These differences were not documented during the inventory process, resulting in noncompliance. Context: As shown in the table below, differences were identified among MAPS, the warehouse inventory system, and the physical count. While no items were actually missing, the physical count did not note or explain the reasons for the differences. Effect: Inadequate controls resulted in noncompliance with federal regulations. Weak controls over food inventories also increase the risk of theft and further noncompliance with federal requirements. Cause: In FY2024, the physical inventory was taken on June 3rd. The beef arrived at the warehouse on June 12th. The documentation we were provided in our testing has a date of June 30th. The office did not retain inventory reports as of the date a physical inventory was taken to support there were no differences at the time of the physical count. The office was unable to determine the cause for the differences in FY2025 and did not retain the inventory reports for this year either. Recommendation: We recommend the Office of Public Instruction: A. Enhance controls to retain the book inventory records, warehouse inventory records, and physical counts of commodities and to ensure they agree or differences are resolved. B. Reconcile the book inventory, warehouse inventory, and physical count of all commodities on hand at the time of each count. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-003 Federal Program Name Child Nutrition Cluster (COVID 19) Federal Awarding Agency U.S. Department of Agriculture State Agency Office of Public Instruction (office) ALN # 10.553, 10.555, 10.556, 10.559, and 10.582 Grant # 213MT306N1199, 223MT306N1099, 223MT306N1199, 233MT306N1199, 243MT306N1199, 253MT306N1199 Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 170, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-Federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During FY2024 and FY2025, the office did not accurately submit required FFATA reports for subrecipients of the Child Nutrition Cluster, as required by federal regulations. Internal controls were not sufficient to ensure accurate reporting. Context: Child Nutrition payments to Local Educational Agencies (LEAs), which are mainly schools or school districts, are based on meals served monthly, not predetermined allocations, unlike other federal programs at this office. Prior single audit finding 2023-001 reported that most of FY2022 and all of FY2023 were not reported as required by the FFATA. The following page summarizes reporting activity for ALN 10.555 grants for 2021–2025. Late reporting for grants 2021, 2022, and 2023 was addressed in the prior single audit. Those years are noted below for transparency in understanding what was reported for those fiscal years and are not included in the error table, as they were already reported in tabular form in the prior audit. • 2021 grant – $115M was reported on 3/25/24. • 2022 grant – $87M was reported between 3/19/24 and 2/11/25. We estimate, in total, under-reported subawards in FY24 and FY25 is $16,676,256. For ALN 10.582, the prior audit found that no reports were submitted for school obligations exceeding $30,000. The 2022 and 2023 grants were entirely reported during the current audit period to address the prior recommendation. However, no reporting was found for the 2024 or 2025 grants, despite schools with grant obligations exceeding $30,000 during the audit period. See the chart below for a summary. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2023-001 from the audit for the two fiscal years ended June 30, 2023. Effect: The office is not in compliance with FFATA reporting requirements. This limits the federal grantor agency's ability to transparently report program activity. The inaccurate reports also overstate amounts distributed to schools, which is misleading to the public. Cause: This finding repeats a prior audit recommendation. Because the recommendation was communicated partway through the current audit period, the office could not correct errors for the entire period. During the current audit period, there were prior period adjustments made after the final report was submitted, which resulted in the office data we compared not matching the federal reporting. Additionally, for ALN 10.582, the federal reporting system did not recognize the Federal Award Identification Number, so the office was unable to report that grant. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls to ensure accurate and timely submission of FFATA reports. B. Submit FFATA reports in accordance with federal regulations. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1. • 2023 grant – $46M was reported between 3/19/24 and 2/12/25. • 2024 and 2025 grants – Auditors tested the five highest dollar subgrants (non-statistical) in FY24 and FY25. Results are in the table below.
Finding 2025-011 Federal Program Name Housing Voucher Cluster Federal Awarding Agency U.S. Department of Housing and Urban Development (HUD) State Agency Department of Commerce (department) ALN # 14.871 and 14.879 Grant # Various Compliance Requirement E. Eligibility N. Special Tests and Provisions Type of Finding Significant Deficiency (E) Material Weakness and Material Noncompliance (N) Questioned Costs No questioned costs identified Criteria: Federal regulation, 24 CFR 982.204, requires that except for special admissions, participants must be selected from the Public Housing Authority (PHA) waiting list. The PHA must select participants from the waiting list in accordance with admission policies in the PHA administrative plan. This means that families seeking assistance apply to the program and are placed on the waiting list until a spot becomes available. The PHA’s method for selecting families from the waiting list determines the order in which they receive assistance. The Department of Commerce is the PHA. The Department of Commerce administrative plan (Chapter 4 III.C. Selection Method) indicates that eligible applicants will be placed on the waiting list and selected from the waiting list first by waiting list preference, then by the waiting list date and time their complete application was received. Preferences are given to those transitioning out of institutional settings, at risk of institutionalization, and at serious risk of homelessness. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked sufficient internal controls over wait list selection to ensure applicants were chosen in the order required by federal regulations and the department's administrative manual. During the audit period, the department identified multiple individuals who were not selected in the correct order. Context: When there is an opening in the program, the field agent will notify the department that they need applicants selected from the waiting list. Department staff then select applicants and notify the field agent to begin the intake process. In state fiscal year 2024, the department reviewed 2,092 mail-in applications with an eligible status and found 29 that were pulled out of order. In fiscal year 2025, the department reviewed 1,469 applicants and identified three errors. Repeat Finding: This is a repeat finding and was reported as Single Auditing finding #2023-007 in the audit for the two fiscal years ended June 30, 2023. Effect: The department did not comply with federal regulations and its administrative plan. The potential exists that families at the top of the wait list may experience delays in receiving housing assistance. Cause: Management indicated that due to the department’s accelerated voucher issuance pace, online applicants were pulled ahead of some earlier paper applicants. The department identified this as a training issue. Errors also resulted from combining the wait lists for two separate programs, the voucher program and the Mod Rehab housing program. The department has since created a separate wait list for the Mod Rehab program. Recommendation: We recommend the Department of Commerce: A. Continue to improve internal controls over wait list selection to ensure applicants are chosen in the correct order. B. Select applicants from the wait list in accordance with the administrative plan and federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action, see the Corrective Action Plan starting on page D-1.
Finding 2025-012 Federal Program Name Housing Voucher Cluster Federal Awarding Agency U.S. Department of Housing and Urban Development (HUD) State Agency Department of Commerce (department) ALN # 14.871 and 14.879 Grant # Various Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal guidance, OMB No. 2577-0282, requires the Public Housing Authority (PHA) to submit a report monthly through the Voucher Management System (VMS). This report includes information such as the unit months leased and the monthly housing assistance payments. The Department of Commerce is the PHA. Federal regulation, 24 CFR 115.308, requires that the agency provide the Office of Fair Housing and Equal Opportunity (FHEO) regional director reports identified in the cooperative agreement. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s internal controls in fiscal year 2024 were not adequate to ensure that monthly reports submitted through the VMS were complete and accurate. Additionally, we found multiple reports submitted in fiscal year 2024 that were not accurate. Context: During our review of the department’s monthly reports submitted through the VMS for fiscal year 2024, we identified errors in five out of twelve reports. The department confirmed that these errors did not impact the total expenses reported or the funding calculation used by HUD. The department implemented a control in fiscal year 2025 to ensure accuracy of the reports, in response to a prior audit recommendation. We did not test the control in fiscal year 2025, but our limited testing of the fiscal year 2025 reports did not identify any errors. Repeat Finding: This is a repeat finding and was reported as Single Auditing finding #2023-004 in the audit for the two fiscal years ended June 30, 2023. Effect: The department was not fully compliant with federal reporting requirements. Without adequate internal controls, there is an increased risk of reporting errors which undermine the integrity of the reporting process. Additionally, while the nature of the errors we identified didn’t impact program funding decisions, certain errors in this report could affect program funding calculations. Cause: In fiscal year 2024, the department lacked sufficient staffing to segregate duties between the preparer and reviewer of the VMS report. Subsequently, the department hired an additional accountant and implemented a new control in fiscal year 2025 to improve report accuracy. Recommendation: We recommend the Department of Commerce: A. Strengthen internal controls over the preparation and review of monthly Voucher Management System reports to ensure their completeness and accuracy. B. Comply with federal reporting requirements regarding the Voucher Management System reports. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action, see the Corrective Action Plan starting on page D-1.
Finding 2025-013 Federal Program Name Housing Voucher Cluster Federal Awarding Agency U.S. Department of Housing and Urban Development (HUD) State Agency Department of Commerce (department) ALN # 14.871 and 14.879 Grant # Various Compliance Requirement L. Reporting N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s internal controls were not appropriately designed to ensure that the Financial Assessment Subsystem (FASS) reports submitted to HUD were complete and accurate. Context: FASS reports are submitted annually. While our testing of the FASS reports submitted in fiscal years 2024 and 2025 did not identify any errors, the department’s main control over these reports is a review performed by someone other than the individual who prepared the report. This review process was not documented during the audit period, and the department cannot demonstrate that the control occurred. Effect: Without adequate internal controls, there is an increased risk that FASS reports may contain errors or be incomplete. Cause: Personnel indicated that the reporting system does not record the reviewer’s identity, and the department does not maintain any other evidence of review. Recommendation: We recommend that the Department of Commerce establish and implement controls to ensure that Financial Assessment Subsystem reports are complete and accurate prior to submission and that reviews of the reports are sufficiently documented. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action, see the Corrective Action Plan starting on page D-1.
Finding 2025-014 Federal Program Name Housing Voucher Cluster Federal Awarding Agency U.S. Department of Housing and Urban Development (HUD) State Agency Department of Commerce (department) ALN # 14.871 and 14.879 Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked sufficient internal controls to ensure that all leased units were inspected in accordance with federal regulations. Context: Federal regulations require that all leased units undergo inspections to verify compliance with Housing Quality Standards (HQS). The department contracts with field agents, including housing authorities and nonprofit organizations, to conduct these inspections. Despite delegating the inspection process, the department retains ultimate responsibility for ensuring that all units are inspected as required. In the prior audit, it was noted that the department lacked appropriate internal controls to monitor the completion of HQS inspections. In February 2025, the department implemented a new control to review a federal system report listing all required inspections and identifying overdue inspections. However, prior to this implementation, controls were insufficient. Our review of overdue inspection reports revealed seven units in fiscal year 2024 and one unit in fiscal year 2025 that were not inspected within the required timeframe. Based on the limited number of untimely inspections, we do not consider there to be material non-compliance with the federal regulations requiring timely inspections. Additionally, management indicated that the program received full points for compliance with the federal timely inspection requirement in its Section 8 Management Assessment Program reviews for fiscal years 2024 and 2025. Repeat Finding: This is a repeat finding and was reported as Single Auditing finding #2023-005 in the audit for the two fiscal years ended June 30, 2023. Effect: The absence of adequate controls increases the risk of untimely inspections as well as the risk for leased units not meeting established housing quality standards. Cause: Staff turnover contributed to a lapse in internal controls. Recommendation: We recommend the Department of Commerce develop and maintain internal controls to ensure that all required HQS inspections are completed within the time frame required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action, see the Corrective Action Plan starting on page D-1.
Finding 2025-015 Federal Program Name Housing Voucher Cluster Federal Awarding Agency U.S. Department of Housing and Urban Development (HUD) State Agency Department of Commerce (department) ALN # 14.871 and 14.879 Grant # Various Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked adequate internal controls to ensure payments to field agents did not exceed the amounts specified in their contracts. Context: The department contracts with field agents to perform tasks including ensuring that unit inspections are completed as required by HUD. The department tracks these contracts on a spreadsheet to monitor payments against contract amounts. During fiscal years 2024 and 2025, several field agents received payments that exceeded their contract amounts. Although the contracts allow for modifications, the department did not amend them to increase the allowable fee amounts until we brought the issue to their attention. Effect: Without adequate controls, the department may pay field agents more than the contract amount allows. Cause: The overpayments occurred around the same time the contracts were up for renewal. Rather than amending the existing contracts to address the overages, the department chose to incorporate the adjustments into the upcoming contract renewals. Recommendation: We recommend the Department of Commerce strengthen internal controls to ensure field agent contracts are amended as needed for the Housing Voucher Cluster. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action, see the Corrective Action Plan starting on page D-1.
Finding 2025-016 Federal Awarding Agency U.S. Department of Housing and Urban Development (HUD) State Agency Department of Commerce (department) Federal Program Name Housing Voucher Cluster ALN # 14.871 and 14.879 Grant # Various Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles E. Eligibility L. Reporting N. Special Tests and Provisions Type of Finding Material Weakness Questioned Costs No questioned costs identified Criteria: Montana Operations Manual, Information Security Controls Standard, outlines baseline security controls for every state agency to implement for information technology systems they manage. Included among the baseline controls are requirements for the development and documentation of a security plan; documentation of access control policies and procedures, including periodic review of user access; and documentation of a formal change management system so that IT best practices are followed and controls over computer systems are sufficient. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department uses the Housing Assistance Payment Plan Yearly (HAPPY) system to administer the Housing Voucher Cluster program. The department's internal controls over the HAPPY system are insufficient to ensure compliance with state information security policy. Context: The department uses the HAPPY system to gather applicant data, maintain the waiting list, determine program eligibility, monitor if inspections are occurring, house inspection data, and calculate monthly housing assistance payments. The department partially implemented a prior audit recommendation related to HAPPY system controls. The following issues indicate controls still need improvement. • Access Reviews - The department did not perform a formal, documented annual review of user roles and privileges, as required by state policy. o The department could not provide descriptions for the privileges within the system, and without them, they cannot determine segregation of duties. o Approximately 185 inactive users retained system privileges, which they should not have. o The department could not provide documentation showing it restricted field agent access as recommended in prior Single Audit Recommendation #23-007. • Written Policies - The department's access control policy lacks key elements. o Because the HAPPY system allows each user a customized role, a clearly defined written policy is essential for consistent and appropriate access management. A written access policy also leads to consistent access management and appropriate access. • Staff Cross-Training - The department has no training or cross-training on access policies or procedures for granting and removing system access. o Training ensures access is managed consistently and that multiple staff can perform the task when needed. • Password Requirements - Password requirements did not meet state standards for change frequency, length, or complexity during the audit period. After the audit period, state password requirements changed and the department is now in compliance. Repeat Finding: A portion of the finding is a repeat finding and was reported as Single Auditing finding #2023-006 in the audit for the two fiscal years ended June 30, 2023. Effect: Without adequate controls meeting state standards, the department risks inappropriate system access, unintended changes to system functionality, or erroneous data that could affect program operations. Cause: Department personnel cited several reasons these issues remain unresolved: functional limitations in the system, the vendor providing only high-level responses to their questions, and limited advance notice of IT changes and updates to standards as these require time to implement. Recommendation: We recommend the Department of Commerce continue to improve controls over the HAPPY system by: A. Performing regular user access reviews, including documenting and gaining a full understanding of user privileges. B. Updating the access control policy to meet state standards. C. Training staff on access policies and procedures for granting and removing system access. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action, see the Corrective Action Plan starting on page D-1.
Finding 2025-017 Federal Program Name Housing Voucher Cluster Federal Awarding Agency U.S. Department of Housing and Urban Development (HUD) State Agency Department of Commerce (department) ALN # 14.871 and 14.879 Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 24 CFR 985.3(e)(1), requires a Public Housing Agency (PHA) supervisor or other qualified person to complete quality control inspections of a sample of units under contract during the PHA fiscal year, which meets the minimum sample size requirements specified at 24 CFR 985.2 under the PHA's quality control sample, for quality control of HQS inspections. Federal regulation, 24 CFR 985.2, includes the number of quality control inspections the department is required to complete each year based on the universe size. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked adequate internal controls to ensure the required number of quality control inspections were completed. In fiscal year 2024, the department completed only 21 of the 37 required quality control inspections, and therefore it did not comply with federal requirements. Context: Federal regulations require the department to complete supervisory reviews in several areas, including quality control inspections. The department tracks required inspections using a spreadsheet. However, this system proved ineffective in fiscal year 2024. In fiscal year 2025, the department completed more inspections than required. Effect: The department was not in compliance with federal regulations. Without completing all required quality control inspections, the department may fail to identify deficiencies in work performed by contract field agents that is intended to help ensure housing quality standards are met. Cause: Management cited significant staff turnover and extended hiring, onboarding, and training timelines as the primary reasons inspections were not completed in fiscal year 2024. Management also indicated staff had limited access to training on the housing quality inspection protocols as HUD had transitioned training offering to the new NSPIRE inspection protocol. Recommendation: We recommend the Department of Commerce: A. Strengthen internal controls to ensure all required quality control inspections are completed each fiscal year. B. Comply with federal regulations by meeting the minimum number of required quality control inspections annually. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action, see the Corrective Action Plan starting on page D-1.
Finding 2025-018 Federal Program Name Housing Voucher Cluster Federal Awarding Agency U.S. Department of Housing and Urban Development (HUD) State Agency Department of Commerce (department) ALN # 14.871 and 14.879 Grant # Various Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked sufficient internal controls to ensure Housing Assistance Payments (HAP) were made on a timely basis. Context: The department makes approximately 4,000 monthly HAP payments and reconciles its system against the state’s accounting system to verify that payments are processed correctly. In our randomly selected nonstatistical sample, in 6 of the 48 reconciliations completed for the audit period, we identified three reconciliations that were not completed. Each contained payment errors that went unaddressed, leading to three late HAP payments. After we communicated this issue, the department reviewed all reconciliations for the audit period and identified additional unaddressed payment errors. However, the total number of errors was less than 1 percent of all payments made during the audit period. Effect: Because the department did not complete its reconciliation controls, some HAP payments were not made on time. Without this control, additional late payments could have occurred. Cause: There was staff turnover in the position responsible for monitoring reconciliations. Recommendation: We recommend the Department of Commerce strengthen internal controls to ensure that reconciliations are completed to ensure that HAP payments are made on time. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action, see the Corrective Action Plan starting on page D-1.
Finding 2025-098 Federal Program Name Medicaid Cluster (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services (HHS) State Agency Department of Public Health and Human Services (department) ALN # 93.775, 93.777, and 93.778 Grant # 2005MT5ADM, 2105MT5ADM, 2305MT5ADM, 2305MT5MAP Compliance Requirement L. Reporting Type of Finding Other Matter Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a)(1) and (a)(2)(ii), requires non-federal entities to report each subaward obligation of $30,000 or more to the Federal Funding Accountability and Transparency Act (FFATA) reporting system no later than the end of the month following the month the obligation is made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2024 and 2025, the department's internal controls were not sufficient to ensure that only required subrecipient actions for Medicaid of $30,000 or more were accurately, completely, and timely reported to the FFATA reporting system. Montana has no Medicaid subrecipients; however, the department submitted significant FFATA reports for the program. Context: For all major federal programs for which FFATA was applicable for testing, we reviewed all obligations reported during the audit period and compared them with subaward agreements and amendments provided by the department. Montana has no Medicaid subrecipients or subrecipient agreements. Therefore, the department should not have filed any FFATA reports for Medicaid; however, it filed 291 reports. The number of instances and corresponding dollar amounts are summarized below. Our analysis was conducted using FFATA reporting system data as of July 2025. We considered each transaction submitted, or omitted, by the department and compared information against executed subaward agreements from the audit period, as provided by the department. Any corrections the department made during fiscal year 2026 were not considered in our testing for this audit but will be considered during the fiscal year 2026 audit. Effect: FFATA reporting provides transparency to federal grantor agencies and the public. Because Montana has no Medicaid subrecipients, the 291 erroneously filed reports could mislead users of FFATA data. Cause: The department uses a central contracting system to capture obligations, which include both subrecipient and contractor relationships. The system is used to process payments and identify which agreements require FFATA reporting. However, information entered into the system did not distinguish between contractor and subrecipient relationships, was not consistently accurate and was not always entered at the time of obligation. Department personnel responsible for FFATA reporting indicated they are working with federal program staff to implement process changes to ensure FFATA reports are filed only for subrecipients and are accurate and timely. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls over FFATA reporting to ensure only required FFATA reports for the Medicaid Cluster are submitted. B. Only report required FFATA information for the Medicaid Cluster. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-107 Federal Program Name Research and Development Cluster (R&D) (COVID-19) Federal Awarding Agency Various State Agency University of Montana - Missoula (university) ALN # Various Grant # Various Compliance Requirement F. Equipment and Real Property Management Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.313 (b) states that, “A State must use, manage and dispose of equipment acquired under a Federal award in accordance with State laws and procedures.” However, 2 CFR 200.313(d) adds additional specific requirements where equipment is acquired utilizing a federal award. Federal regulation, 2 CFR 200.313(d)(2) states, “A physical inventory of the property must be conducted, and the results must be reconciled with the property records at least once every two years.” MOM policy 335 (V)(A)(3) requires all major equipment to be identified in the manner that promotes easy identification and requires property tags to be placed on plain sight on the equipment. While state policy does allow some discretion based on the physical nature of some equipment for situations where property tags may not be feasible, it does require that “whenever possible, the tag number will still be identified on the item by some means such as etching, decal, indelible ink, etc.” Federal regulation, 2 CFR 200.303 requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The university’s internal controls were insufficient to ensure a complete physical inventory was performed during the biennium or that equipment purchased with federal funds was properly tagged, as required by federal regulations and state policy. Context: During the audit period, 434 of 1,147 grant assets were not inventoried. The university tracked inventory completion by university department using a checklist; however, 47 university departments were omitted from the tracking spreadsheet. As a result of those omissions, 676 grant assets were not tracked through the university’s tracking spreadsheet. These assets would be at risk of not being inventoried as a result. In the prior audit, inventory had not been completed for 109 university departments. We performed testing on a random nonstatistical sample of 11 capital assets, drawn from 159 capital assets purchased above the $10,000 capitalization threshold with grant funds during the audit period, we found that 1 asset (a drone) was not affixed with a property tag as required by state policy. University staff affixed a tag to the drone after it was observed during audit fieldwork. In the prior audit, 4 of 8 sampled items lacked tags. Repeat Finding: This issue was first reported in the 2020–2021 Single Audit (2021-034). The prior audit (2023-077) also noted untagged equipment and an incomplete physical inventory. We noted improvements from the prior periods during this audit as in the prior audit 109 university departments did not have an inventory completed for them compared to 46 university departments with no inventory completed this period. Additionally, we noted 50% of the assets reviewed in the prior audit had no asset tag affixed, compared to 9% this audit period. Effect: The university is noncompliant with federal requirements to use and manage equipment under a federal award in accordance with state laws and procedures. Incomplete inventories and untagged assets leave equipment susceptible to misuse or theft. Cause: University staff attributed the issue to employee turnover, which disrupted the complete transition of inventory tracking information. Near the end of fiscal year 2024, the university hired a dedicated capital asset accountant but was unable to completely address the backlog of uninventoried items before the audit period was over, though substantial progress was made. Recommendation: We recommend the University of Montana - Missoula: A. Continue to use enhanced internal controls to ensure compliance with federal and state requirements governing equipment for the Research and Development Program; B. Perform a complete physical inventory of capital assets at least every two years; and C. Tag all capital assets when feasible. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-108 Federal Program Name Research & Development Cluster (R&D) (COVID-19) Federal Awarding Agency Various State Agency University of Montana - Missoula (university) ALN # Various Grant # Various Compliance Requirement A. Activities Allowed B. Allowable Costs/Cost Principles H. Period of Performance Type of Finding Material Weakness Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The university did not perform its controls over reviewing ledgers for charges made to funds to ensure they were for authorized activities and costs were allowable. Context: The university managed over 1,300 federal R&D awards during the audit period. These awards are managed by the university’s Office of Sponsored Programs (OSP), which is managed day-to-day by Principal Investigator’s (PI’s) who are usually faculty at the university. The university manages R&D grant awards in three stages: Pre-Award: A PI identifies a funding opportunity and works with OSP to document proposed funding details, including salaries, budget, and subawards. Award Management: OSP staff record award information and conduct regular financial reviews to assess whether expenses are allowed as charged to the project. While PI’s oversee the award’s progression and certify staff time charged to the grant. Post-Award: When an award ends, OSP staff use a checklist to complete close-out procedures, including reconciling expenses and performing final billing. As part of its award management phase, OSP fiscal specialists are required to review the full expense ledger for each grant at least quarterly (monthly for most awards). Our random nonstatistical sample was drawn from grant expenses charged to active awards during the audit period, covering the Pre-Award and Award Management stages. We performed testing on a random nonstatistical sample of 40 grant transactions from a population of 222,024, we found 14 instances where a quarterly review was not completed in a timely manner or was not documented at all. The grants that were missing timely reviews ranged from awards of $87,762 to $8,153,914. For example, one grant for the quarter ending December 2023 had no documented review until February 2025. Another grant had no ledger reviews from September 2023 through October 2024. These gaps create risk that unallowable or out-of-scope charges go undetected. Testing did not identify any unallowed activities or unallowable costs charged to these grants. Given the number of grants affected and the extended timeframe, this is considered a material weakness in internal control. Repeat Finding: This is a repeat finding. Finding 2023-078 from the previous single audit noted four quarterly grant expense reviews were not performed. Effect: The university is not in compliance with the federal requirement to maintain effective internal controls over federal awards. Without these controls, the university is at risk of additional noncompliance, such as charging unallowable costs to grants. Cause: The university experienced staffing turnover and performance issues, causing some employees to be unaware of which grants they were responsible for reviewing. At one point, OSP only had 5 of 12 positions filled, leading to missed reviews. Recommendation: We recommend the University of Montana – Missoula, follow established internal controls to provide reasonable assurance that federal Research and Development Program awards are managed in compliance with all applicable federal statutes and regulations. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-109 Federal Program Name Research and Development Cluster (R&D) Federal Awarding Agency Various State Agency University of Montana - Missoula (university) ALN # Various Grant # Various Compliance Requirement A. Activities Allowed/Unallowed B. Allowable Costs/Cost Principles H. Period of Performance N. Special Tests and Provisions Type of Finding Material Weakness (A, B, H) Material Noncompliance (A, B) Significant Deficiency (N) Questioned Costs 15.R&D: $34,044 15.247: $1,041 Criteria: Federal regulation, 2 CFR 200.430(g)(1)(i) states that, “Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated.” Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The university did not follow established controls to certify payrolls charged to grants. As a result, payroll expenses charged to various grants were not certified as required by federal regulations. Questioned Costs: From our sample, questioned costs were accumulated based on payrolls charged to grants that were not approved. From this, we identified known questioned costs of $35,085. $24,439 of questioned costs occurred in FY24 and $10,646 of questioned costs occurred in FY25. From review of summary-level payroll information additional payrolls were not approved, leading estimated questioned costs to be higher. Context: The Office of Sponsored Programs (OSP) at the university administers the grant, while the Principal Investigator (PI) (normally faculty) is responsible for carrying out the grant. The university manages R&D grant awards in three stages: Pre-Award: A PI identifies a funding opportunity and works with OSP to document proposed funding details, including salaries, budget, and subawards. Award Management: OSP staff record award information and conduct regular financial reviews to assess whether expenses are allowable as charged to the project. PI’s oversee the award’s progression and certify staff time on the grant. Post-Award: When an award ends, OSP staff use a checklist to complete close-out procedures, including reconciling expenses and performing final billing. Federal regulations require that salary and wage charges to federal awards be based on records that accurately reflect work performed and are supported by internal controls that provide reasonable assurance that charges are accurate, allowable, and properly allocated. The university fulfills this requirement through a Personnel Activity Report (PAR). After each pay period, employees approve their time allocations to each grant, and PIs certify both their own time and the employees’ time charged to their grant. If a PI does not act, the PAR system sends two notifications to the PI to certify payroll. After the second notification, the PAR system is to alert the OSP Director so they can follow up directly with the PI. We performed testing of a random nonstatistical sample of 15 personal services transactions from a population of 222,024 transactions, 4 transactions had not been certified. Because certification is required for costs to be allowable, these costs were deemed unallowable. Additional uncertified payroll expenses charged to federal grants were also identified during the same pay period for those employees and included in questioned costs. For example, the two payrolls that occurred under a grant in October 2023 had 4 employees whose total uncertified payroll was $7,813. A different grant for the pay periods in October 2024 had 3 employees charge time to the grant that was not certified that totaled $2,720. A broader review of PARs across the audit period indicated additional grants and payrolls may be affected where PIs had not approved payroll. Effect: The university is not in compliance with the federal requirement to maintain effective internal controls over federal awards. The university is also noncompliant with federal requirements that salaries and wages charged to federal grants be based on records that accurately reflect the work performed. Consequences may include clawback of unallowed amounts, suspension or termination of federal awards, or heightened monitoring by federal awarding agencies. Cause: The university experienced staffing turnover and performance issues, causing some employees to be unaware of which grants they were responsible for reviewing. This led to missed reviews and missing documentation in grant files. The PAR system was also not configured to notify the new OSP Director when PIs failed to approve PARs after their notifications. As a result, the OSP did not receive notifications that these payrolls had not been certified. Recommendation: We recommend the University of Montana - Missoula: A. Ensure that charges to federal awards for salaries and wages are based on records that actively reflect the work performed. B. Follow established internal controls to provide reasonable assurance that charges to federal awards for salaries and wages are accurate, allowable, and properly allocated. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-105 Federal Program Name Research and Development Cluster (R&D) (COVID-19) Federal Awarding Agency Various State Agency University of Montana - Missoula (UM) and Montana State University - Bozeman (MSU) (universities) ALN # Various Grant # Various Compliance Requirement I. Procurement and Suspension and Debarment Type of Finding Material Weakness Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Department of Administration (DOA) did not establish delegation agreements with the University of Montana and Montana State University for the last six months of fiscal year 2025. These agreements lay out the policies and procedures departments must follow when procuring goods and services exceeding $10,000. Context: Federal regulations require the state to follow the same policies and procedures used for procurements with non-federal funds. State law authorizes the DOA to oversee all state purchasing and to delegate that authority to state agencies, including UM and MSU, through written delegation agreements. Delegation agreements are required for equipment and service contracts exceeding $10,000 and must include: • The activity or function authorized; • Limits or restrictions on the delegated authority; • Whether the authority may be further delegated; and • The duration of the delegation. UM and MSU held delegation agreements covering calendar years 2023 and 2024, but no agreements were in place for calendar year 2025. The universities receive their delegation authority through a delegation agreement between the Office of the Commissioner of Higher Education (OCHE) and the DOA. The universities requested new agreements from the DOA but were told to proceed procuring goods and services without them. Our testing indicated that both universities followed the same procurement procedures outlined in the previous delegation agreements while awaiting updated delegation agreements. This was what was communicated to the Universities by the DOA and indicated by DOA’s involvement and approval of major purchases that were above the universities’ previously delegated authority. The table below summarizes universities’ expenditures made without a delegation agreement in place. There was no indication that any of these purchases were for unallowable activities or unallowable costs. Effect: The universities are at risk of not following applicable state procedures when procuring goods and services. If the universities did not follow state procedures when procuring goods and services this could lead to noncompliance with state policies which would trigger significant questioned costs at both universities. Cause: The DOA was restructuring the state's procurement process and, during that process, chose not to execute new delegation agreements. Because the universities were able to demonstrate regular and ongoing efforts to obtain a signed delegation agreement and because they continued to follow previously applicable procurement processes, we did not classify this as material noncompliance and we did not question the costs incurred absent the signed agreement. Recommendation: We recommend the universities enhance internal controls over procurement by continuing to work with the Office of the Commissioner of Higher Education and Department of Administration to secure a delegation agreement that supports procurement transactions. Views of Responsible Officials: The universities concur with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-106 Federal Program Name Research and Development Cluster (R&D) Federal Awarding Agency Various (COVID-19) State Agency Montana State University - Bozeman (university) ALN # Various Grant # Various Compliance Requirement F. Equipment and Real Property Management Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.313(b) directs a state to, “use, manage, and dispose of equipment acquired under a Federal award by the state in accordance with state laws and procedures.” However, 2 CFR 200.313(d) adds additional specific requirements where equipment is acquired utilizing a federal award. Federal regulation, 2 CFR 200.313(d)(1) states that, “Property records must include a description of the property, a serial number or another identification number, the source of funding for the property (including the Federal Agency Identification Number), the title holder, the acquisition date, the cost of the property, the percentage of the federal agency contribution towards the original purchase, the location, use and condition of the property, and any disposition data including the date of disposal and sale price of the property. The recipient and subrecipient are responsible for maintaining and updating property records when there is a change in the status of the property.” Federal regulation, 2 CFR 200.313(d)(2) states that, “a physical inventory of the property must be conducted, and the results must be reconciled with the property records at least once every two years.” MOM policy 335 (V)(A)(3) requires all major equipment to be identified in a manner that promotes easy identification and requires property tags to be placed in plain sight on the equipment. While state policy does allow some discretion based on the physical nature of some equipment for situations where property tags may not be feasible, it does require that “whenever possible, the tag number will still be identified on the item by some means such as etching, decal, indelible ink, etc.” Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The university did not complete a full physical inventory of equipment during the audit period as required by federal regulations. As a result, the university’s controls were not effective in updating asset locations on property records or ensuring all assets were properly tagged. Context: The university holds approximately 4,755 capital assets across all funding sources; however, only 3,545 (approximately 75%) were inventoried during the audit period. This is an improvement from the prior audit (22-02), during which only 1,055 of 4,551 assets (approximately 23%) were inventoried, but a full inventory was still not completed. We performed testing on a random nonstatistical sample of 10 out of a population of 266 assets, found that 7 were not located at the address listed on the property record, and 1 was not tagged during the audit period. Repeat Finding: This is a repeat finding from the prior single audit (2023-076). As mentioned above in the context section, significant progress has been made on the inventorying of equipment as 75% of equipment was inventoried this period compared to 23% in the prior period. Effect: The university is not in compliance with federal requirements to use and manage equipment acquired under federal awards in accordance with state laws and policies. Inaccurate property records and incomplete asset tagging leave capital assets inadequately safeguarded and susceptible to theft. Cause: The university attributed the incomplete inventory to a COVID-19-related backlog and insufficient personnel resources to inventory capital assets, tag equipment, and update property records. Recommendation: We recommend Montana State University - Bozeman: A. Continue enhancing internal controls to ensure compliance with federal and state requirements governing equipment for the Research and Development Program; B. Perform a complete physical inventory of capital assets at least every two years; and C. Tag all capital assets when feasible. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-009 Federal Program Name Section 8 Project-Based Cluster Federal Awarding Agency U.S. Department of Housing and Urban Development (HUD) State Agency Department of Commerce (department) ALN # 14.195 and 14.856 Grant # MT800CC0001 Compliance Requirement C. Cash Management Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 31 CFR Part 205, implements the Cash Management Improvement Act (CMIA). The CMIA requires the state to enter into agreements that prescribe specific methods of drawing down federal funds and making payment via Electronic Funds Transfer (EFT). The details of these methods are included in the annual Treasury State Agreement (TSA) between the state and the federal government, if federal program expenditures exceed a set threshold defined by federal regulations. The department is included in the TSA for fiscal years 2024 and 2025 for the Section 8 Project-Based Cluster. The TSA requires the department to disburse funds to landlords by EFT so that the settlement date is the first business day of the month, except for January and July when the settlement date is the second business day of the month for fiscal year 2024. For fiscal year 2025, the requirement is that the settlement date be within five business days of receiving funds from HUD. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s controls were insufficient to ensure that the TSA aligned with business practice and was followed in fiscal years 2024 and 2025. We noted multiple instances of non-compliance during our testing. Context: The department receives federal reimbursement for Section 8 housing assistance payments, averaging over $2 million monthly to about 86 projects. Our review showed that the department routinely missed the deadline by at least one day. In fiscal year 2024, payments missed the first business day deadline in 6 out of 12 months. In fiscal year 2025, one month had a settlement date more than five days after receiving federal funds. However, this instance was the department drawing funds late, not early. Additionally, in both fiscal years, every month had at least one payment made outside the bulk payment process. Over the entire audit period, approximately $2 million was paid out each fiscal year outside of the bulk payments made at the beginning of each month. Repeat Finding: This is a repeat finding and was reported as Single Auditing finding #2023-008 in the audit for the two fiscal years ended June 30, 2023. Effect: The department did not comply with federal regulations and TSA requirements. Additionally, the TSA does not accurately reflect business processes for payments made to landlords outside the bulk process or not at the beginning of the month. Cause: Controls over cash management were insufficient to ensure compliance with the TSA. The department indicated that payments outside the bulk process occurred when additional information was received, allowing payment release. While waiting to release payments until all necessary information was available is acceptable, it does not align with TSA requirements. Because this was a prior audit recommendation, the department did request a change in the TSA, but it did not go into effect until fiscal year 2025. In addition, after we communicated the issue regarding mid-month payments, the department did request a change to TSA to accommodate them, but the change did not go into effect until fiscal year 2026. Recommendation: We recommend the Department of Commerce: A. Strengthen internal controls to ensure payments to landlords follow the Treasury State Agreement. B. Distribute payments to landlords in accordance with the Treasury State Agreement. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action, see the Corrective Action Plan starting on page D-1.
Finding 2025-010 Federal Program Name Section 8 Project-Based Cluster Federal Awarding Agency U.S. Department of Housing and Urban Development (HUD) State Agency Department of Commerce (department) ALN # 14.195 and 14.856 Grant # MT800CC0001 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles E. Eligibility L. Reporting N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Montana Operations Manual, Information Security Controls Standard, outlines baseline security controls for every state agency to implement for information technology systems they manage. Included among the baseline controls are requirements for documenting access control policies and procedures, including periodic reviews of user access. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department controls are inadequate to ensure that a periodic review of user access to the Housing Development Services (HDS) system is completed as required by state policy. Context: The HDS system tracks all client information and interfaces with the state’s accounting system for payments. The department did not perform access reviews during the audit period. A new procedure requiring periodic access reviews was implemented on March 31, 2026. Effect: While we did not identify any errors, inadequate access controls may result in inappropriate access to the HDS system and insufficient segregation of duties for automated processes such as issuing payments to landlords. Cause: Department officials stated that turnover at the agency contributed to the lack of access reviews. Recommendation: We recommend the Department of Commerce establish internal controls over the Housing Development Services system to ensure access reviews are completed in compliance with state policy. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action, see the Corrective Action Plan starting on page D-1.
Finding 2025-001 Federal Program Name SNAP Cluster (COVID-19) Federal Awarding Agency U.S. Department of Agriculture State Agency Department of Public Health and Human Services (department) ALN # 10.551 and 10.561 Grant # 23MT35053092101, 24MT3505392101, 25MT35053092101 Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Scope Limitation Questioned Costs No questioned costs identified Criteria: Federal regulation, 7 CFR 274.8(b)(3)(i), requires the state to maintain adequate security over and documentation for unissued Electronic Benefit Transfer (EBT) cards, to prevent their theft, loss, or damage. Federal regulation, 7 CFR 274.5(c), requires the state provide minimum security and controls over the physical EBT cards that include: secure storage, access limited to authorized people, bulk inventory control records, and review of the inventory and issuance records. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department cannot demonstrate the required storage and control measures over physical security of blank, unissued EBT cards were achieved during the audit period and does not have appropriate internal controls to ensure these requirements have been met. Context: The department contracts with an EBT service provider for its SNAP program. That contractor subcontracts EBT physical card security and processing to a third party. The third party maintains physical access to blank, unissued EBT cards. The department relies on processes performed over the main contractor’s activities, including consideration of information in the contractor’s System and Organization Controls (SOC) report, as evidence that the main contractor and all of its subcontractors are appropriately processing data and complying with applicable federal regulations. While the department’s processes are appropriate for the work of the contractor, they do not address requirements handled by the subcontractor that maintains physical security for blank, unissued EBT cards. The primary C-54 contractor's SOC report does not address EBT card security or card processing and specifically excludes subcontractor controls from the scope of the SOC report’s independent auditor’s opinion. Initially, the department could not provide the subcontractor’s SOC report as the subcontractor declined to provide the report directly to the department because no direct contract exists between them. When they were unable to obtain the report, department personnel reviewed 7 CFR 274, which specifically requires a SOC report over the financial transactions which are handled by the primary contractor. Based on the department’s review of the federal regulations and the contractor’s SOC report, they determined the activity at the subcontractor was low risk and assurances were obtained through the primary contractor. While we agree federal regulations do not specifically require a SOC report for the activities of the subcontractor, absent such a report, the department had no assurances that appropriate internal controls were established over the security of the physical EBT cards residing with the subcontractor. Additionally, the department relies on the subcontractor to ensure compliance with physical card security requirements over unissued EBT cards. We discussed this with department personnel, and in July 2026, the department was able to obtain two SOC reports for the subcontractor. One report covered the subcontractor’s information systems controls and processes and the other financial transaction processing. However, neither provided any assurances over the subcontractor’s controls over physical EBT cards and their security. As a result, we were unable to test compliance with federal regulatory requirements from October 1, 2023, through June 30, 2025, resulting in a scope limitation. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023, included a similar finding #2023-079, which directed the department to implement internal controls to obtain and review the subcontractor's SOC report. Effect: Without evidence of the subcontractor's internal controls, usually obtained through a SOC report covering the design and operating effectiveness of the subcontractor’s internal controls, the department cannot demonstrate the necessary controls are in place over physical security for unissued EBT cards maintained by the subcontractor. Additionally, the department is unable to demonstrate full compliance with federal regulations over physical card security. Cause: The department's contract with the primary contractor does not require the contractor to share the subcontractor's SOC report. The subcontractor initially declined to provide their SOC report directly to the department, as no direct contractual relationship exists between them and the department. The department incorrectly determined the assurances provided by the primary contractor’s SOC report also provided assurances over the subcontractor’s controls. When the department subsequently received two of the subcontractor’s SOC reports, their review was insufficient to identify the assurances needed to meet federal regulatory requirements for physical security of unissued EBT cards were not included. Recommendation: We recommend the Department of Public Health and Human Services: C-55 A. Implement internal controls over physical security of unissued EBT cards. B. Comply with federal regulations over physical security of unissued EBT cards. Views of Responsible Officials: The department does not concur with the recommendation. Management believes the SOC report received from their contractor satisfies this requirement. In addition, management indicates no risk remains due to completion of reconciliations over issued and used benefits. Management further believes no correction action is required. For additional information regarding management’s position, see the Corrective Action Plan starting on page D-1. Rebuttal of Views of Responsible Officials: We considered the department’s nonconcurrence. The SOC reports provided to our office during the audit did not include assurances over the requirements of 7 CFR 274.8(b)(3)(i) which are specific to blank unissued card inventory, access and issuance. Reconciliation requirements over benefits are a separate requirement of the SNAP program. As such, our recommendation stands.
Finding 2025-060 Federal Program Name Special Education Cluster (IDEA) (COVID 19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office or OPI) ALN # 84.027A, 84.027X, 84.173A, and 84.173X Grant # H027A230096, H027A240096, H173A230099, H173A240099 Compliance Requirement G. Matching, Level of Effort, Earmarking Type of Finding Material Weakness Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office is responsible for reporting the maintenance of state financial support (MFS) to the federal government as part of its annual application for Federal Special Education funding under the Individuals with Disabilities Education Act. OPI utilizes a spreadsheet to track all sources of special education appropriations for the state. However, in fiscal years 2024 and 2025, the spreadsheets used to calculate and report MFS contained incorrect and unsupported information, resulting in the submission of inaccurate data to the federal government. Context: A review of OPI's MFS calculations identified the following specific errors attributable to the office's internal control deficiency: - FY23 budget data was used in the calculation rather than FY24 budget data. - Expenditures, rather than appropriated amounts, were used. - Amounts were not consistently sourced from the same report within the state’s accounting system, resulting in inconsistent figures across reporting periods. In several instances, accurate information was available to the office but was not utilized in the MFS calculation. Additionally, multiple requests to OPI for budget data consistently yielded either FY23 budget figures or actual expenditure data rather than the correct FY24 and FY25 appropriated amounts, requiring auditors to obtain this information from the Office of Budget and Program Planning. Despite these control failures, auditors independently obtained correct budget information, recalculated the MFS, and determined OPI complied with the federal requirement to maintain at least the same level of state financial support as the prior year. Repeat Finding: Montana’s Single Audit report for the two fiscal years ended June 30, 2023, included a recommendation (2023-044) to the office to strengthen internal controls over MFS and to ensure MFS is accurately and completely tracked to meet federal requirements. We consider the compliance portion of the recommendation implemented. Montana’s Single Audit report for the two fiscal years ended June 30, 2021, also included a recommendation (2021-041) related to internal controls over maintenance of state financial support. Effect: As a result of this control deficiency, FY24 appropriation amounts were underreported by $463,000 in the federal fiscal year (FFY) 2025 federal funding application and by $769,000 in the FFY2026 federal funding application. In addition, the FY25 appropriation amount was also underreported by $966,645 in the FFY2026 federal funding application. The office is at risk of losing Federal Special Education funding if it does not implement and consistently operate effective controls to ensure the state maintains at least the same level of state financial support for special education each year, as required by federal law. Cause: In discussions with management, they were unable to identify the specific reason the spreadsheets used for MFS reporting did not reconcile to the final amounts submitted to the federal government. The Special Education Director, or the equivalent position at the time, held responsibility for ensuring the reported MFS amount was accurate and supported prior to submission to the federal government. However, management acknowledged incorrect information was included in the MFS spreadsheets but was unable to explain why the errors occurred or why they were not detected prior to submission. Recommendation: We recommend the Office of Public Instruction establish and document enhanced internal control processes over the tracking, calculating, and reporting of the maintenance of state financial support for Special Education to ensure compliance with federal regulations. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-061 Federal Program Name Special Education Cluster (IDEA) (COVID 19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.027A, 84.027X, 84.173A, and 84.173X Grant # H027A230096, H027A240096, H173A230099, H173A240099 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs $6,149,159 Criteria: Federal regulation, 2 CFR 200.332 (d), requires pass-through entities to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office reimbursed Local Education Agencies (LEAs), which are generally schools or school districts, without receiving sufficient documentation to determine whether the claimed costs were allowable under the Special Education program. The office’s internal controls did not ensure adequate documentation was on file before issuing reimbursements. Questioned Costs: We question $6,149,159 in Special Education reimbursements that were not adequately supported at the time of payment. Additional unsupported reimbursements likely exist in the populations. Context: In fiscal years 2024 and 2025, the office paid over $89 million to LEAs based on reimbursement requests for the Special Education program. We tested 20 of the largest reimbursement requests, ten from each fiscal year, from different LEAs. Nine requests in fiscal year 2024, and one request in fiscal year 2025, lacked sufficient documentation to determine the allowability of the reimbursed expenditures. Testing exceptions included an absence of dates associated with the compensation, people, or positions for which reimbursement was sought, or details on how supplies or repairs related to the Special Education program. Effect: The office reimbursed schools for Special Education costs that were not adequately supported at the time of reimbursement. The office’s subrecipient monitoring procedures were not sufficient to comply with federal regulations. As a result, the office paid at least $6,149,159 in claims that may have included unallowable costs. Cause: Prior to early 2025, the office’s cash request reviews were minimal and focused primarily on comparing requests to budget line items. While budget comparisons provide some assurance of allowability, they are not sufficient on their own. For example, they do not confirm that personal service costs are for individuals who worked on the Special Education grant, or that work occurred within the period of performance of the grant. The office implemented a new cash request review process in early 2025. However, this change occurred during the audit period and does not address Special Education reimbursements already made. If the office continues to operate under its new procedures, this recommendation should be resolved. Recommendation: We recommend the Office of Public Instruction: A. Continue to use enhanced internal controls to ensure schools submit adequate documentation with reimbursement requests prior to payment. B. Reimburse schools only when documentation is sufficient to confirm that costs are allowable under the Special Education program. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-062 Federal Program Name Special Education Cluster (IDEA) (COVID 19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.027A, 84.027X, 84.173A, and 84.173X Grant # H027A230096, H027A240096, H173A230099, H173A240099 Compliance Requirement H. Period of Performance Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office performs monthly reconciliations of Special Education grant expenditures to verify that amounts agree across the state accounting system, the office grant system, and manual tracking spreadsheets. The office uses the reconciliations to ensure Special Education funding is spent within the allowed grant period. During the audit period, reconciliations were not fully completed or adequately supported. Context: During the audit period, the office completed 44 reconciliations over the Special Education grants. We conducted a judgmentally selected nonstatistical sample and out of the six reviewed, we found four were not fully reconciled and did not agree to supporting documentation. Effect: Incomplete and unsupported reconciliations increase the risk that errors will go undetected and that funds may remain unobligated past the allowable period of performance. Cause: Staff responsible for completing and reviewing reconciliations relied on their knowledge of the reconciling items and did not record the information on the reconciliations. This resulted in undocumented differences. Recommendation: We recommend the Office of Public Instruction strengthen internal controls over grant reconciliations to ensure reconciling differences are documented and resolved in a timely manner, and all funds continue to be obligated within the applicable period of performance. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-040 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education State Agency Montana State University Billings (MSU Billings) ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Grant # Various Compliance Requirement C. Cash Management Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: MSU Billings completed monthly Direct Loan reconciliations between its system and the federal system as required by federal regulation. However, university staff did not have sufficient procedures in place to ensure the accuracy and completeness of the reconciliations, such as documenting a secondary review of the reconciliations. Context: We tested six reconciliations at MSU Billings in a nonrandom, nonstatistical sample and found none had a documented secondary review. The population was 24 reconciliations. No errors were identified in the reconciliation data itself. Effect: Without effective internal controls, differences between MSU Billing’s system data and the federal system data may go undetected and uncorrected. In addition, there is the risk of noncompliance with federal regulations if reconciliations contain errors that are not detected and corrected. Cause: The reconciliation process involves both Financial Aid and Financial Services personnel in gathering data. However, only one staff member documented the reconciliation information. Recommendation: We recommend Montana State University Billings enhance internal controls over direct loan reconciliations by documenting a secondary review. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-046 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U. S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.342 State Agency University of Montana (UM) (all campuses) Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified. Criteria: Federal regulation, 16 CFR 314.3, requires institutions subject to the Gramm-Leach-Bliley Act (GLBA) to develop, implement, and maintain a comprehensive, written information security program that includes certain specific elements outlined in 16 CFR 314.4. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The UM campuses lacked controls to ensure timely compliance with Gramm-Leach-Bliley Act (GLBA) requirements. Because the Office of Commissioner of Higher Education (OCHE) places compliance responsibility on flagship campuses, this constitutes noncompliance for all UM -affiliated campuses. Context: As a Student Financial Assistance program participant, the UM is a financial institution subject to GLBA requirements, including implementation of eight safeguards against foreseeable internal and external risks to the security, confidentiality, and integrity of customer information. The UM first authored an information security program in August 2023 and continued developing it during fiscal year 2024. The program addressed several required GLBA elements; others were addressed through UM policies. The following required policies were not in place until well into the audit period: • Data Security Standard - addresses encryption of customer information on the institution's system and when in transit; first documented April 4, 2024. • Account Security Standard- addresses multifactor authentication for anyone accessing customer information; first documented February 27, 2024. • Network Security Standard- addresses logging authorized user activity and monitoring for unauthorized access; first documented January 8, 2024. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023, included recommendation 2023-022 to continue developing and implementing internal controls to comply with GLBA requirements. Montana's Single Audit for the two fiscal years ended June 30, 2021, also included related recommendation 2021-023. Effect: The UM is not in compliance with federal requirements. Although we are not aware of any security concerns during the audit period, missing controls could result in the mishandling of sensitive student information, data breaches, and reputational damage. Cause: University of Montana personnel indicated that key security practices were in place but not formally documented for part of the audit period. Federal regulations require formalized policies to ensure all personnel consistently follow security practices that protect student information. Recommendation: We recommend the University of Montana: A. Continue to develop and implement internal controls to govern GLBA requirements, and B. Comply with federal regulations by maintaining policies addressing all GLBA requirements. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-047 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.342 State Agency University of Montana (UM) (all campuses) Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: UM campuses lacked sufficient controls to prevent employees from receiving compensation prohibited by federal regulations during the audit period. Context: The Montana Office of the Commissioner of Higher Education (OCHE), under the Board of Regents, oversees the Montana University System (MUS) and administers the Staff Compensation Plan. The plan covers all staff at MUS campuses, excluding student employees, faculty, coaches, and those with employment contracts or appointment letters. Staff may receive compensation adjustments, including strategic pay adjustments for retention, in-range progress reflecting increased job knowledge and duties, and lump sum bonuses. Supervisors initiate pay adjustments, which are then approved and processed by the human resources office (HR). Federal regulations prohibit UM campuses from providing commissions, bonuses, or other incentives based on securing enrollment or financial aid. The MUS Staff Compensation Plan now explicitly prohibits such payments; however, this policy change was not made until December 2024, meaning internal controls were incomplete for most of the audit period. All campuses must continue implementing this policy through their own internal control procedures to prevent enrollment-based payments to employees involved in enrollment, admissions, or financial aid. Our testing found no instances of prohibited incentive compensation. Out of a population of 59 pay adjustments, we performed testing on a nonrandom, nonstatistical sample of 16. Repeat Finding: Montana’s prior Single Audit report for the two fiscal years ended June 30, 2023, included recommendation 2023-024 to the universities to enhance internal controls to ensure employees do not receive compensation prohibited by federal regulations. Effect: Without effective internal controls, employees involved in enrollment, admissions, or financial aid remain at risk of receiving prohibited enrollment-based payments. Cause: The prior audit findings came to the attention of the Office of the Commissioner of Higher Education mid-audit period, leaving insufficient time to implement new controls for most of the audit period. If all universities implement the policy through their own internal control procedures, this issue should be resolved in the next audit. Recommendation: We recommend that all University of Montana campuses continue to enhance internal controls to ensure employees do not receive compensation prohibited by federal regulations. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-048 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S Department of Health and Human Services ALN # 93.342 State Agency University of Montana, Missoula Campus (UM Missoula) Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs Yes, amount could not be determined Criteria: Federal regulation 34 CFR 668.164(l), (3), requires that an institution return Student Financial Aid funds to the federal government no later than 240 days after the date the institution issued a check to a student or parent if the check is not cashed. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The UM Missoula lacks a process to ensure that Student Financial Aid funds from stale-dated checks are returned to the federal government. Questioned Costs: Questioned costs likely exist. UM Missoula could not estimate the amount owed to the federal government, but UM Missoula staff noted uncashed checks are rare. We cannot determine if questioned cost are more than $25,000. Questioned costs could apply to multiple ALNs. Context: UM Missoula applies the same refund process to all student and parent refunds, including Title IV Higher Education Act (HEA) funds. That process results in the transfer of HEA funds to the State as unclaimed property. These HEA funds are not returned to the federal government as required by federal regulations. Effect: UM Missoula is not returning all required federal funds to the federal government and is not adjusting affected students' accounts accordingly. As a result, students may owe more on their loans than the amount of aid they actually received. Cause: UM Missoula staff were unaware of the compliance requirement. Recommendation: We recommend the University of Montana Missoula: A. Enhance internal controls over the return of HEA funds to the federal government by documenting and following policies, and B. Comply with the federal requirement to return HEA funds from stale dated refunds no later than 240 days after the date that the institution issued a check. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-049 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.342 State Agency University of Montana, Missoula Campus (UM Missoula) Grant # Various Compliance Requirement E. Eligibility N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs $673,745 Criteria: Federal regulation 34 CFR 668.32(a) (1) requires that a student be enrolled or accepted for enrollment in an eligible program at an eligible institution to be eligible for Title IV funding. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal year 2025, the UM Missoula was victimized by identity theft fraud resulting in improper disbursements of federal Title IV Higher Education Act (HEA) funds. This type of fraud is a nationwide threat. UM Missoula's existing internal controls did not prevent or detect fraudulent enrollments in a timely manner, indicating a need to strengthen fraud detection measures. Questioned Costs: The total questioned costs are $673,745, representing HEA aid awarded to people posing as students. Approximately $30,000 of this amount relates to fiscal year 2026, which is outside of the audit period. According to university staff, $673,745 was returned to the federal government in fiscal year 2026. The known questioned cost by ALN is: • $534,627 in ALN 84.286, Federal Direct Student Loans • $3,613 in ALN 84.007, Federal Supplemental Educational Opportunity Grants • $95,002 in ALN 84.063, Federal Pell Grant Program The ALN for the approximately $30,000 in fiscal year 2026 is unknown, as is the approximate $10,000 from spring and summer of calendar year 2024. UM did not have the resources to review all activity in fiscal year 2024 and 2025. Therefore, there may be more likely questioned costs during fiscal years 2024 and 2025. Context: Between fiscal years 2024 and 2026, university staff became aware of more than 70 instances of identity theft that resulted in the disbursement of federal HEA funds under the fraud scheme. The 2026 information is included in this finding, because some of the instances of fraud found in 2026 affected disbursements during fiscal years 2024 and 2025. UM first became aware of the fraud when an individual reported that their identity had been used to enroll in online courses. UM then reviewed all students registered for the summer 2025 online session and identified 94 fraudulent enrollments, of which 63 received federal aid. Since the initial report, approximately seven individuals or loan servicers have brought additional cases to UM's attention. The disbursement periods for these cases were the summer of 2024, spring of 2024, and spring of 2026. UM staff noted that they have paid back all federal funds distributed as a result of the fraud. UM staff stated that they lack the resources to review all students across the full audit period for additional fraud. Most fraudulent enrollments were at Missoula College, which has a higher online enrollment. Based on a review of total enrollment at Missoula College, we determined that the fraud is unlikely to rise to the level of material noncompliance for the cluster as a whole. Effect: When UM returns federal funds that were obtained through fraud, it cannot recover those funds from the person posing as a student. The university's net cash loss, the amount actually disbursed during the fraud, was $377,937. The $673,745 reported above is the total amount awarded including amounts posted as tuition and fees as well as amount disbursed to student. Without stronger controls, UM faces risk of future financial loss. Additionally, the federal government may bear the cost of fraudulent loans that will never be repaid. Cause: Missoula College was likely targeted due to its higher volume of online enrollments and lower tuition costs, which result in greater cash disbursements to fraudulent enrollments after tuition and fees are deducted. Isolated incidents also occurred outside of Missoula College. UM staff reported maintaining controls during the audit period. Controls include standard federal aid eligibility verification, enrollment monitoring, and financial aid review processes. The fraud represents a national problem that the U.S. Department of Education is actively working to address. The sophistication and evolving nature of the fraud schemes exceeded the effectiveness of controls commonly used across higher education at the time. UM staff report they have since strengthened their fraud detection efforts through enhanced monitoring, increased cross-departmental review of suspicious activity, and expanded identity-verification procedures aligned with current guidance and best practices. Recommendation: We recommend the University of Montana Missoula continue to increase internal controls in an effort to ensure federal funds are awarded only to eligible students. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-050 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.342 State Agency University of Montana, Missoula Campus (UM Missoula) Grant # Various Compliance Requirement C. Cash Management Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified. Criteria: Federal regulation 34 CFR 685.300(b)(5) requires monthly reconciliations of Direct Loan funds received by the Department of Education to university records. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: UM Missoula staff did not complete all Direct Loan reconciliations as required and lacked effective controls to prevent noncompliance. Completed reconciliations were not adequately supported, and two months contained unreconciled differences. Context: We tested 6 out of 24 months of UM Missoula cash reconciliations in a nonrandom, nonstatistical sample. Two of the six months had no reconciliation completed. Of the four completed, only two included a secondary review. None of the completed reconciliations we reviewed retained support for cash balances and distributions. Two months showed an unreconciled difference of $8,251 with no explanation provided. Effect: Without effective internal controls, differences between the university’s data system and the federal data system may not be detected and corrected. Failure to complete Direct Loan reconciliations constitutes material noncompliance with federal regulations. Cause: UM Missoula experienced staff turnover during the audit period. The current Student Financial Aid director was unable to locate the two missing reconciliations. Controls to ensure reconciliations are completed, supported, and reviewed were not in place. Recommendation: We recommend the University of Montana: A. Strengthen internal controls over direct loan reconciliations, and B. Comply with direct loan reconciliation requirements. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-051 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.342 State Agency University of Montana, Missoula Campus (UM Missoula) Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation 34 CFR 668.165(a)(1) and (2) requires that before an institution disburses Title IV, HEA program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans. If an institution credits a student’s accounts for Direct Loans, Federal Perkins Loans, or TEACH Grant program funds, the institution must notify the student or parents of the right to cancel the loan. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: UM staff could not provide documentation of any required Title IV Higher Education Act (HEA) disbursement notifications for fiscal years 2024 and 2025. Context: In a sample test of 60 out of 30,162 students who received a Direct Loan and/ or a Pell grant, we tested 20 students from UM. This was a random nonstatistical sample. UM Missoula provided no evidence that required federal notifications were sent to any students tested. Staff noted that students access financial aid award and disbursement information through university systems, and that UM’s Student Financial Services publishes consumer information on Federal student aid, loan borrowing, withdrawal requirements, refund policies, and borrower responsibilities on its website. UM staff also explained that students complete federally required entrance counseling. However, UM staff acknowledged that existing communications do not fully address all disbursement notification requirements under federal regulations. Effect: Students and parents may not be aware of the total loans they are borrowing or their right to cancel those loans. Not notifying students of the specific items required by federal regulations is material noncompliance. Cause: There was staff turnover during the audit period. During the audit, university staff conducted internal inquiries of staff to determine how the notification process worked and no one was able to identify anyone who completed the required notifications. Recommendation: We recommend the University of Montana: A. Develop internal controls over the HEA disbursement notification process, and B. Comply with all notification requirements for HEA funds as required by federal regulations. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-052 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.342 State Agency University of Montana-Missoula (UM Missoula), MT Technological University, Butte (MT Tech), University of Montana Western (UM Western) and Helena College (Helena College) campuses Grant # Various Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulations, 34 CFR 675.19(b)(3), 34 CFR 674.19(d)(2), and 34 CFR 676.19(b)(3), require that regarding the Federal Work Study (FWS) program, the Federal Perkins Loans program, and the Federal Supplemental Educational Opportunity Grant (FSEOG) program, each year an institution shall submit Fiscal Operations Reports (FISAP) plus other information the Secretary of Education (Secretary) requires. The institution shall ensure the information reported is accurate and shall submit it on the form and at the time specified by the Secretary. Federal regulation, 34 CFR 668.24(e)(1)(i), requires institutions to keep the FISAP for the Federal Perkins Loan, FWS, and FSEOG programs and any records necessary to support the data contained in the FISAP for three years after the end of the award year in which the FISAP was submitted. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: UM Missoula's FISAP reports submitted during fiscal years 2024 and 2025 were unsupported, indicating that internal controls over FISAP reporting needs improvement. MT Tech was unable to provide support for one line item each year because it could not be located. UM Western’s FISAP reports in 2024 and 2025 contained line items which were not fully supported. Additionally, support provided by Helena College for the complex manual calculations used to support a significant number of lines on each report did not match the figures reported. Context: Each campus is required to complete the FISAP annually for its campus-based programs. The campuses use the Fiscal Operations Report portion of the FISAP to report expenditures and students served in the previous award year. The Application to Participate portion of the FISAP is to apply for funding for the following year. The fiscal year 2024 report covers the 2022–2023 school year, and the fiscal year 2025 report covers the 2023–2024 school year. We identified inaccuracies in the reported amounts, and estimates were used instead of actual amounts. The table below summarizes the total errors identified by campus. These issues indicate that controls over FISAP reporting were not effective. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2023, included recommendation 2023-020 for UM-Western, MT Tech, and Helena College to implement internal controls to ensure that FISAP reports submitted are accurate and supported to comply with federal regulations. UM Missoula was not included in the prior audit recommendation. Montana’s Single Audit for the two fiscal years ended June 30, 2021, included recommendation 2021-031 for UM-Western and Helena College to implement internal controls to ensure FISAP reports submitted are accurate and supported in compliance with federal regulations. UM Missoula and MT Tech were not included in this recommendation. Effect: Both reports submitted during the audit period by UM Missoula, MT Tech, UM-Western, and Helena College contained unsupported figures and inaccuracies. Inaccurate reporting to the federal government could affect the amount of future funding awarded or UM’s ability to participate in these programs. Cause: For UM, staff turnover during the audit period left current staff unable to locate all supporting documentation. For MT Tech, not all support was retained. Helena College uses a complex manual process to report a significant number of report lines, and documentation was not adequately retained to support this process. UM Western’s review process did not identify inaccurate reporting items. This indicates that controls at these campuses were not designed to be effective. Recommendation: We recommend the University of Montana Missoula, Montana Technological University, University of Montana Western, and Helena College: A. Enhance internal controls to ensure that FISAP information reported to the federal government is accurate by creating and documenting a review process that ensures reports are supported at the time reports are submitted, B. Enhance internal controls to ensure FISAP reports and support are retained in a central location, and C. Comply with federal requirements governing the Federal Perkins Loan, Federal Work-Study, and Federal Supplemental Educational Opportunity Grant programs by accurately completing FISAP reports. Views of Responsible Officials: The university concurs with the recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-053 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.342 State Agency University of Montana, Missoula campus (UM Missoula) Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 34 CFR 668.22, requires institutions of higher education to calculate the amount of Title IV, of the Higher Education Act (HEA), grant or loan assistance that must be repaid when a student who received such assistance withdraws. The calculation must include all days within the period that students are scheduled to complete, less scheduled breaks of at least five consecutive days. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls at the UM Missoula were not sufficient to ensure the calculation of unearned federal financial assistance was accurate. In our review of return calculations, we found several that did not subtract scheduled break days, resulting in overstated repayment amounts. Because UM Missoula returned more aid than required and the amount was less than $25,000, we do not consider the amount in error a questioned cost. Context: When a student receives HEA financial aid and withdraws, the university must calculate the percentage of aid earned based on the length of the term and how long the student attended, excluding scheduled breaks of five or more consecutive days. If the student attended less than 60 percent of the term, the institution must return the portion of unearned aid. Out of a population of 764 students, we tested 25. In 11 of the 25 students tested in a randomly selected nonstatistical sample, the calculation did not properly subtract scheduled break days, resulting in a higher calculated amount of aid to return. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2023, included recommendation 2023-026 to UM Missoula and affiliate campus University of Montana Western (UM Western) to enhance internal controls for accurate calculations and timely return of unearned aid, and to UM Missoula to comply with federal regulations. We determined that UM Western has fully implemented the recommendation, but that UM Missoula partially implemented the recommendation. Montana's Single Audit for the two fiscal years ended June 30, 2021, also included recommendation 2021-028 to UM Missoula and UM Western to enhance internal controls over the calculation and return of unearned HEA funds, and to comply with federal regulations. Effect: Not subtracting scheduled break days from the number of days a student attended UM Missoula resulted in errors in calculating earned HEA aid and led to inaccurate amounts of aid returned to the federal Department of Education. Cause: Staff did not consistently subtract scheduled break days from repayment calculations, indicating a weakness in internal controls over the federal aid return process.UM staff indicated that the oversite was due to turnover in the position responsible for inputting break days into the student information system used to calculate repayment amounts. Recommendation: We recommend the University of Montana Missoula: A. Strengthen internal controls to ensure scheduled break days are correctly subtracted when calculating the amount of federal aid to be returned upon student withdrawal, and B. Comply with federal regulations to accurately calculate and timely return unearned Title IV aid. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-054 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U. S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U. S. Department of Health and Human Services ALN # 93.342 State Agency University of Montana, Missoula campus (UM Missoula) Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 34 CFR 668.22(c)(4), requires institutions of higher education to document a student’s withdrawal date. Federal regulation, 34 CFR 685.309, requires institutions to report enrollment information, including withdrawals from enrollment, accurately and on time. Federal regulation, 34 CFR 668.24(c)(1)(iv)(C), requires institutions to maintain documentation of the amount, date, and basis of the institution’s calculation of any refunds or overpayments due to or on behalf of the student, or the treatments of Title IV Higher Education Act (HEA) program funds when a student withdraws. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: UM Missoula’s controls were insufficient to ensure all students, who received HEA aid and withdrew during the term they were awarded aid, were accurately reported to the National Student Loan Database System (NSLDS). Withdrawal dates differed between the two systems. Context: The federal Department of Education (ED) requires schools participating in the Direct Loan program to complete regularly scheduled enrollment reporting to NSLDS. Accurate, timely reporting allows ED to manage HEA aid, loan repayment dates, and program completion data. When a student withdraws from classes, staff record the withdrawal date in the university’s student information system, Banner, and use the National Student Clearinghouse (clearinghouse), a third-party organization, to complete enrollment reporting on behalf of the university. Staff can also manually update enrollment records, when necessary. From a nonstatistical sample population of 764 UM Missoula students, we tested 25 randomly selected students and found two students whose withdrawal dates in the federal system did not match the dates in the university's records. Montana’s Single Audit for the two fiscal years ended June 30, 2023, included recommendation 2023-027 to enhance internal controls to ensure all required students are reported to NSLDS, staff are aware of Banner programming rules, and to comply with federal requirements governing the enrollment reporting process. That recommendation was a repeat finding from Montana’s Single Audit for the two fiscal years ended June 30, 2021 (recommendation 2021-029). The cause of this reporting issue is unrelated to the prior audit recommendations. Therefore, we consider this a new audit recommendation. Effect: Inaccurate withdrawal date reporting resulted in noncompliance with Federal enrollment reporting requirements. Cause: The university's internal Student Financial Aid system, Banner, did not automatically update withdrawal dates in the NSLDS, indicating controls over system interfaces should be strengthened. UM staff stated that no formal process exists for confirming that updates to enrollment information are accurately transmitted. Also, a change in leadership during the audit period that led to inconsistencies in oversight and monitoring of the enrollment reporting process. Recommendation: We recommend the University of Montana Missoula: A. Strengthen internal controls to ensure enrollment status, including withdrawal dates, is reported accurately and timely to the National Student Loan Database System, and B. Comply with federal regulations to accurately and timely report enrollment information to the National Student Loan Database System. Views of Responsible Officials: The university partially concurs with the recommendation. Management agrees accurate and timely enrollment is essential to compliance with federal requirements and recognizes the importance of maintaining effective controls over the process. Management bases their partial concurrence on not yet completing their assessment of how the error occurred to fully correct the issue. Rebuttal of Views of Responsible Officials: We considered the university’s partial concurrence. The university plans to enhance monitoring, reconciliation, and verification procedures to support accurate and timely reporting of enrollment information, indicating they agree internal controls should be strengthened in order to comply with federal regulations. As such, our recommendation stands.
Finding 2025-056 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.342 State Agency University of Montana, Missoula campus (UM Missoula) Grant # Various Compliance Requirement E. Eligibility N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Internal controls were not sufficient to ensure all students' cost of attendance (COA) calculations are completely and accurately supported. Context: Before each academic year, the financial aid office calculates each student's estimated cost to attend UM Missoula. COAs may be adjusted on a case-by-case basis for special circumstances, and certain types of aid cannot exceed the COA. Out of 30,162 students (10,367 from UM), we tested a randomly selected nonstatistical sample of 20 UM students' COAs and found that one was less than UM Missoula’s original calculations by $1,382. Staff were unable to provide documentation explaining the difference. We tested 60 students in total, from all campuses in our rotation. We determined that the student did not receive aid for which they were not eligible, but ineffective internal controls increase the risk of awarding more aid than students are eligible for. Effect: Without effective COA controls students may qualify for aid amounts that do not reflect their eligibility. Cause: Staff could not immediately identify why the COA did not match and needed time to investigate whether an adjustment was made using professional judgment. Due to staff turnover, one employee handled nearly all audit requests. Ultimately, UM was unable to find documentation supporting the adjustment. Recommendation: We recommend the University of Montana - Missoula strengthen internal controls to ensure COA adjustments are documented and accessible to staff. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-041 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.264, 93.364, and 93.925 State Agency Montana State University (MSU) (all campuses) Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: MSU Bozeman did not designate a "qualified individual" to oversee and implement its required information security program for most of the audit period. MSU Bozeman designated a qualified individual in spring 2025. The Office of the Commissioner of Higher Education (OCHE) places the responsibility for compliance on the flagship campus. Therefore, this issue affects all MSU-affiliated campuses. Context: As a Student Financial Assistance program participant, MSU campuses are financial institutions subject to the Gramm-Leach-Bliley Act (GLBA), which has been in effect since 2003 and subject to audit since 2019. MSU campuses collect and store sensitive data, including student and employee personally identifiable information (PII). PII includes items such as names, Social Security numbers, and bank account information, as well as intellectual property and personal health information. Under its Program Participation Agreement with the Federal Department of Education, MSU campuses must comply with GLBA requirements. Federal regulations require institutions to designate a qualified individual responsible for overseeing and implementing the institution's information security program. Designating this individual was the only missing element. Therefore, this does not constitute material noncompliance for the MSU campuses. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023, included recommendation 2023-021 to continue developing and implementing internal controls to comply with GLBA requirements. Montana's Single Audit for the two fiscal years ended June 30, 2021, also included a related recommendation, 2021-022. Effect: Absent a designated point person to oversee and implement the information security program, the university risks mishandling sensitive student information which could lead to noncompliance. We are not aware of any security concerns during the audit period. Cause: OCHE delegated information security administration to flagship campuses, placing responsibility on MSU Bozeman. In September 2023, MSU Bozeman notified OCHE that it had identified its Chief Information Security Officer as the qualified individual but needed to formalize the designation in writing. According to university staff, the formalization was delayed because the Chief Information Security Officer position was vacant for seven months of the audit period. Recommendation: We recommend Montana State University enhance internal controls to maintain a designated qualified individual to oversee and implement its information security program, including in times of turnover. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-042 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.264, 93.364, and 93.925 State Agency Montana State University (MSU) (all campuses) Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: MSU campuses lacked sufficient controls to prevent employees from receiving compensation prohibited by federal regulations during the audit period. Context: The Montana Office of the Commissioner of Higher Education (OCHE), under the Board of Regents, oversees the Montana University System (MUS) and administers the Staff Compensation Plan. The plan covers all staff at MUS campuses, excluding student employees, faculty, coaches, and those with employment contracts or appointment letters. Staff may receive compensation adjustments, including strategic pay adjustments for retention, in-range progress reflecting increased job knowledge and duties, and lump sum bonuses. Supervisors initiate pay adjustments, which are then approved and processed by the human resources office (HR). Federal regulations prohibit MSU campuses from providing commissions, bonuses, or other incentives based on securing enrollment or financial aid. The MUS Staff Compensation Plan now explicitly prohibits such payments; however, this policy change was not made until December 2024, meaning internal controls were incomplete for most of the audit period. All campuses must continue implementing this policy through their own internal control procedures to prevent enrollment-based payments to employees involved in enrollment, admissions, or financial aid. Our testing found no instances of prohibited incentive compensation. Out of a population of 59 pay adjustments, we completed a nonrandom, nonstatistical sample of 16. Repeat Finding: Montana’s prior Single Audit report for the two fiscal years ended June 30, 2023, included a recommendation, 2023-023, to the universities to enhance internal controls to ensure employees do not receive compensation prohibited by federal regulations. Effect: Without effective internal controls, employees involved in enrollment, admissions, or financial aid remain at risk of receiving prohibited enrollment-based payments. Cause: The prior audit findings came to the attention of the Office of the Commissioner of Higher Education mid-audit period, leaving insufficient time to implement new controls for most of the audit period. If all universities implement the policy through their own internal control procedures, this issue should be resolved in the next audit. Recommendation: We recommend that all Montana State University campuses continue to enhance internal controls to ensure employees do not receive compensation prohibited by federal regulations. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-043 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.264, 93.364, and 93.925 State Agency Montana State University Bozeman (MSU Bozeman) Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: 34 CFR 668.164(l)(3), requires that an institution return Student Financial Aid funds to the Federal government no later than 240 days after the date that the institution issued a check to a student or parent if the check is not cashed. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: MSU Bozeman’s process to ensure the return of uncashed Title IV Higher Education Act (HEA) checks to the federal government was not carried out in fiscal year 2025, except for returns for Parent PLUS funds. Unreturned funds were less than $25,000, so no questioned costs were reported. Context: MSU Bozeman has a process to return Parent PLUS refunds to the federal government. The comparable process for other HEA funds was not completed during fiscal year 2025. All non-Parent PLUS HEA refunds during fiscal year 2025 were transferred to the State as unclaimed property rather than returned to the federal government. Per MSU Bozeman staff, there was a process to return uncashed checks to the federal government during fiscal year 2024. Effect: MSU Bozeman was not returning all required federal funds during fiscal years 2025 or 2026, but it will be able to return the 2026 checks within 240 days now that it is aware of the federal requirement. During fiscal year 2025, MSU Bozeman was also not adjusting affected students' accounts accordingly. As a result, there was a risk students could owe more on their loans than the amount of aid they actually received. Cause: Student refunds transitioned to a vendor around 2020. The previous Director of Student Accounts worked with the vendor to process files when a check had expired. A new director started at the beginning of 2025. The documented policies and procedures did not contain directions to process students’ expired checks, so knowledge was lost in the turnover. Recommendation: We recommend Montana State University Bozeman: A. Enhance their controls over the return of HEA funds to the federal government by documenting and following policies, and B. Comply with the requirement to return HEA funds from stale-dated refunds no later than 240 days after the date that the institution issued a check. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-044 Federal Program Name Student Financial Assistance Cluster (SFA) Federal Awarding Agency U.S. Department of Education ALN# 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN# 93.264, 93.364, and 93.925 State Agency Montana State University Bozeman (MSU Bozeman), Northern (MSU Northern), and Great Falls College – Montana State University (Great Falls College MSU) Grant # Various Compliance Requirement C. Cash Management Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 34 CFR 668.166(a), allows an institution to maintain a cash balance of any amount of Title IV Higher Education Act (HEA) funds for up to three business days before it becomes excess cash. Federal regulation, 34 CFR 668.166(b), allows an institution to maintain an excess cash tolerance of less than one percent of its prior year’s drawdowns for up to seven calendar days. The institution must immediately return any amount of excess cash over the one percent tolerance and any excess cash remaining in its account after the seven-day period. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: MSU Bozeman, MSU Northern, and Great Falls College MSU campuses lacked sufficient controls during the audit period to monitor excess cash balances of HEA funds. We identified multiple instances of excess cash at the MSU Bozeman campus. Context: We analyzed cash balances for all four Montana State University campuses throughout the audit period. At MSU Bozeman, we identified excess cash across all four SFA programs. Excess cash periods ranged from 11 to 444 days. They also varied in amount from approximately $1,000 to nearly $6 million. Specifically, we identified 3 excess cash periods for the Direct Loan program and 4 periods each for the Pell Grant, Federal Work-Study, and Federal Supplemental Educational Opportunity Grants (FSEOG) programs during the audit period. Following the prior Single Audit recommendation, MSU Northern and Great Falls College MSU implemented new daily cash monitoring controls at the start of fiscal year 2025. Before these controls took effect, one isolated instance of excess cash was identified at each campus. No additional noncompliance was identified for the remainder of the audit period, indicating the compliance portion of the prior audit recommendation is implemented for these campuses. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023, included recommendation 2023-025 to enhance internal controls to comply with federal regulations over cash management and excess cash. MSU Billings was part of the recommendation in the prior audit, but not in the current one. We did not find material noncompliance at MSU Northern, or Great Falls College in the current audit. Effect: MSU Bozeman did not comply with federal cash management requirements, resulting in excess cash that was not returned to the federal government. This noncompliance could affect the campus's federal funding or eligibility to participate in these programs, and could result in fines from the Department of Education. Without adequate controls, MSU Northern and Great Falls College MSU remain at risk of future cash management noncompliance. Cause: Following the prior Single Audit, MSU Bozeman began improving its cash management process but has not yet fully resolved the issue. The program activity is complex as SFA funds are constantly disbursed to students and reported to and drawn from the Department of Education. For FSEOG, federal and state match funds are deposited into the same account, making it difficult to manage federal cash separately and identify state fund disbursements. The campus also continued to earn interest on FSEOG funds, though it was unclear whether the invested money came from federal or state sources For MSU Northern and Great Falls College MSU, the prior audit recommendation was communicated, and a new daily monitoring process was developed, but implementation did not occur until halfway through the audit period. If these campuses continue to follow their new process, we expect the control portion of the prior audit recommendation will be implemented. Recommendation: We recommend: A. MSU Northern and Great Falls College MSU continue following their improved daily monitoring process to maintain compliance with federal cash management requirements. B. MSU Bozeman enhance internal controls by regularly monitoring cash balances to ensure compliance with federal cash management requirements. C. MSU Bozeman comply with federal requirements over cash management and excess cash. Views of Responsible Officials: The universities concur with this recommendation. For additional information regarding the universities’ planned corrective actions see the Corrective Action Plan starting on page D-1.
Finding 2025-045 Federal Program Name Student Financial Aid Cluster Federal Awarding Agency U.S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U.S. Department of Health and Human Services ALN # 93.264, 93.364, and 93.925 State Agency Montana State University Bozeman (MSU Bozeman) and Billings (MSU Billings) campuses Grant # Various Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulations, 34 CFR 675.19(b)(3), 34 CFR 674.19(d)(2), and 34 CFR 676.19(b)(3), require that regarding the Federal Work Study (FWS) program, the Federal Perkins Loans program, and the Federal Supplemental Educational Opportunity Grant (FSEOG) program, each year an institution shall submit Fiscal Operations Reports (FISAP) plus other information the Secretary of Education (Secretary) requires. The institution shall ensure the information reported is accurate and shall submit it on the form and at the time specified by the Secretary. Federal regulation, 34 CFR 668.24(e)(1)(i), requires institutions to keep the Fiscal Operations Report and Application to Participate (FISAP) for the Federal Perkins Loan, Federal Work-Study, and Federal Supplemental Educational Opportunity Grant (FSEOG) programs and any records necessary to support the data contained in the FISAP for three years after the end of the award year in which the FISAP was submitted. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Controls at MSU Bozeman and MSU Billings were not sufficient to ensure that the FISAP was complete and accurate in fiscal years 2024 and 2025. We identified multiple errors in the FISAP reports submitted by the two campuses. Context: Each campus is required to complete the FISAP annually for its campus-based programs. The campuses use the Fiscal Operations Report portion of the FISAP to report expenditures and students served in the previous award year. The Application to Participate portion of the FISAP is to apply for funding for the following year. The fiscal year 2024 report covers the 2022–2023 school year, and the fiscal year 2025 report covers the 2023–2024 school year. We identified inaccuracies in the reported dollar amounts, and estimates were used instead of actual amounts. The table below summarizes the total errors identified by campus. These issues indicate that controls over FISAP reporting were not effective. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2023, included a recommendation (2023-019) for MSU Bozeman, MSU Billings, and MSU Northern. Audit work over MSU Northern’s FISAP reporting did not identify any issues for fiscal years 2024 or 2025. Effect: Both reports submitted during the audit period by MSU Bozeman and MSU Billings contained unsupported figures and inaccuracies. Inaccurate reporting to the federal government could affect the amount of future funding awarded or MSU’s ability to participate in these programs. Cause: The misreported amount for Perkins cash on hand at MSU Bozeman is due to inherited historical errors on various lines in Part III of the FISAP which the reporting system requires to balance with the cash on hand line. Because of this, MSU Bozeman staff adjust the cash on hand line to submit the report, and the information reported did not agree to supporting documentation. Additionally, reviews do not catch all human errors. Internal controls should be strengthened to prevent inaccurate information from being reported to the federal government. MSU Billings can strengthen its internal controls to ensure staff use actual numbers instead of estimates. Recommendation: We recommend Montana State University Bozeman and Montana State University Billings: A. Enhance internal controls to ensure that FISAP information reported to the federal government is accurate by creating a review process that ensures reports are supported at the time reports are submitted, and B. Comply with federal requirements governing the Federal Perkins Loan, Federal Work-Study, and Federal Supplemental Educational Opportunity Grant programs by accurately completing FISAP reports. Views of Responsible Officials: MSU-Bozeman partially concurs with the recommendation. MSU-Bozeman management agrees additional efforts can be made to ensure accurate data elements are accurately reported, and indicates it has been transparent in communicating challenges validating the FISAP with Federal Student Aid going back to 2019. The university maintains the repayment and December cash on hand update is accurate for the distribution of asset calculation. MSU-Billings concurs with the recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1. Rebuttal of Views of Responsible Officials: We considered MSU-Bozeman’s partial concurrence. As discussed above, the cash on hand reported did not agree to supporting documentation. Additionally, MSU Bozeman agrees improvements can be made to FISAP reporting. As such, our recommendation stands.
Finding 2025-055 Federal Program Name Student Financial Assistance Cluster Federal Awarding Agency U. S. Department of Education ALN # 84.007, 84.033, 84.038, 84.063, and 84.268 Federal Awarding Agency U. S. Department of Health and Human Services ALN # 93.264, 93.364, and 93.925 State Agency Montana State University Bozeman (MSU Bozeman) Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 34 CFR 685.309, requires institutions to report enrollment information, including withdrawals from enrollment, accurately and on time. Federal regulation, 34 CFR 690.83, requires institutions of higher education to perform, correctly and timely, required reporting regarding Pell grants disbursed by the institution. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: MSU Bozeman’s controls were insufficient to ensure all students who received Title IV Higher Education Act (HEA) aid and withdrew in the same term were accurately reported to the National Student Loan Data System (NSLDS). Context: The federal Department of Education (ED) requires schools participating in the Direct Loan program to complete regularly scheduled enrollment reporting to NSLDS. MSU Bozeman uses the National Student Clearinghouse (clearinghouse), a third-party organization, for this reporting. MSU Bozeman staff extract data from Banner, the university's student information system, review it for errors, and send it to the clearinghouse for upload to NSLDS. If a student stops attending without completing official withdrawal paperwork, Banner does not record the withdrawal until after the semester ends. If that student is registered for the next semester, they continue to be reported as enrolled because the extract reflects the most current status and cannot capture retroactive changes. In these cases, campus staff must manually report the withdrawn status to NSLDS. From a randomly selected, nonstatistical sample of 1,673 students who received HEA aid and withdrew across multiple campuses in the Montana University System (690 from MSU Bozeman), we tested 11 MSU Bozeman students and found two whose withdrawals were not reported to NSLDS. The two students were identified as unofficial withdrawals after the semester ended and both were registered for the following semester. Effect: MSU Bozeman is noncompliant with enrollment reporting requirements for HEA aid programs. Not performing accurate, timely reporting impacts ED’s ability to manage HEA aid, loan repayment dates, and program completion information. Cause: Campus staff stated that manually updating enrollment status for students who unofficially withdraw while already registered for the next semester is time- and labor-intensive, particularly for a campus as large as MSU Bozeman. Recommendation: We recommend Montana State University Bozeman: A. Enhance internal controls to ensure all students who received HEA aid in a term and withdrew are reported to National Student Loan Database System as withdrawn in a timely manner, and B. Comply with federal requirements to complete enrollment reporting accurately and timely to the National Student Loan Database System. Views of Responsible Officials: The university concurs with this recommendation. For additional information regarding the university’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-078 Federal Program Name 1332 State Innovation Waivers Federal Awarding Agency U.S. Department of Health and Human Services State Agency Montana Office of the State Auditor (office) ALN # 93.423 Grant # SIWIW200014 Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, Appendix A to Part 170, Title 2, requires pass-through entities to report each obligating action no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office did not have adequate internal controls to ensure timely submission of Federal Funding Accountability and Transparency Act (FFATA) reports. Context: The office passes all Innovation Waivers grant funds through to the Montana Reinsurance Association as a subrecipient. The office considers grant funds obligated upon receiving a notice of award from the federal Department of Health and Human Services, which triggers the FFATA reporting requirement. The office submitted both required FFATA reports late during the audit period: one five months late in fiscal year 2024 and one two months late in fiscal year 2025. Repeat Finding: This finding was previously reported as Single Audit Finding #2023-048 in the audit for the two fiscal years ending June 30, 2023. Effect: The office is not in compliance with FFATA reporting requirements. This limits the federal grantor agency's ability to transparently report program activity. Cause: The office receives notices of award from the Department of Health and Human Services at inconsistent times during the year. For fiscal year 2024, the office had not yet implemented new reporting procedures before the report was due, in part because the subrecipient needed to register on the Federal FFATA reporting site. For fiscal year 2025, the inconsistent timing of award notices made it difficult for the office to plan and complete the report on time. Recommendation: We recommend that the Montana Office of the State Auditor: A. Strengthen internal controls to ensure compliance with FFATA reporting requirements. B. Submit required FFATA reports no later than the end of the month following the month in which an obligation is made, as required by federal regulation. Views of Responsible Officials: The office concurs with this recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-093 Federal Program Name Adoption Assistance – Title IV-E (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.659 Grant # 2401MTADPT and 2501MTADPT Compliance Requirement B. Allowable Costs/Cost Principles Type of Finding Material Weakness and Material Noncompliance Questioned Costs $76,348 Criteria: In combination, federal regulations, 45 CFR 1356.40(b)(3) and 45 CFR 1356.60(a)(1)(ii), permit federal matching funds to be used for adoption assistance payments when the adoption assistance agreement contains certain elements, including the duration of the agreement and nature and amount of payment. Federal regulation, 2 CFR 200.403, indicates a cost is reasonable if it does not exceed an amount that a prudent person would incur under the circumstances prevailing when the decision was made to incur the cost. Federal regulation, 2 CFR 200.403(a), indicates one of the factors in determining this reasonableness is whether the cost is generally recognized as ordinary and necessary for the recipient's operation or the proper and efficient performance of the Federal award. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked internal controls to review daily subsidy rate changes when adoption agreements included multiple rates. As a result, the department overpaid adoption subsidies by more than $76,000 during the audit period. Questioned Costs: Based on the department's analysis of amount that should have been paid, we question $76,348 in federal subsidy payments made during the audit period. Additional questioned costs were identified outside the audit period. Context: The department made 74,232 subsidy payments during fiscal years 2024 and 2025, with the federal portion totaling approximately $32.2 million. We randomly selected a nonstatistical sample of 25 payments from fiscal years 2024 and 2025 and found two payments where the rate paid did not comply with the applicable adoption agreement. After we reported these errors, the department reviewed all payments made regarding 4,055 children with active subsidies during the audit period, including payments back to 2008. That review found overpayments for 37 children totaling more than $365 thousand in federal funds, and underpayments for 5 children totaling approximately $13.5 thousand. The federal portion of overpayments attributable to the audit period was approximately $76 thousand. The department returned $371 thousand dollars to the federal government in fiscal year 2026 for overpayments dating back to 2008 through 2026. Effect: The department did not comply with federal requirements to make adoption subsidy payments in accordance with signed adoption agreements. Some families were overpaid and others were underpaid, dating back to 2008. Cause: The department had no system to track instances where daily subsidy rates in adoption agreements were scheduled to change at a future date. Recommendation: We recommend the Department of Public Health and Human Services: A. Establish controls to track changes in daily subsidy rates throughout the adoption agreement period. B. Pay the daily subsidy rate in accordance with the signed adoption agreement. Views of Responsible Officials: The department concurs with the recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-022 Federal Program Name Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.106 Grant # 3-30-0000-016-2020, 3-30-0000-019-2022, 3-30-0000-020-2024, 3-30-0050-009-2021, 3-30-0050-010-2021, 3-30-0050-011-2022, 3-30-0050-012-2024, 3-30-0082-022-2021, 3-30-0082-024-2021, 3-30-0082-026-2022, 3-30-0082-027-2022, 3-30-0082-028-2022, 3-30-0082-029-2023, 3-30-0082-030-2023, 3-30-0082-031-2023, 3-30-0082-032-2024, 3-30-0082-033-2025, 3-30-0082-034-2025 Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.328, requires grant recipients to submit financial reports as stipulated in the terms and conditions of the federal award. The terms and conditions of Airport Improvement Program (AIP) grants require annual submission of SF-270 and SF-425 financial reports. Federal Aviation Administration (FAA) instructions for completing the SF-425 require that negative cash on hand be reported when a grant recipient has incurred eligible expenses in excess of reimbursements. If positive cash on hand is reported, the grant recipient must return the excess funds. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Department controls were insufficient to ensure financial reports were completed accurately, resulting in misreported financial information. Context: The department prepares SF-270 and SF-425 reports annually for each AIP grant, as required by grant terms and conditions. Both reports are prepared at the same time using the same financial data and are reviewed and certified by an accounting supervisor. During planning, auditors found that the department had transposed the cash receipts and cash disbursements lines on the SF-425, causing positive cash on hand to be reported. Because the department operates the Airport Improvement Program on a reimbursement basis, all cash is disbursed before FAA reimbursement is received. The department does not draw cash in advance of expenditures and should never report positive cash on hand. Auditors conducted a nonstatistical random sample of grant financial reports. Of the 18 grants requiring SF-270 and SF-425 reports during the audit period, auditors tested three and found multiple errors in two of them: • The state share of expenditures was reported as zero, even though the actual federal share was less than 100%, misstating multiple lines on both reports. • For one report, total expenditures were not supported by documentation. Effect: These reporting errors misrepresent the department's financial management of grant funds and reduce the FAA's ability to oversee their use. The transposition caused the SF-425 to show positive cash on hand, signaling to the FAA that the department held excess funds and owed a return, even though no excess funds existed. Across the reports reviewed, cash on hand was reported at amounts ranging from approximately $2,000 to $2 million. Cause: Neither the preparer nor the reviewer understood what each report line required. Report line names alone do not always make the required inputs clear, leading to incorrect entries. Recommendation: We recommend that the Montana Department of Transportation: A. Strengthen internal controls to ensure federal financial data is reported accurately. B. Work with the Federal Aviation Administration to clarify the required information for each SF-270 and SF-425 report line. C. Accurately report financial information on the SF-270 and SF-425 as required by the Federal Aviation Administration. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-023 Federal Program Name Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.106 Grant # 3-30-0000-016-2020, 3-30-0000-019-2022, 3-30-0000-020-2024, 3-30-0050-009-2021, 3-30-0050-010-2021, 3-30-0050-011-2022, 3-30-0050-012-2024, 3-30-0082-022-2021, 3-30-0082-024-2021, 3-30-0082-026-2022, 3-30-0082-027-2022, 3-30-0082-028-2022, 3-30-0082-029-2023, 3-30-0082-030-2023, 3-30-0082-031-2023, 3-30-0082-032-2024, 3-30-0082-033-2025, 3-30-0082-034-2025 Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: The Federal Aviation Administration (FAA) Authorization Act of 1994 (Public Law 103-305) requires commercial service airports to file annual financial reports with the FAA. Required information includes payments made to, services performed for, and land and facilities provided to governmental entities, as well as airport revenues, expenses, and other financial information. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Department controls were insufficient to ensure FAA-required financial reports were complete and accurate before submission, resulting in misreported financial information. Context: The department owns and operates West Yellowstone Airport, a commercial service airport in West Yellowstone, MT. The FAA requires the airport to submit two annual financial reports. The department, as the airport sponsor, designates an accountant to complete both reports. Neither report was reviewed for completeness or accuracy by a second staff member before submission to the FAA. The Operating and Financial Summary Report (FAA Form 5100-127) requires disclosure of funds collected and spent at the airport. We traced all financial line items in the reports submitted during the audit period to the department's financial records. Based on testing performed through August 25, 2026, of the 51 report lines reviewed, 5 line items on the fiscal year 2023 report and 6 line items on the fiscal year 2024 report differed from supported amounts by 10% or more. The Financial Government Payment Report (FAA Form 5100-126) requires disclosure of all services provided to governmental entities that are not used exclusively for airport operations and all payments over $1,000 to governmental entities. The department’s written procedures for FAA reporting contained no guidance for this form, noting only that it was unlikely to apply. As a result, the department submitted blank reports for both years of the audit period. Through review of the department’s financial records and discussions with department personnel, we identified reportable items including a land lease to a local government for a purpose unrelated to airport operations and six payments over $1,000 to governmental entities: • Three payments to a regional airport authority • One payment to a tribal government • Two payments to the U.S. Department of Agriculture Effect: By not reporting required activity accurately, the department reduced the airport’s financial and operational transparency and limited the FAA's ability to monitor the airport and verify compliance with grant requirements. The absence of a second reviewer also means additional reporting errors may exist, which could further limit the FAA's ability to detect the diversion of airport revenues. Cause: The department had not assigned anyone to review FAA reports, and no review was expected. The department's standing assumption that the Financial Government Payment Report did not apply to the airport led staff to not look for reportable activity, resulting in blank submissions. Recommendation: We recommend that the Montana Department of Transportation: A. Strengthen internal controls to ensure operating and financial data for West Yellowstone Airport is reported completely and accurately. B. Report all West Yellowstone Airport financial information as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.
Finding 2025-024 Federal Program Name Airport Improvement Program, Infrastructure Investment and Jobs Act Programs, and COVID-19 Airports Programs (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Administration (department, DOA) ALN # 20.106 Grant # 3-30-0000-016-2020, 3-30-0082-026-2022, 3-30-0082-027-2022, 3-30-0082-028-2022, 3-30-0082-029-2023, 3-30-0082-030-2023, 3-30-0082-031-2023, 3-30-0082-033-2025, 3-30-0082-034-2025 Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs Likely questioned costs exceed $25,000 Criteria: Federal regulation, 29 CFR 5.5(a)(3)(ii)(A), requires contractors to submit certified payrolls weekly for each week in which any contract work is performed. Federal regulation, 29 CFR 5.6(a)(1)(i), indicates that no payment should be made if a contractor or subcontractor is not in compliance with 29 CFR 5.5. Section §18-2-103, Montana Code Annotated (MCA), requires the department to supervise, review, and accept all construction activities costing more than $300,000 unless it delegates this responsibility to another state agency. Under its memorandum of understanding (MOU) with the Montana Department of Transportation (MDT) for the West Yellowstone Airport Terminal project, the Department of Administration retains construction administration duties. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s controls were insufficient to collect certified payrolls from airport terminal contractors timely during state fiscal years 2024 and 2025, resulting in noncompliance and likely questioned costs. Certified payrolls are the department's primary tool for verifying that contractors pay employees at least the prevailing wages required by the U.S. Department of Labor. Questioned Costs: We identified no known questioned costs. However, our sample found 21 payrolls certified more than 30 days late. Because contractors are paid monthly, the department likely paid contractors while out of compliance with certified payroll requirements. We believe likely questioned costs exceed $25,000. Context: During the audit period, DOA managed construction of a new terminal at the West Yellowstone Airport. MDT, as the airport sponsor, hired a consultant to help administer the project, including collecting weekly certified payrolls from contractors and subcontractors. The MOU between DOA and MDT did not specify which party was responsible for compliance with federal wage rate requirements, causing each party to assume the other was responsible. Because the MOU assigned construction administration to DOA, and collecting certified payrolls is a construction administration duty, DOA is the legally responsible party. We tested a random, nonstatistical sample of certified payrolls associated with 14 of 133 project invoices. We considered a payroll late if submitted more than 14 days after the end of the pay period, allowing contractors reasonable time to pay employees and compile payroll records. Of the 45 certified payrolls reviewed, 21 (46%) were submitted more than 30 days late. As a result, those contractors were not in compliance with payroll submission requirements when they requested payment. The project consultant withheld three of nine payments to one contractor for late payrolls. However, we also found payrolls outstanding for seven months or more without payment being withheld, and five payments were made to that same contractor during this period. Effect: By not collecting certified payrolls weekly, the department is not compliant with federal regulations and risks missing instances where contractors or subcontractors pay workers below required minimum wages. Detecting such underpayments is the core purpose of federal wage rate requirements. Cause: The department interpreted FAA guidance as requiring certified payroll collection only at project closeout and final payment. Federal guidance requires that no certified payrolls remain outstanding at the time of final payment; it does not permit the department to delay collection until then. Recommendation: We recommend the Montana Department of Administration: A. Strengthen internal controls to ensure contractors comply with weekly certified payroll requirements, and explicitly assign responsibility for federal wage rate compliance at the start of each project. B. Ensure contractors submit certified payrolls weekly and take corrective action, including withholding payment, when they do not comply, as required by federal regulation. Views of Responsible Officials: The department partially concurs with this recommendation. Management believes MDT held responsibility for certified payrolls as the agency responsible for grant administration and federal reporting, but agrees that responsibility for compliance should be explicitly stated in future projects. Rebuttal of Views of Responsible Officials: We considered the department's partial concurrence. Collecting certified payrolls is a construction administration function that requires knowing which contractors were on-site each week. As project administrator, DOA is best positioned to ensure compliance. As such, our recommendation stands.
Finding 2025-094 Federal Program Name Children’s Health Insurance Program (CHIP) (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services (HHS) State Agency Department of Public Health and Human Services (department) ALN # 93.767 Grant # 2305MT3002, 2305MT5021, 2405MT5021, 2505MT5021 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles Type of Finding Material Weakness Questioned Costs Approximately $26,000 Criteria: Federal regulation, 2 CFR 200.403(a), requires expenditures to be necessary and reasonable for the performance of the federal award. Federal regulation, 42 CFR 457.402, defines child health assistance as payment for part or all of the cost of health benefits coverage for targeted low-income children. Federal regulation, 42 CFR 457.310(a), states that a targeted low-income child is a child who meets federal and state eligibility standards. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not take timely corrective action to resolve known data interface issues that were causing inaccurate eligibility information to be reported to the department’s contractor. These issues led to claims being paid for ineligible CHIP program participants. Questioned Costs: The department provided a list of payment adjustments for ineligible individuals. Using the Federal Medical Assistance Percentages (FMAP) rates in effect, we calculated the federal share of the adjustment and used that number to arrive at questioned costs of approximately $26,000. Context: The department uses a contractor to review and pay benefit claims. The contractor paid a total of $146.6 million in claims during the audit period. The contractor relies on eligibility information from the department’s system, provided through a system interface. The department found that the interface was not working properly, resulting in payments for ineligible individuals. At the end of the audit period, the interface issue was unresolved. After identifying the issue, the department reviewed claims and eligibility data to find all cases where claims were paid for ineligible individuals. They worked with the contractor to adjust these claims. In total, adjustments were made for 48 beneficiaries of approximately $26,000 in federal share. These adjustments occurred in fiscal year 2026, after the audit period. Effect: Without timely corrective action, the department risks paying claims for ineligible beneficiaries. The identified costs incurred for ineligible beneficiaries totaled about $26,000, but the amount could have been higher due to the timing of the department’s review and the nature of the issue. Cause: The department’s interface with the contractor did not function properly, resulting in payments for individuals who were not eligible for coverage. The department did annually review data to determine if benefits were paid to ineligible individuals, but it was not timely enough to resolve all issues during the audit period. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to identify and correct payments for ineligible individuals timely. B. Continue to investigate and resolve the interface issue with the contractor to prevent future payments to ineligible individuals. Views of Responsible Officials: The department does not concur with this recommendation. The department indicates they identified an interface issue and promptly corrected the affected payments. Additionally, the department believes the errors were limited and immaterial to the financial statements, indicating if errors had been larger they would have been corrected prior to fiscal year end. The department states the interface issue was fully corrected in April 2026. Rebuttal of Views of Responsible Officials: We considered the department’s nonconcurrence with the recommendation. While the department did correct the affected payments and indicate that the interface issue was corrected, these corrections did not occur within the audit period. As such, our recommendation stands.
Finding 2025-095 Federal Program Name Children’s Health Insurance Program (CHIP) (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services (HHS) State Agency Department of Public Health and Human Services (department) ALN # 93.767 Grant # 2305MT3002, 2305MT5021, 2405MT5021, 2505MT5021 Compliance Requirement B. Allowable Costs/Cost Principles N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs Likely questioned costs exceed $25,000 Criteria: Federal regulations, 42 CFR 455.410 and 455.412, require the department to ensure CHIP providers are licensed, screened, and enrolled in accordance with the State Plan requirements. These activities are required for a provider to receive CHIP payments. Medicaid Provider Enrollment Compendium (MPEC), section 1.5.B, indicates a state may delegate provider enrollment and screening to a third party. If screening is delegated, the state must make sure third parties are carrying out activities consistently and should make sure the third party is documenting screening. The state also remains responsible for screening activities delegated to third parties. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacks agency-level controls to ensure its contractor follows approved policies and procedures and properly documents the enrollment of CHIP-only providers, as required by federal regulations. As a result, the department cannot demonstrate compliance for any of these contractor-enrolled providers. Questioned Costs: The department pays its contractor a lump sum for all provider claims processed in a given period. Because payment data is not separated by provider, the amount paid to the 948 providers whose compliance could not be verified cannot be determined. We believe likely questioned costs exceed the $25,000 threshold due to noncompliance. Context: The department uses two processes for CHIP provider screening and enrollment. Providers who also provide Medicaid services are screened and enrolled by the department. CHIP-only providers are screened and enrolled by a contractor. Policies and procedures used by the contractor are reviewed and approved by the department when federal regulations change, when the contractor makes a change to the policies and procedures, and during contract renewals. The department’s process includes confirming that the policies and procedures are consistent with federal requirements. In fiscal year 2025, the department began receiving quarterly summary information from the contractor, showing which providers were enrolled as well as some screening and enrollment data. While the department does have discretion in determining what controls to implement to comply with federal regulation, the new information does not include details on the screening and enrollment process or documentation of the contractor’s decisions and, therefore, is not sufficient to demonstrate compliance. As such, we could not test whether CHIP-only providers were enrolled as required by federal regulations and consider the amount paid to these providers to be questioned costs and noncompliance. After we identified this issue, the department reached out to the Centers for Medicare and Medicaid Services (CMS). CMS responded on March 3, 2026, via email, and reiterated the MPEC requirements. Specifically, CMS indicated that “in the event the [department] opts to delegate screening…, the [department] should make sure third parties are carrying out activities consistently… In addition, the [department] should make sure the third party is documenting screening.” Currently, the department’s controls do ensure that the contractor has processes set up to consistently screen provider enrollments. Due to this, we consider Single Audit finding #2023-065 partially implemented because the department does not review documentation to confirm the contractor actually follows their procedures or properly conducts provider screening and enrollment. CHIP program benefits and claims for the audit period totaled $159 million, with about 54 percent paid to providers enrolled by the contractor. Of 44,813 providers, 948 were CHIP-only providers subject to contractor enrollment, for whom compliance cannot be demonstrated. Repeat Finding: This is a repeat finding, previously reported as Single Audit finding #2023-065 for the two fiscal years ended June 30, 2023. Effect: Without agency-level controls over contractor-provider enrollment, the department is not in compliance with federal regulations. Payments to providers not properly screened and enrolled are unallowable, putting the department at risk for unallowed costs. Likely questioned costs were identified for the audit period. Cause: During the audit period, the department enhanced internal controls by reviewing contractor policies and procedures and obtaining summary information. Staff believed these were sufficient controls. However, these procedures do not allow the department to determine if the contractor is following all federal requirements for contractor-enrolled providers. Recommendation: We recommend the Department of Public Health and Human Services: A. Develop and maintain internal controls to confirm that provider eligibility screening and enrollment decisions made by the department’s contractor are performed in accordance with approved policies and are documented as required by federal requirements. B. Ensure providers enrolled by the department’s contractor are licensed, screened, and enrolled, as required by federal regulations, to ensure payments are only made to the licensed and enrolled providers. Views of Responsible Officials: The department does not concur with this recommendation. The department noted that its existing screening and enrollment controls satisfy the federal requirements and the federal grantor agency reviewed those controls and closed the prior audit recommendation. The department implemented enhanced internal controls in 2025 in response to the prior audit recommendation. The department also noted that the form and manner of oversight activities remain within the state agency’s discretion. Given the federal grantor agencies review of the enhanced controls, the department believes its controls are sufficient. Rebuttal of Views of Responsible Officials: We considered the department’s nonconcurrence with the recommendation. While the department did enhance controls, this did not occur until over halfway through the audit period. Given these enhanced controls we consider the prior recommendation partially implemented. Additionally, the department does not have documentation to show that the provider eligibility screening and enrollment decisions made by the department’s contractor are documented, as required by federal requirements. As such, our recommendation stands.
Finding 2025-096 Federal Program Name Children’s Health Insurance Program (CHIP) (COVID-19) Federal Awarding Agency U.S Department of Health and Human Services (HHS) State Agency Department of Health and Human Services (department) ALN # 93.767 Grant # 2105MT5021 and 2205MT5021 Compliance Requirement L. Reporting Type of Finding Other Matter Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a)(1) and (a)(2)(ii), requires non-federal entities to report each subaward obligation of $30,000 or more to the Federal Funding Accountability and Transparency Act (FFATA) reporting system no later than the end of the month following the month the obligation is made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2024 and 2025, the department's internal controls were not sufficient to ensure that only required subrecipient actions for the CHIP of $30,000 or more were accurately, completely, and timely reported to the FFATA reporting system. Montana has no CHIP subrecipients; however, the department submitted significant FFATA reports for the program. Context: For all major federal programs for which FFATA was applicable for testing, we reviewed all obligations reported during the audit period and compared them with subaward agreements and amendments provided by the department. Montana has no CHIP subrecipients or subrecipient agreements. Therefore, the department should not have filed any FFATA reports for CHIP; however, it filed 12. The number of instances and corresponding dollar amounts are summarized below. Our analysis was conducted using FFATA reporting system data as of July 2025. We considered each transaction submitted, or omitted, by the department and compared information against executed subaward agreements from the audit period, as provided by the department. Any corrections the department made during fiscal year 2026 were not considered in our testing for this audit but will be considered during the fiscal year 2026 audit. Effect: FFATA reporting provides transparency to federal grantor agencies and the public. Because Montana has no CHIP subrecipients, the 12 incorrectly filed reports could mislead users of FFATA data. Cause: The department uses a central contracting system to capture obligations, which include both subrecipient and contractor relationships. The system is used to process payments and identify which agreements require FFATA reporting. However, information entered into the system did not distinguish between contractor and subrecipient relationships, was not consistently accurate and was not always entered at the time of obligation. Department personnel responsible for FFATA reporting indicated they are working with federal program staff to implement process changes to ensure FFATA reports are filed only for subrecipients and are accurate and timely. Recommendation: We recommend the Department of Health and Human Services: A. Enhance internal controls over FFATA reporting to ensure only required FFATA reports for the Children's Health Insurance Program are submitted. B. Only report required FFATA information for the Children's Health Insurance Program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.