Findings Citing § 200.303

Finding 2025-097 State Agency Department of Public Health and Human Services (department) Federal Awarding Agency U.S Department of Health and Human Services (HHS) Federal Program Name Children’s Health Insurance Program (CHIP) (COVID-19) ALN # 93.767 Grant # 2305MT3002, 2305MT5021, 2405MT5021, 2505MT5021 Federal Program Name Medicaid Cluster (COVID-19) ALN # 93.775, 93.777, and 93.778 Grant # Various Compliance Requirement E. Eligibility Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 42 CFR 435.912(c)(3), requires non-Federal entities to, among other things, make a determination of eligibility for Medicaid within 90 calendar days for applicants who apply for Medicaid on the basis of disability and 45 calendar days for all other applicants. Federal regulation, 42 CFR 457.340(d)(1), applies the timeliness and performance standards established by 42 CFR 435.912 equally to CHIP. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked sufficient internal controls to ensure timely eligibility determinations were made for initial Medicaid and CHIP applications. During the audit period, the department did not meet the timeliness standards required by federal regulations. Context: The department accepts, enters, and processes Medicaid and CHIP applications through an eligibility system. Applications are assigned to eligibility groups, tracked by supervisors via a caseload management report, verified through system interfaces and manual follow-up, and then issued an eligibility determination. We tested a nonstatistical random sample of initial Medicaid and CHIP applications to determine whether eligibility determinations were made within the required timeframe. Testing identified multiple instances of untimely determinations, as summarized below. The department’s initial application records for the audit period indicate a similar proportion of untimely determinations are likely to exist in the overall population. Effect: The department is not compliant with federal regulations. Untimely determinations delay benefits for eligible applicants. Without stronger controls, the department risks further noncompliance. Cause: During the audit period, the department was unwinding from the COVID-19 Public Health Emergency. The expiration of expanded eligibility waivers led to a significant surge in renewals, increasing the overall workload and causing processing delays. The department indicated they prioritized making redeterminations and were unable to consistently process new applications timely due to the added volume and resource constraints. Recommendation: We recommend the Department of Public Health and Human Services: A) Strengthen internal controls to ensure eligibility determinations are made timely. B) Make eligibility determinations for the Medicaid and CHIP programs within the timeliness standards required by federal regulations. Views of Responsible Officials: The department concurs with the recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-037 Federal Program Name Coronavirus State and Local Fiscal Recovery Funds (COVID-19) (SLFRF) Federal Awarding Agency U.S. Department of the Treasury State Agency Department of Administration (department) ALN # 21.027 Grant # SLFRP1747 Compliance Requirement M. Subrecipient Monitoring Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked sufficient internal controls to ensure that total federal award amounts were communicated to all subrecipients receiving broadband funding under SLFRF grants. Context: Federal subrecipient monitoring award requirements state that pass-through entities must notify each subrecipient of the total amount of the federal award committed to the subrecipient across all subawards. The department reviewed and approved broadband subgrants all at once. Several subrecipients applied for and received multiple SLFRF subawards for different broadband projects. The department used an appendix in the subaward agreements to communicate required elements to subrecipients. However, Element 10, "Total Amount of the Federal Award Committed to the Subrecipient by the Pass-Through Entity", reflected only the individual grant total and did not account for other grants issued to the same subrecipient. The department had no other documentation showing that the cumulative total of federal award was communicated to subrecipients during the audit period. The department reported 12 unique subrecipients receiving a total of 34 SLFRF broadband subawards. In a randomly selected nonstatistical sample of six subrecipients tested, five received more than one SLFRF-funded grant without receiving specific communication from the department, as the pass-through entity, about the total federal award committed to them. Effect: Inaccurate or incomplete total federal award amounts communicated to subrecipients can result in incorrect Schedule of Expenditures of Federal Awards reporting for the subrecipient, which is used to determine when a subrecipient is required to obtain a single audit. Cause: Department personnel indicated they chose to include just the dollar amount of the individual subaward, not the total of all subawards, in Element 10 to avoid needing to update or modify agreements in the event that other subaward amounts were declined or required modification. Based on our review, however, the department signed all subawards at the same time, so could have included total amounts in Element 10. Alternatively, the department could have chosen to communicate the total amount of the federal award committed to the subrecipients separately from the individual subawards once all subaward agreements were signed, but did not do so. Recommendation: We recommend the Department of Administration strengthen internal controls to ensure all required subaward elements, including total federal award amounts, are communicated to subrecipients on a timely basis. Views of Responsible Officials: The department partially concurs with the recommendation. Management agrees the aggregate funding amount must be communicated to subrecipients. However, management claims subrecipients were formally notified of the aggregate funding amount across all projects. In addition, management indicates subrecipients have access to cumulative award amounts through access to an online portal. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. While the department indicates they formally notified the subrecipients of their total federal awards, evidence of this was not provided during our audit. As such, our recommendation stands.

Finding 2025-039 Federal Program Name Coronavirus State and Local Fiscal Recovery Funds (SLFRF) (COVID-19) Federal Awarding Agency U.S. Department of the Treasury (Treasury) State Agency State of Montana Governor’s Office (office) ALN # 21.027 Grant # N/A Compliance Requirement L. Reporting Type of Finding Material Noncompliance and Material Weakness Questioned Costs No questioned costs identified Criteria: Federal regulation, 31 CFR 35.4, requires recipients to provide the Secretary of the Treasury periodic applicable reports providing detailed accounting of the uses of funds. Coronavirus State and Local Fiscal Recovery Funds Compliance and Reporting Guidance Chapter 2, Section B, Part 3(b) requires that for all projects entered into the reporting portal, each project should report the current period obligations, cumulative obligations, current period expenditures, and cumulative expenditures. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Governor's office was required to submit quarterly Project and Expenditure Reports to the Treasury. Testing found that the key line item, current obligations, was materially misstated for the quarters ending 09/30/24 and 12/31/24. The 09/30/24 misstatement also caused cumulative obligations to be misstated as of that date. The office, which administered SLFRF funds on behalf of all state agencies, lacked sufficient controls to ensure the key line item, current obligations, was accurately reported. We determined that the department had sufficient internal controls over the other key line items. Context: The state of Montana received SLFRF funds during the prior audit period. The office oversaw the administration and allocation of these funds to state agencies, including responsibility for submitting quarterly Project and Expenditure Reports to the Treasury. The required report elements include current quarter expenditures, cumulative expenditures, current quarter obligations, and cumulative obligations. Per the 2022 SLFRF Final Rule, an obligation means “an order placed for property and services and entering into contracts, subawards, and similar transactions that require payment.” In March 2024, Treasury issued new guidance clarifying how obligations could be established before the December 31, 2024 deadline, the date by which all SLFRF funds had to be obligated or returned. This new guidance allowed for interagency agreements between the office and other state agencies to constitute obligations if certain conditions were satisfied in the interagency agreements. In response, the office executed addendums to its interagency agreements with state agencies to ensure those agreements met Treasury's definition of an obligation. A review of the addenda showed that many were signed and therefore obligated for the quarter ending 09/30/24. However, the office did not report many of these as current obligations for that quarter. Instead, it reported obligations for those agencies up to their budgeted amounts in the quarter ending 12/31/24. The table below shows the quarterly misstatements identified. While the office misreported the current obligations that were made with SLFRF funds, it did not affect the cumulative obligations made by the Treasury imposed, December 31, 2024, obligation deadline. Our audit work determined that the office had insufficient controls in place to verify the accuracy of reported obligations. The office is required to report activity through the Treasury’s reporting portal. The portal has controls built into it, such as flagging errors if cumulative expenditures were greater than cumulative obligations, if cumulative obligations reported were greater than the budgeted amount for the project, and validation checks to ensure that current period entries reconciled to prior period entries. The office also required state agencies to sign Memorandum’s of Understanding (MOUs) that included budget controls and to submit project information through a standardized form. While these forms had checks in them, including requiring data to be entered into two separate forms, there was no control in place to ensure what was submitted for current obligations by an agency was supported by a contract or addenda signed with the office. Effect: Current obligations were not accurately reported, resulting in noncompliance with federal reporting requirements. By under-reporting obligations for the quarter ending 09/30/24, the federal government was not properly informed of the state's intended use of SLFRF funds. Treasury may have concluded that a significant portion of cash would be returned at the end of the obligation period. Cause: Office staff believed the Treasury reporting portal, along with the MOUs, the use of the standardized form and expense ties performed by the office provided sufficient controls to prevent material misstatement. They also believed their oversight of agency-level controls satisfied their own reporting responsibilities. Regarding the misstated obligations specifically, office personnel felt it was not practical to report obligations for addenda signed from July 2024 through September 2024, given the volume of projects and funding considerations as they approached the 12/31/24 deadline. The office also sought additional internal assurance of the MOUs to ensure they aligned with the Treasury guidance provided in March, before reporting the obligations in the Treasury portal for the quarter ended 12/31/24. Recommendation: We recommend the State of Montana Governor's Office: A. Implement internal controls to ensure the current obligations key line item is reported accurately. B. Accurately report all individual elements of the quarterly Project and Expenditure Report each quarter. Views of Responsible Officials: The office does not concur with the recommendation. Management notes that as cumulative obligations were accurately reported as of the December 2024 deadline there is no noncompliance. The office states that the controls they had in place were sufficient to prevent inaccurate reporting. Rebuttal of Views of Responsible Officials: We considered the office’s nonconcurrence. As discussed above, the office was required to submit reports quarterly. These quarterly reports are individually material to the reporting requirement. These reports include information about activity that occurred during the quarter including obligations made during the quarter. Current obligations are considered a key line item, which indicates the Treasury considered it important information. The office misconstrues our opinion that not having sufficient controls over reporting current obligations as having no controls over current obligations. As stated above, as the office did not have a control in place to ensure what was submitted as current obligations was supported by contracts/addenda signed. As such, our recommendation stands.

Finding 2025-101 Federal Program Name Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Awarding Agency U.S. Department of Homeland Security State Agency Department of Military Affairs (department) ALN # 97.036 Grant # 4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001, 4726DRMTP00000001, 4745DRMTP00000001, 4801DRMTP00000001, 4813DRMTP00000001 Compliance Requirement M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.332(d), requires pass-through entities to monitor subrecipient activities. Monitoring must ensure subrecipients take timely, appropriate action on all award deficiencies and resolve related audit findings. As of October 2024, these same requirements are now in 2 CFR 200.332(e). Federal regulations, 2 CFR 200.332(d)(3) and 2 CFR 200.521, require pass-through entities to issue management decisions for audit findings applicable to Federal awards passed to subrecipients. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked sufficient internal controls to ensure it performed all required subrecipient monitoring in fiscal years 2024 and 2025. We identified multiple instances of noncompliance with subrecipient monitoring requirements during the audit period. Context: When a disaster is declared in Montana, the department subgrants federal funds to cities, counties, and nonprofits to support local recovery. Federal regulations require the department to monitor subrecipients to ensure funds are spent properly and issues are resolved promptly. During the audit period, the department paid $53,947,993 to subrecipients for 187 projects across 8 disasters. The department did not begin reviewing subrecipient audit reports until May 2025 and had not completed all reviews as of July 30, 2025. Of 24 subrecipients who should have had an audit reviewed during the audit period: • 10 were not included on the monitoring spreadsheet • 2 were listed but had no audits reviewed • 12 had only one audit reviewed Federal regulations further require the department to issue management decisions for audit findings applicable to the department’s sub-granted federal awards. We identified three subrecipients with findings tied to the Disaster Grants program. Although the department corresponded with these subrecipients about the findings, no management decisions were issued. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023 included recommendation #2023-074, directing the department to implement controls to obtain and review subrecipient audit reports and to obtain and review audit reports of entities receiving grants. Effect: Without adequate subrecipient monitoring, the department is unaware of findings related to its grants or similar federal programs. This increases the risk of misspent federal funds and the department providing additional funds to a subrecipient who has already mishandled federal funds. It also means the department cannot determine when management decisions, corrective action plans, or additional monitoring are needed to ensure subrecipient compliance. Cause: The failure to review audit reports was previously identified as recommendation #2023-074. The department began developing a review process in August 2024 following that finding, but implementation was slow, and reviews of audit reports only began in late spring 2025. Additionally, department staff knew that management decisions are required for applicable findings but were unaware of the specific required elements or deadlines and believed their email correspondence was sufficient. Recommendation: We recommend the Department of Military Affairs: A. Strengthen internal controls to ensure subrecipient monitoring is performed as required by federal regulations. B. Obtain and review audit reports for all entities receiving subgrants from the department. C. Issue management decisions for all audit findings applicable to federal awards sub-granted by the department. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-102 Federal Program Name Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Awarding Agency U.S. Department of Homeland Security State Agency Department of Military Affairs (department) ALN # 97.036 Grant # 4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001, 4726DRMTP00000001, 4745DRMTP00000001, 4801DRMTP00000001, 4813DRMTP00000001 Compliance Requirement B. Allowable Costs/Cost Principles M. Subrecipient Monitoring N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs $7,814,126 in total questioned costs: $1,528,856 known and $6,285,270 likely. Criteria: Federal regulation, 2 CFR 200.403(c), requires costs to be consistent with policies and procedures applied uniformly to both federally financed and other activities of the recipient or subrecipient to be allowable. Federal regulation, 2 CFR 200.403(g), requires that costs be adequately documented to be allowable. Federal regulation, 2 CFR 200.332, requires pass-through entities to monitor subrecipient activities. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked internal controls to ensure costs were supported and documented before making payments on Disaster Grant projects. We identified multiple subrecipient projects with unsupported or inadequately documented costs. Questioned Costs: We identified $7,814,126 in total questioned costs: $1,528,856 known and $6,285,270 likely. We calculated likely questioned costs by analyzing a selection of project invoices and found that 32% were supported and 68% were not. We then projected that 68% rate to the remaining project costs. Context: During the audit period, the department paid $53,947,993 to subrecipients for 187 projects across 8 disasters. We planned to test a nonrandom, nonstatistical sample of 19 projects but stopped after finding errors in 2 of the first 5 projects tested. The first project provided emergency protective measures during the COVID-19 public health emergency, primarily temporary medical staffing. The second project repaired and replaced more than 100 miles of fencing damaged by wildfire. Across the two projects, we identified known questioned costs via the following documentation errors: • $153,240 paid with no invoices on file. • $868,709 paid when the contract lacked personnel rates needed to calculate payment. • $33,962 paid when invoices lacked sufficient detail to support the payment. • $39,920 paid over the contract limit. • $345,213 paid for materials without a required contract or other procurement documentation showing the subrecipient had followed their procurement policy. • $87,813 for Tribal Employment Rights Office fees paid twice, once by the contractors and once by the Federal Emergency Management Agency (FEMA). Additionally, $6,285,270 in likely questioned costs stemmed from the same lack of personnel rates in the contract. Effect: The department did not comply with federal regulations, resulting in more than $7.8 million in questioned costs for the program. Cause: Both projects were fully validated and closed through FEMA's large project closeout and Validate As You Go (VAYGO) processes. The department is uncertain how the documentation gaps occurred and believes the completed validation indicates costs were reviewed and deemed allowable, even if certain documents were absent from the files at the time of the audit. In the instance where no contract was executed by the subrecipient when it should have been under the subrecipient’s procurement policy, the department and subrecipient believed no contract was needed because materials were purchased as the project progressed. However, even when each of the seven purchases is considered individually, five would require at least some procurement documentation, and two would require a formal contract based on dollar amount alone. Considered together as a single project to replace 100+ miles of fence, all purchases would have required a contract under the subrecipient's procurement policy. Recommendation: We recommend the Department of Military Affairs: A. Strengthen internal controls to ensure subaward costs are adequately supported and retain supporting documents, as required by federal regulations. B. Comply with federal regulations by paying only allowable project costs to subrecipients. Views of Responsible Officials: The department partially concurs with the recommendation. Management agrees there is an opportunity to improve project documentation retention. However, they reiterate the reviewed projects were validated and deemed allowable through both the department and FEMA. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. While the projects were closed and validated by both the department and FEMA, we are required to include closed projects within the scope of our audit procedures, as requested and required by FEMA. Closed projects must be adequately documented. As a result, our recommendation stands.

Finding 2025-103 Federal Program Name Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Awarding Agency U.S. Department of Homeland Security State Agency Department of Military Affairs (department) ALN # 97.036 Grant # 4508DRMTP00000001, 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001, 4726DRMTP00000001, 4745DRMTP00000001, 4801DRMTP00000001, 4813DRMTP00000001 Compliance Requirement M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.332(a)(1)(xii), requires the pass-through entity to provide the Assistance Listing Number (ALN) to each subrecipient. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked sufficient internal controls to ensure it provided the ALN to all subrecipients as required by federal regulations in fiscal years 2024 and 2025. We identified multiple instances where the ALN was not provided to subrecipients during the audit period. Context: During the first half of the audit period, the department provided the ALN to subrecipients in payment letters accompanying project payments. Recommendation #2023-074 in the prior audit determined that the ALN was not consistently included in those letters, as its inclusion depended largely on which staff member prepared the letter. Beginning with the disaster declared in July 2024, the department adopted subgrant agreements that include the ALN as standard practice. However, the department did not retroactively collect agreements for older projects. Because projects span multiple years, we focused testing on payment letters issued during the audit period for the six open disasters declared before July 2024 and the subgrant agreements for disasters declared after that point. In a nonrandom, nonstatistical sample of 19 of 187 projects, we found five projects where the ALN was missing from at least one payment letter. In three of those projects, the ALN appeared in later letters but not all. However, these items are still considered errors because subrecipients could not have known the ALN at the time of earlier disbursements. One project also had an incorrect ALN in two letters. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023, included recommendation #2023-074 to the department to implement controls to ensure the ALN is communicated to subrecipients when awarding grants, and to communicate the ALN to all subrecipients awarded disaster funds. Effect: By not providing the ALN to all subrecipients, the department is not in compliance with federal subrecipient monitoring requirements. Without the ALN, there is risk the subrecipients are not able to properly report the subaward in their own Schedule of Expenditure of Federal Awards. Cause: Failing to consistently provide the ALN to subrecipients was identified in the prior audit. Recommendation #2023-074 recommended the department to include the ALN in all payment letters. The department was notified of this issue on March 6, 2024, and subgrant agreements incorporating the requirement took effect in July 2024. All payment letters missing the ALN were issued before those milestones. Two letters issued after the milestones contained incorrect ALNs; however, each included at least one ALN, indicating the department had adopted the requirement but was not applying it consistently. Because the department took corrective steps and subgrant agreements we tested contained no errors, recommendation #2023-074 should be resolved if the department continues to follow its new processes, despite the noncompliance noted in the current audit period. Recommendation: We recommend the Department of Military Affairs: C. Continue to follow its improved process to ensure the ALN is provided to all subrecipients as required by federal regulations. D. Comply with federal regulations by providing the ALN to all subrecipients. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-104 Federal Program Name Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Federal Awarding Agency U.S. Department of Homeland Security State Agency Department of Military Affairs (department) ALN # 97.036 Grant # 4608DRMTP00000001, 4623DRMTP00000001, 4655DRMTP00000001, 4726DRMTP00000001, 4801DRMTP00000001 Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 170, Appendix A(I)(a) and (a)(2)(ii), requires non-Federal entities to report each subaward action of $30,000 or more to the Federal Funding Accountability and Transparency Act (FFATA) reporting system. Reports must be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked sufficient internal controls to ensure FFATA reporting was complete, timely, and accurate. We identified multiple instances of noncompliance with FFATA reporting requirements during the audit period. Context: When a disaster is declared in Montana, the department subgrants federal funds to cities, counties, and nonprofits for local disaster recovery. All projects over $30,000 require FFATA reporting. Because projects span multiple years, we focused testing on FFATA reporting required during the audit period. Our population included projects with initial obligation dates or obligation changes in fiscal years 2024 or 2025. For projects obligated before the audit period but amended during it, we tested only the new reports submitted during the audit period. We tested a nonrandom, nonstatistical sample of 16 out of 110 projects and identified errors in 5 projects: • One project with no FFATA report filed for an obligation change • Four projects with late FFATA reports • Three projects with incorrect amounts reported The details of these errors are summarized in the table below: The department had similar findings in the prior two Single Audits. While we saw significant improvement, material noncompliance remained throughout the current audit period. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023, included finding #2023-073, which recommended that the department implement controls to ensure timely and accurate FFATA reporting and submit reports in accordance with federal regulations. This issue was also reported as finding #2021-014 in the Single Audit for the two fiscal years ended June 30, 2021. Effect: The department is not in compliance with FFATA reporting requirements. FFATA reporting provides transparency to federal grantor agencies and the public. The errors identified could mislead users of the data reported through FFATA. Cause: In response to prior findings, the department took steps to improve FFATA reporting during the current audit period, including continuing a new monthly reporting control. However, these corrective actions took time to implement fully, leaving gaps in compliance during the transition. If the department continues with their improved process, this finding will likely be resolved in the next audit. Recommendation: We recommend the Department of Military Affairs: A. Continue to strengthen internal controls to ensure FFATA reporting is complete, timely, and accurate. B. Submit FFATA reports in accordance with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-066 Federal Program Name Education Stabilization Fund (ESF) (COVID 19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.425 Grant # S425D200006, S425U210006, S425D210006 Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 170, Appendix A(I)(a) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-Federal entity. The report should be submitted no later than the end of the month following the month in which the obligation was made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office receives ESF funds under the Elementary and Secondary School Emergency Relief (ESSER) fund portion of the grant. The prior single audit identified errors in the office’s FFATA reporting for ESSER. During the current audit, we found similar errors, as reported amounts did not agree with the office’s allocation spreadsheets. Context: We compared subaward amounts reported on SAM.gov (as of March 2026) to the office’s ESSER allocation spreadsheets for Local Education Agency (LEAs), which are generally schools or school districts, receiving more than $30,000. Of the 399 schools that received ESSER funds, 351 (ESSER II) and 364 (ESSER III) received allocations above the $30,000 reporting threshold. We were able to match SAM.gov data to allocation records for 235 schools. Of the schools we could compare, we found the ESSER II allocations were more than reported at Sam.gov by $35.5 million, and for ESSER III, allocations were $78.6 million more than reported at Sam.gov The table on the following page summarizes testing results: Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2023-045 from the audit for the two fiscal years ended June 30, 2023. This was originally reported as finding 2021-038 in Montana’s Single Audit report for the two fiscal years ended June 30, 2021. Effect: The office did not comply with federal FFATA reporting requirements. Inaccurate and untimely reporting limits the federal grantor agency's ability to transparently track and report program activity. Cause: The office experienced difficulties reporting accurately in the new federal reporting system. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls to ensure the timely and accurate submission of FFATA reports, including a follow-up plan when errors occur. B. Submit FFATA reports in accordance with federal regulations, including submitting prior-year reports. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-067 Federal Program Name Education Stabilization Fund (ESF) (COVID 19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.425 Grant # S425D200006, S425U210006, S425D210006 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs $944,172 Criteria: Federal regulation, 2 CFR 200.332(e), requires pass-through entities to, “Monitor the activities of the subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.” Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award Condition: The office receives ESF funds under the Elementary and Secondary School Emergency Relief (ESSER) fund portion of the grant. The office reimbursed Local Education Agencies (LEAs), which are generally schools or school districts, without receiving sufficient documentation to determine whether claimed costs were allowable under the ESSER program. The office’s internal controls did not ensure adequate documentation was on file before issuing reimbursements. Questioned Costs: We question $944,172 in ESSER reimbursements we tested that were not adequately supported at the time of payment. Additional unsupported reimbursements likely exist in the populations. Context: In FY2024 and FY2025, the office paid over $230 million to schools based on reimbursement requests. We designed a randomly selected, non-statistical sample of 60 items to test controls and 40 items to test allowability. We tested the first 16 items and found 10 instances of non-compliance. Based on this error rate, we concluded there was a material weakness and material non-compliance and did not test the remaining sample items. The 10 items with errors, totaling $770,637, lacked one or more of the following: dates associated with compensation, identification of employees or positions covered, or explanation of how supplies or repairs related to the ESSER program. Absent this information, the office is unable to demonstrate the costs reimbursed are for allowable costs under the grant. The number and consistency of errors indicate a systemic problem. The office also provided funds to schools under ESSER as part of a separate Math Innovations program. Four schools were paid funds under this program during the audit period for a total of $347,095. As this program was new in the audit period, we looked at all the cash requests for the audit period and question an additional $173,535 in costs. These cash requests also lacked adequate documentation to support they were allowable under the grant. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2023-032 from the audit for the two fiscal years ended June 30, 2023. This was originally reported as Single Audit finding 2021-036 in the audit for the two fiscal years ended June 30, 2021. Effect: The office reimbursed schools for ESSER costs that were not adequately supported at the time of reimbursement. The office’s subrecipient monitoring procedures were not sufficient to comply with federal regulations. As a result, the office paid at least $944,172 in claims that could have been for unallowable activities or unallowed costs. Cause: This issue was originally communicated to the office in late fiscal year 2024, leaving only part of the audit period for the office to strengthen controls. Prior to early 2025, the office’s cash request reviews were minimal and focused primarily on comparing requests to budget line items. While budget comparisons provide some assurance of allowability, they are not sufficient on their own. For example, they do not confirm that personal service costs are for individuals who worked on the ESSER grant, or that work occurred within the period of performance of the grant. The office implemented a new cash request review process in early 2025. However, this change came after the audit period and does not address ESSER reimbursements already made. If the office continues to operate under their new procedures, this recommendation should be resolved. Recommendation: We recommend the Office of Public Instruction: C. Enhance internal controls to ensure schools submit adequate documentation with reimbursement requests prior to payment. D. Reimburse schools only when documentation is sufficient to confirm that costs are allowable under the program. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-068 Federal Program Name Education Stabilization Fund (ESF) (COVID-19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.425D and 84.425U Grant # S425D200006, S425U210006, S425D210006 Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.334, requires non-federal entities to retain records related to federal awards. Compliance Supplement 2025 (page 4-84.425-29) states an annual special report is required with the following key line items: • Local Education Agency’s (LEA) expenditures by the Elementary and Secondary School Emergency Relief (ESSER) subgrant fund, expenditure category, and object code • Number of specific positions supported with ESSER funds • Allocation of ESSER funds to schools and criteria used to allocate funds to schools, and • Full Time Equivalent (FTE) positions Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office receives ESF funds under the ESSER portion of the grant. The office did not have documented evidence that it reviewed the ESSER annual report before submission. No other compensating controls were in place to ensure the report was accurate and complete. Upon reviewing the report submitted during the audit period, we found multiple instances where the report did not reconcile with supporting data. Context: As the ESSER program ended, the federal Department of Education waived the annual report for 2025. As a result, only one annual report was due during the two-year audit period. We reviewed supporting data from 46 schools and found that of those schools, 43 included data that did not match what the office submitted to the federal government. Differences between the two sources ranged from approximately $400 to over $400,000. Repeat Finding: This is a repeat finding and was reported as Single Audit finding #2023-031 from the audit for the two fiscal years ended June 30, 2023. Effect: Annual ESSER reports were posted to a public website to show how ESSER funds were spent across the United States. Montana's report for the office contained information that was not supported by school data, which could mislead the public about how funds were used and create inconsistencies with data reported by other states. By reporting incomplete and/or inaccurate information, the office is not in compliance with federal regulations. Cause: The office indicated it completed a review of the annual report prior to submission. However, staff in the positions responsible for preparing and reviewing the report left the office when the program ended. Current staff could not locate documentation to support that a review occurred or explain why amounts conflicted with supporting documentation. Recommendation: We recommend the Office of Public Instruction A. Strengthen internal controls to ensure that reviews of federal reports are completed and documented prior to submission and documentation is retained in a centralized location. B. Retain supporting documentation and submit accurate federal reports, as required by federal regulation. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-069 Federal Program Name Education Stabilization Fund (ESF) (COVID-19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.425D and 84.425U Grant # S425D200006, S425U210006, S425D210006 Compliance Requirement B. Allowable Costs/Cost Principles Type of Finding Material Weakness and Material Noncompliance Questioned Costs $668,828 Criteria: Federal regulation, 2 CFR 200.403(c) and (g) states, that for costs to be allowable, they must be consistent with policies and procedures that apply uniformly to both federal-financed and other activities of the recipient. They also must be adequately documented. Federal regulation, 2 CFR 200.413(c), states that administrative and clerical staff salaries should normally be treated as indirect costs. Federal regulation, 2 CFR 200.430(g)(1) states that charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. The records must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office charged salaries to the ESSER grant as direct costs for staff whose positions are normally recovered through indirect cost collections. Supporting documentation was not available to show that these staff worked directly on the grant. The office also applied an indirect cost rate to those direct salary charges, which is not permitted under federal regulations. Questioned Costs: In total, we question $668,828 in costs calculated as described below. Context: During the audit we noted the following situations: 1. Indirect cost overcharge: When indirect costs were moved out of the office’s indirect cost account, the amounts already allocated and charged to federal programs through the indirect cost fund were not reduced. This resulted in overcharging the ESSER program by an estimated $207,363 for indirect costs. We question costs in this amount. 2. Unallowable direct salary: Personal services costs for administrative and executive positions, including a Financial Manager, Budget Analyst, Chief Operating Officer, and Chief Information Officer, were moved from a non-federal funding source directly to the ESSER grant. No time-and-effort documentation was available to support these charges. We question these costs totaling $398,096. 3. Indirect cost rate applied to unallowable salary: The indirect cost rate was also applied to the salaries in item 2 above, effectively charging the federal government twice for a portion of the same costs. We question these additional costs totaling $63,370. Effect: The office did not comply with federal regulations, resulting in $668,828 in questioned costs. Questioned costs are based on actual amounts moved to the ESSER grant as well as the auditor’s calculation to prorate the federal share for the indirect costs that were removed from the indirect cost account. Cause: The office's internal controls were not sufficient to ensure that salaries and indirect costs charged to the ESSER grant were allowable and supported by adequate documentation. While the office indicated the administrative and executive positions worked on ESSER reports, presentations to community partners, and inquiries from schools, there was no documentation that supported this time and effort. The office has implemented time and effort controls; however, it was implemented subsequent to the ending of the ESSER program. Recommendation: We recommend the Office of Public Instruction: A. Strengthen internal controls over salaries and indirect costs to ensure only allowable and supported costs are charged to federal grants. B. Track and document time and effort on grants to support both direct and indirect charges, as required by federal regulations. Views of Responsible Officials: The office partially concurs with the recommendation as they noted administrative and management staff did work on the grant. Rebuttal of Views of Responsible Officials: We considered the office’s nonconcurrence. We agree that administrative and management staff could have direct charges to the grant as allowed under federal regulations. However, no time and effort documentation was provided to support these staff members worked directly on the grant to support the costs were allowable as a direct charge. As such, our recommendation stands.

Finding 2025-070 Federal Program Name Education Stabilization Fund (ESF) (COVID-19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.425U Grant # S425D200006, S425U210006, S425D210006 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles Type of Finding Material Weakness and Material Noncompliance Questioned Costs $393,231 Criteria: Per Federal regulation, 2 CFR 200.403(a), for costs to be allowable, they must be necessary and reasonable for the performance of the Federal award. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office receives ESF funds under the Elementary and Secondary School Emergency Relief (ESSER) fund portion of the grant and contracted with the University of Montana - Western for services to recruit and retain K–12 teachers. The office paid the contractor primarily based on estimated costs rather than actual services performed. One invoice also included a cost category not authorized by the contract. When the contractor later submitted an invoice based on the number of teachers participating in the programs, it did not fully account for prior estimate-based payments, resulting in an overpayment. Questioned Costs: We question $393,231 in costs based on the amount the contract was overpaid as calculated below. Context: The contract specified a flat fee per resident teacher, up to 60 teachers, plus certain administrative costs. Payments were to be progress-based, tied to services performed. The office paid $926,894, total, including $594,469 in prepayments based on estimates. A subsequent invoice showing total actual costs of $601,663 indicates the office overpaid by $325,231. The contract authorized payments for resident teacher compensation, teacher-leader stipends, and resident teacher tuition grants. However, the contractor also billed $68,000 for "tuition other," a category not authorized by the contract. Combined, these issues total $393,231 in questioned costs. Effect: The office made payments outside the contract terms and without supporting evidence of actual contractor costs, resulting in $393,231 in questioned costs. Cause: The office's internal controls were insufficient to ensure that contractor invoices reflected services actually performed or that payments were limited to cost categories authorized by the contract. Office staff indicated the $68,000 “tuition other” category was related to the contractor billing for fringe benefits for each participant. Recommendation: We recommend the Office of Public Instruction: A. Strengthen internal controls to ensure contractor payments are supported by documentation of services performed and are consistent with contract terms. B. Pay contractor invoices only for costs and categories explicitly allowed by the contract. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-071 Federal Program Name Education Stabilization Fund (ESF) (COVID-19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.425D and 84.425U Grant # S425D200006, S425U210006, S425D210006 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles Type of Finding Material Weakness and Material Noncompliance Questioned Costs $110,075 Criteria: Per Federal regulation, 2 CFR 200.403(a), for costs to be allowable, they must be necessary and reasonable for the performance of the federal award. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office receives ESF funds under the Elementary and Secondary School Emergency Relief (ESSER) portion of the grant. Under this grant, the office recorded expenditures for payments to schools twice for the same transaction. Staff made correcting journal entries intended to reverse duplicate transactions. However, the entries re-recorded the expenditures rather than eliminating them. Because the office requests federal reimbursement based on recorded expenditures, the federal government paid the same costs twice. Questioned Costs: Based on the journal that duplicated costs, we question costs of $110,075. Context: The office accrued payments to three schools related to school expenditures for the ESSER grant. They then paid the schools and reversed the accrual, which is the expected sequence of journal entries. However, a subsequent journal entry described as a reversal, instead recorded the expenditures a second time. Effect: The office is not in compliance with federal regulations, resulting in questioned costs of $110,075. Cause: Internal controls were not sufficient to prevent the office from recording the same expenditures twice. The reversal journals were completed by two separate accountants and the reviewer of the journals did not notice they were duplicate. Recommendation: We recommend the Office of Public Instruction: A. Strengthen internal controls to ensure costs are recorded only once. B. Ensure all transactions submitted for federal reimbursement reflect actual costs incurred on the federal award. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-072 Federal Program Name Education Stabilization Fund (ESF) (COVID 19) Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.425D and 84.425U Grant # S425D200006, S425U210006, S425D210006 Compliance Requirement F. Equipment and Real Property Management M. Subrecipient Monitoring N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation 2 CFR 200.313(c)(1) requires prior approval from the federal government or the pass-through entity (the office), before equipment is purchased. Federal regulation, 2 CFR 200.439(b)(1) requires capital expenditures to be pre-approved by the federal government or pass-through entity. Federal regulation, 2 CFR 176.190(a) requires laborers and mechanics employed by contractors and subcontractors on projects funded directly with federal funds to be paid prevailing wages. Federal regulation, 2 CFR 200.332(e) requires the office to monitor the activities of subrecipients (schools) to ensure the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office receives ESF funds under the Elementary and Secondary School Emergency Relief (ESSER) portion of the grant. The office reimbursed Local Education Agencies (LEAs), which are generally schools or school districts, that included equipment and construction costs. The office did not have adequate controls to ensure compliance with federal regulations, such as preapproval for equipment and construction projects or that schools paid the prevailing wage rate. Additionally, monitoring tools used to ensure subrecipients complied with federal regulations were not always obtained or reviewed adequately to ensure they were fully completed. Context: In fiscal years 2024 and 2025, the office paid over $230 million to schools based on reimbursement requests. We designed a randomly selected a non-statistical sample of 60 items to test controls and 40 items to test allowability out of 3,062 LEA cash requests. We tested the first 20 items and found one or more exceptions for the different required attributes tested. Associated expenditures for these exceptions ranged from approximately $6,000 to over $420,000. Attributes tested included existence of preapproval form for equipment or construction projects, actual approval of the items, acknowledgment of prevailing wage requirements, and existence and completion of a self-assessment tool used to monitor subrecipients. As part of our testing of subrecipients, we also noted three schools with Single Audit reports that contained prevailing wage rate findings in their 2024 audit reports. Based on this error rate, we concluded there was a material weakness and material noncompliance and did not test the remaining sample items. Because we did not identify any equipment or construction that was unallowable per grant regulations, we did not question any costs. Repeat Finding: Recommendation part C of Single Audit finding 2023-032 from the audit for the two fiscal years ended June 30, 2023, is related to the monitoring of subrecipients for compliance with construction and equipment requirements. Effect: Controls were not adequate to ensure the office complied with federal regulations related to subrecipient monitoring or that schools complied with federal regulations. The office is not in compliance with federal regulations. Cause: The office required schools to complete various forms, such as a self-assessment form to ensure compliance with all ESSER federal requirements and a preapproval form if they used ESSER funds for large equipment items or construction items. While these required schools to certify they were aware of and followed prevailing wage rate requirements, it was not adequate to ensure they did. Additionally, while most schools received the self-assessment form, staff did not adequately review it or follow up to ensure all questions were answered. Because the ESSER grant program has ended, no staff members who worked on this portion of the grant were available to explain why the forms were not approved or why the self-assessments were not fully completed. Recommendation: We recommend the Office of Public Instruction: A. Enhance internal controls over monitoring to ensure subrecipients are complying with all requirements, including that construction and equipment purchases are preapproved and federal regulations related to the prevailing wage rate are followed. B. Monitor subrecipients’ compliance with construction and equipment requirements, including reviewing wage certifications for construction projects, as required by federal regulations. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-038 Federal Program Name Coronavirus State and Local Fiscal Recovery Funds (COVID-19) (SLFRF) Federal Awarding Agency U. S. Department of the Treasury State Agency Department of Administration (department) ALN # 21.027 Grant # SLFRP1747 Compliance Requirement I. Procurement, Suspension and Debarment Type of Finding Material Weakness Questioned Costs No questioned costs identified Federal Program Name Epidemiology and Laboratory Capacity for Prevention and Infectious Diseases (ELC) (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services State Agency Department of Administration (department) and Public Health and Human Services (PHHS) ALN # 93.323 Grant # NU50CK000500 Compliance Requirement I. Procurement and Suspension and Debarment Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacks internal controls to demonstrate that all contractors were verified as not suspended or debarred from receiving federal funds at the time of contract award. Context: Federal procurement rules require the department to verify that contractors awarded federally funded contracts are not suspended or debarred, and to retain documentation of those checks. Of the department’s 20 SLFRF contracts, the department could not provide suspension and debarment evidence for 14 SLFRF consultant and design-related contracts. Eleven of those SLFRF contracts were originally awarded using state funds, where no suspension and debarment check was required at award. However, the department did not conduct a review when the funding source changed to federal where the check is required. The remaining three contracts had no record of a suspension and debarment check at all. The department also manages construction for all agencies of the state, including a project for the ELC grant administered by PHHS. Of the two judgmentally selected construction contracts we tested for the ELC grant, the department could not provide the suspension and debarred certification form for one. Our audit work confirmed that the 20 SLFRF and 2 ELC contractors tested were not suspended or debarred, therefore no noncompliance was identified. Effect: Without documentation, the Department of Administration cannot demonstrate that it verified contractors’ suspended or debarred status before the award. This creates a risk that federally prohibited entities receive contract awards. Cause: The Department of Administration had no policy requiring suspension and debarment documentation for consultant-type contracts. Additionally, no control existed to track when federal funding was added to existing contracts, so contracts that predated those additions were not reviewed at the time of the change. Although the Department of Administration later asserted that documentation was maintained in the state’s contract management and procurement system, no evidence was provided for the audit period. Recommendation: We recommend the Department of Administration establish and implement internal controls to ensure suspension and debarment checks are performed and documented for all contracts funded with federal funds, including when a contract's funding source changes from state to federal. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-075 Federal Program Name (COVID-19) Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.323 Grant # NH23IP922574, NU50CK000409, NU50CK000500, NU51CK000366, NUE2EH001420 Compliance Requirement B. Allowable Costs/Cost Principles M. Subrecipient Monitoring Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: In general terms, the ELC grant helps the department find, track, and stop the spread of infectious diseases. The department was awarded specific funding under the grant for the detection and mitigation of COVID-19 in confinement facilities. Under this specific funding, the department entered into a Memorandum of Understanding (MOU) with the Montana Department of Corrections. The department obtained federal approval to change the budget of the project, however an updated MOU could not be located and costs not allowed under the approved MOU were reimbursed. The MOU has since expired, ending on July 31, 2024. Context: The department entered into an MOU with the Montana Department of Corrections. The MOU stated it could not be "enlarged, modified, or altered except upon written agreement signed by the Parties" and that the agency "must use the grant funds only in accordance with the approved budget." The department reimbursed the Department of Corrections for transport vehicles that exceeded the budgeted amounts and for a data warehouse contract that was not included in the MOU budget. While the department sought and received approval from the federal government for these changes, an updated MOU could not be located. Costs paid to the Montana Department of Corrections are not supported by the MOU. Adequate internal controls are necessary to ensure all applicable documents are updated when changes to the grant occur. Effect: By paying costs outside of the MOU, the department paid costs of $200,296, that while approved at the federal level, were outside of the written agreement with Montana Department of Corrections. In the event costs would need to be returned the federal government, the department would be the party responsible. Cause: One department employee was solely responsible for maintaining project files related to the MOU. When that employee left the position, she did not save or transfer relevant records, leaving insufficient documentation for the remaining staff. Recommendation: We recommend that Montana Department of Public Health and Human Services strengthen internal controls to ensure project documentation is maintained in a shared, accessible location so that staff can retrieve required records regardless of personnel changes. Views of Responsible Officials: The department concurs with the recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-076 Federal Program Name Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.323 Grant # NH23IP922574, NU50CK000409, NU50CK000500, NU51CK000366, NUE2EH001420 Compliance Requirement I. Procurement and Suspension and Debarment M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.332(a), (c) and (e) requires non-Federal entities to verify that subrecipients are not excluded or disqualified in SAM.gov, evaluate each subrecipient’s fraud risk and risk of noncompliance, and monitor the activities of a subrecipient to ensure the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the award. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked adequate internal controls to meet federal requirements for conducting risk assessments, verifying debarment and suspension status, and conducting financial and performance monitoring procedures for all of its grants. As a result, the department did not comply with federal regulations. Context: The department awards grants under the ELC program for activities such as wastewater surveillance and support to counties and schools during the COVID-19 pandemic. We tested a nonrandom, nonstatistical sample of 40 of 458 subrecipients that received ELC funds during the audit period. Testing revealed that the department lacked documentation of its control process over subrecipient monitoring for all subrecipients, most of which were grants awarded to counties and health care facilities for COVID-19 pandemic assistance. Based on the department’s internal control processes, for a subrecipient to be adequately monitored, we expected the department to provide the following for each subrecipient: • risk assessment for subrecipients receiving over $50,000 • certification that the subrecipient had not been suspended or debarred • task order, contract, or grant agreement which included required disclosures • approved invoices • approved Acquisition Planning and Implementation form • subrecipient monitoring checklist which included both financial and performance reviews of the subrecipient. For two entities in our sample, the department did not use their subrecipient monitoring checklist or have other controls in place for monitoring. We also noted 13 grants where there was no risk assessment documentation and 17 where there was no verification the subrecipient was not debarred or suspended. A risk assessment is necessary to ensure the proper level of monitoring is put in place for each entity. Although many of these grants are smaller amounts individually, approximately $1.5 million was spent in fiscal year 2024 and 2025 for the subrecipients tested indicating some monitoring procedures should still be in place for all entities. Repeat Finding: Montana’s Single Audit for the two fiscal years ended June 30, 2023, included findings 2023-053 and 2023-055 related to internal controls over and compliance with completing subrecipient risk assessments and conducting post-award monitoring, respectively. These issues were also reported in Montana’s Single Audit for the two fiscal years ended June 30, 2021, as 2021-052 over subrecipient disclosures, and 2021-062 and 2021-054, both of which addressed adequately monitoring and properly reimbursing subrecipients. Prior audit findings 2023-053 and 2023-055 have not been fully implemented. The department did fully implement the recommendation related to subrecipient disclosures. Effect: The department is not in compliance with federal subrecipient monitoring requirements for many ELC-funded grants, which totaled around $2.4 million in awards during the audit period. This increases the risk of awarding funds to debarred entities or high-risk subrecipients without implementing monitoring procedures to ensure federal funds are spent in accordance with regulations. Cause: The department partially implemented prior audit recommendations for county grants but did not have sufficient time to fully resolve all identified issues before the current audit period started. Some of the grants were awarded through a grant application platform that had no process for completing debarment verifications. If the department continues to operate under their new control processes this recommendation should be resolved. Recommendation: We recommend the Department of Public Health and Human Services: A. Continue to follow its improved process to ensure subrecipient monitoring processes are completed and documented for each ELC subrecipient. B. Conduct and document risk assessments for all subrecipients and verify and document that subrecipients are not debarred or suspended prior to awarding funds. C. Perform monitoring procedures to confirm subrecipients comply with grant requirements, as required by federal regulations. Views of Responsible Officials: The department concurs with the recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-077 Federal Program Name Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services (HHS) State Agency Department of Public Health and Human Services (department) ALN # 93.323 Grant # NU50CK000500, NU51CK000366, NUE2EH001420 Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a)(1) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity. The report must be submitted no later than the end of the month following the month in which the obligation is made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2024 and 2025, the department's internal controls were insufficient to ensure all ELC obligations of $30,000 or more were accurately and completely reported to the FFATA reporting system. Required obligations were not reported as required by federal regulation, and the department overreported other obligation amounts. Context: We reviewed all obligations reported during the audit period against obligations made through subaward agreements and amendments to subrecipient agreements. The department obligated approximately $1.2 million in ELC funds under one federal award to 44 subrecipients subject to FFATA reporting requirements. Based on our review of the subrecipient contracts and amendments provided, 22 FFATA reports should have been filed; instead, 183 were filed across three federal awards. Of the 183 reports filed, only 5 matched current audit period obligations. Two overreported obligations; one by $68,074.90 and the other by $36,566.67. As the department indicated it was working during the audit period to correct prior-year errors, we also compared current-year reports to prior-year recommendation support. We identified 2 FFATA reports matching prior-year errors. Both were reported with amounts overreported by $892,294. This is evidence the department has not properly addressed the prior audit finding. The number of instances and corresponding dollar amounts for the reporting errors discussed are summarized in the following table. We did not test timeliness of the reports submitted and matched to current-year or prior-year subawards due to the column in Sam.gov data changing upon transaction modification. While the department provided subaward agreements for 44 entities presented as subrecipients, we determined that 11 were not subrecipients and that the department had not provided subawards for an additional 22 subrecipients. This further supports that the department's controls over subrecipient identification for FFATA reporting are insufficient to ensure complete and accurate reports. Our analysis was conducted using FFATA reporting system data as of July 2025. We considered each transaction submitted, or omitted, by the department and compared information against executed subaward agreements from the audit period, as provided by the department. Any corrections the department made during fiscal year 2026 were not considered in our testing for this audit but will be considered during the fiscal year 2026 audit. We did not provide our detailed analysis to the department. However, we believe the department has all necessary information in its possession, such as the FFATA reporting system data and its issued and amended subawards, to ensure necessary corrections are made to the FFATA reporting system. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2021, included finding #2021-066, and the report for the two fiscal years ended June 30, 2023, included finding #2023-069. Both findings recommended the department enhance internal controls over FFATA reporting and submit reports for the ELC program as required by federal regulation. Effect: The department is not in compliance with FFATA reporting requirements. Insufficient internal controls resulted in missing and inaccurate subaward reporting. FFATA reporting provides transparency to federal grantor agencies and the public. The errors identified could mislead users of the reported data. Cause: The department uses a central contracting system to capture obligations, which includes both subrecipient and contractor relationships. The system is used to process payments and identify which obligations require FFATA reporting. However, information entered into the system did not distinguish between contractor and subrecipient relationships, was not consistently accurate, and was not always entered at the time of obligation. Department personnel responsible for FFATA reporting indicated they are working with federal program staff to implement process changes to ensure FFATA reports are captured accurately and timely for subrecipients only. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure accurate and complete submission of FFATA reports for the Epidemiology and Laboratory Capacity for Infectious Diseases program. B. Submit FFATA reports for the Epidemiology and Laboratory Capacity for Infectious Diseases program in accordance with federal regulations. Views of Responsible Officials: The department partially concurs with the recommendation. The department agrees that internal control deficiencies existed in its FFATA subaward reporting processes during FY24-FY25 and that instances of noncompliance existed. The department disagrees with the quantified extent of exceptions because they have been unable to replicate the numbers and dollars presented in the finding context and they believe the auditor has not provided sufficient detail to address the identified errors. The department also points to ongoing processes to identify and correct duplicate and inaccurate records. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. While the department agrees with the need to improve internal controls and errors in FFATA reporting, management disagrees with the auditor’s quantification of the errors. We believe management has sufficient detail to address the finding because it has access to its subaward agreements as well as the information currently available in the federal FFATA reporting system. As such, our recommendation stands.

Finding 2025-029 Federal Program Name Formula Grants for Rural Areas and Tribal Transit Program (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.509 Grant # MT-2018-011, MT-2020-003, MT-2020-013, MT-2022-019, MT-2022-022, MT-2023-004, MT-2023-005, MT-2023-011, MT-2024-009, MT-2024-012, MT-2024-015, MT-2024-018, MT-2025-005, MT-2025-006 Compliance Requirement M. Subrecipient Monitoring Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not effectively design controls to assess subrecipients' risk of noncompliance. Context: The department uses a risk assessment template, incorporating factors suggested by federal regulation, to evaluate each subrecipient's risk of noncompliance. When a risk factor does not apply to a subrecipient, department staff mark it as "not applicable" and score it the same as a factor that actively reduces risk, even though it does not. For example, the template includes a factor for whether a subrecipient receives a Single Audit. A Single Audit reduces noncompliance risk by providing additional monitoring. If a subrecipient is not required to have a Single Audit, staff mark the item "not applicable" and score it as if an audit had occurred, even though no additional monitoring took place and the risk was not actually reduced. Repeat Finding: The Single Audit for the two fiscal years ended June 30, 2023, included related finding #2023-014. That finding recommended the department enhance internal controls for subrecipient monitoring, perform and document subrecipient risk assessments, and conduct enhanced monitoring in response to higher assessed risk levels. Effect: The department’s scoring method caused subrecipients to appear lower risk than they actually were, which may have led the department to conduct fewer monitoring activities than warranted. The impact was greatest for new or for-profit subrecipients, since more risk factors tend to be marked "not applicable" for those entities. Cause: Staff misunderstood certain risk assessment elements and completed the assessments incorrectly as a result. The department independently identified the issue and has already begun revising the risk assessment template for the next grant year. Recommendation: We recommend the Montana Department of Transportation continue to strengthen internal controls to ensure accurate risk assessments for each subrecipient by revising its risk assessment form to reduce a subrecipient's risk score only for factors that genuinely reduce the risk of undetected material noncompliance with federal statutes, regulations, and subaward terms and conditions. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-030 Federal Program Name Formula Grants for Rural Areas and Tribal Transit Program (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.509 Grant # MT-2018-011, MT-2020-003, MT-2020-013, MT-2022-019, MT-2022-022, MT-2023-004, MT-2023-005, MT-2023-011, MT-2024-009, MT-2024-012, MT-2024-015, MT-2024-018, MT-2025-005, MT-2025-006 Compliance Requirement M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.332, requires pass-through entities to, among other things, monitor subrecipient activities to ensure subaward funds are used for authorized purposes. This includes issuing a management decision for any audit finding related to the Federal award the pass-through entity provided to the subrecipient. Federal regulation, 2 CFR 200.521, requires that management decisions clearly state whether the audit finding is sustained, the reasons for the decision, and the expected corrective action. If the subrecipient has not completed corrective action, the decision must include a follow-up timetable. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Department controls to verify that subrecipients are audited were insufficient to detect when subrecipients required a Single Audit due to grants from multiple sources. The department also did not comply with federal management decision requirements regarding subrecipient audit findings. Context: The department monitors subrecipient Single Audits across all of its programs by obtaining audit reports from the Federal Audit Clearinghouse and evaluating grant payments it made to subrecipients. However, this process does not account for federal funds a subrecipient may have received directly from the federal government or from other pass- through entities. As a result, the department's process cannot reliably determine whether a subrecipient meets the Single Audit threshold. During the audit, auditors identified a for-profit subrecipient that received minimal grant payments from the department but also received federal subgrants from two other state pass-through entities. That subrecipient's total federal awards were approximately $1.8 million, exceeding the Single Audit threshold. Although federal regulations do not require for-profit subrecipients to obtain a Single Audit, this case demonstrates that the department's internal data alone is not sufficient to assess a subrecipient's Single Audit requirements. Reliable external data sources are available to the department, including USASpending.gov and SAM.gov for federal fund obligations, Montana and other states' government transparency websites, and direct inquiries to subrecipients. After auditors brought this issue to the department's attention, the department began revising its Single Audit monitoring process. Auditors also identified one subrecipient Single Audit report with a finding related to the Formula Grants for Rural Areas program. The department's central Single Audit review process monitors findings, but the department's response did not include the required elements of a management decision. Instead of formally accepting or rejecting the subrecipient's planned corrective action, the department only reviewed subsequent audit reports to check whether the deficiency had been corrected. Effect: The department may fail to identify all subrecipients required to obtain a Single Audit. Single Audits are an important monitoring tool for pass-through entities; without them, material noncompliance at the subrecipient level may go undetected. The department may also put federal grant money at risk by continuing to provide assistance to organizations with known, unresolved deficiencies. Without a formal management decision, the department does not take an active role in resolving subrecipient deficiencies. Timely communication of acceptance of the subrecipient’s corrective action is necessary to resolve deficiencies promptly. Without it, subrecipient control weaknesses and federal noncompliance are likely to persist longer. Cause: The department relied solely on internal data to assess whether subrecipients met the Single Audit threshold, but the information needed to make that determination is not always held internally. While the department reviews Single Audit reports centrally and notifies program staff of relevant findings, it does not issue a formal management decision to the subrecipient that includes the elements required by federal regulations. The department's process is not formally documented, creating gaps in compliance. Recommendation: We recommend that the Montana Department of Transportation: A. Incorporate external data sources when evaluating whether subrecipients meet Single Audit requirements. B. Formalize the subrecipient Single Audit review process by defining roles and responsibilities for complying with federal monitoring regulations. C. Issue formal management decisions to subrecipients that include all elements required by federal regulation. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-031 Federal Program Name Formula Grants for Rural Areas and Tribal Transit Program (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.509 Grant # MT-2018-011, MT-2020-003, MT-2020-013, MT-2022-019, MT-2022-022, MT-2023-004, MT-2023-005, MT-2023-011, MT-2024-009, MT-2024-012, MT-2024-015, MT-2024-018, MT-2025-005, MT-2025-006 Compliance Requirement F. Equipment and Real Property Management Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.313(e), requires grant recipients to request disposition instructions from the federal awarding agency when equipment acquired under a federal award is no longer needed for its original purpose. Federal regulation, 2 CFR 200.313(d)(2), requires a physical inventory of equipment acquired under a federal award, with results reconciled against property records, at least every two years. Federal regulation, 2 CFR 200.313(d)(4), requires regular maintenance procedures to ensure equipment acquired under a federal award remains in proper working condition. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department's controls were insufficient to ensure equipment inventory was conducted completely and accurately. As a result, not all subrecipient equipment was disposed of as required by federal regulation, and the department's equipment records were inaccurate. Context: The department conducts a physical inventory of all subrecipient vehicles acquired with federal awards every two years. During the audit period, the department reconciled inventory results with property records and identified discrepancies but did not follow up to determine what happened to missing vehicles and did not update property records to reflect the inventory results. The department also conducted safety inspections during the physical inventory but did not confirm that vehicles with critical safety failures were repaired before returned to service. Subrecipients are required to report quarterly to the department on vehicle use; if a vehicle was not used, the subrecipient must explain why. We followed up on five vehicles at two subrecipients that were not located during the physical inventory. Each vehicle originally cost between $50,000 and $135,000. Quarterly reports showed all five vehicles were reported as not in operation for 10 to 13 consecutive quarters, yet none were listed as disposed of in property records. One subrecipient reported that the vehicles had been scrapped for parts. The department's controls did not detect the need for disposal and therefore never provided disposal instructions. Effect: The department's equipment property records are inaccurate. There is also a risk that proceeds from the disposal of federally funded vehicles are owed to the Federal Transit Administration but have not been remitted. Cause: The department was short-staffed during the audit period, causing vehicle disposals to become backlogged. With fewer resources to proactively detect when disposals were needed, the department relied on subrecipients to request disposal instructions themselves. Recommendation: We recommend the Montana Department of Transportation: A. Strengthen internal controls to detect when subrecipients have disposed of or are no longer actively using equipment acquired under the Formula Grants for Rural Areas federal program. B. Provide disposal instructions to subrecipients for all equipment acquired under the Formula Grants for Rural Areas federal program when it is no longer used for the program, as required by federal regulation. C. Update property records to reflect the results of equipment inventories, as required by federal regulation. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-033 Federal Program Name Formula Grants for Rural Areas and Tribal Transit Program (COVID-19) Federal Awarding Agency U. S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.509 Grant # MT-2018-011, MT-2020-013, MT-2022-019, MT-2023-004, MT-2023-005, MT-2024-018, MT-2025-006 Compliance Requirement I. Procurement and Suspension and Debarment Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 180.300, requires grant recipients to verify that an entity is not excluded or disqualified before entering into a covered transaction with that entity. Federal regulation, 2 CFR 200.334, requires grant recipients to retain all records related to a federal award for three years after submitting the final expenditure report. Records for federally funded equipment must be kept for three years after final disposition. State procurement policy requires agencies to maintain a complete procurement record to support compliance and auditing. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacks documentation showing it verified that vehicle suppliers were not suspended or debarred before entering into contracts. Context: The department uses term contracts with vehicle suppliers, issuing purchase orders off the master contract as needed throughout the contract period. Procurement staff follow a checklist that includes verifying a supplier is not suspended or debarred, and the department expected staff to save that verification in the procurement file. However, during the audit period the department did not document checklist completion and the department did not require a secondary review for compliance with federal requirements. We requested suspension and debarment verification documentation for two master contracts, two master contract amendments, and three purchase orders. The department could not provide contemporaneous documentation for any of the seven contracts. We confirmed that none of the contracted entities were suspended or debarred. The three purchase orders included a clause in which the supplier certifies it is not suspended or debarred, which is an allowable method of verification. However, neither the master contracts nor their amendments contained this clause. Effect: The department has no documentation confirming it verified whether vehicle suppliers were excluded or disqualified before entering into covered transactions. Without that verification, the department risks contracting with an entity ineligible to receive federal funds. Cause: The department attributes the missing documentation to a single employee who did not save verification records. That employee is no longer with the department, and the department's review found that other procurement staff appropriately document their verifications. Recommendation: We recommend the Montana Department of Transportation: A. Strengthen internal controls to ensure compliance with suspension and debarment verification requirements is documented and retained for all transit vehicle procurements. B. Document verification of exclusion or disqualification status for all covered transactions involving transit vehicles, as required by federal regulation. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-034 Federal Program Name Formula Grants for Rural Areas and Tribal Transit Program (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.509 Grant # MT-2018-011, MT-2020-003, MT-2020-013, MT-2022-022, MT-2023-004, MT-2023-005, MT-2023-011, MT-2024-009, MT-2024-015 Compliance Requirement M. Subrecipient Monitoring Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s controls were insufficient to communicate federal subaward requirements to subrecipients on time, preventing the department from ensuring federal awards were used in accordance with federal requirements. Context: The department relies on signed subaward agreements to communicate requirements to subrecipients, including eligible activities, reporting requirements, and applicable federal and state grant requirements. These agreements are typically signed before the subgrant period of performance begins, which coincides with the state fiscal year (SFY). The SFY 2024 subaward agreements, covering the period beginning July 1, 2023, were not signed on time. We reviewed three agreements for SFY 2024 operating assistance during audit planning and found that all three were signed between December 20, 2023, and February 11, 2024. The subgrant period was more than halfway over before requirements were formally communicated to subrecipients. Although the department withheld grant payments until agreements were signed, it still required subrecipients to submit quarterly reimbursement reports for October 2023 activity. The department reviewed and approved those reports before agreements were in place. We do not take issue with the department's decision to withhold payment. We consider it the best available option under the circumstances, even though it resulted in technically late payments under federal regulation. However, the department should have had signed agreements in place before the subgrant period began. Effect: Most subrecipients are small, rural transit providers that depend on federal funds to operate and pay employees. Because subaward agreements were not in place on time, the department could not make timely payments, delaying subrecipient reimbursements by up to three months. Approximately 37 subrecipient payments were delayed, ranging from $1,500 to $400,000. Additionally, the department reviewed quarterly reports for allowable activities and costs before those requirements had been formally communicated or agreed to in a signed subaward agreement. This means subrecipients were held to requirements they may not have been aware of, increasing the risk that ineligible activities could be reimbursed. Cause: The department's subaward agreement template was undergoing significant revision and legal review to streamline the payment process and establish clear deadlines for subrecipients. The review took longer than expected, and the updated template was not ready before the subgrant period of performance began. Recommendation: We recommend the Montana Department of Transportation strengthen internal controls to ensure all requirements imposed on subrecipients are clearly communicated before the period of performance begins. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-035 Federal Program Name Formula Grants for Rural Areas and Tribal Transit Program (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.509 Grant # MT-2018-011, MT-2020-003, MT-2020-013, MT-2022-022, MT-2023-004, MT-2023-005, MT-2023-011, MT-2024-009, MT-2024-015 Compliance Requirement B. Allowable Costs/Cost Principles M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs $ 170,922 Criteria: Federal regulation, 2 CFR 200.403, requires that costs charged to a federal award be necessary, reasonable, adequately documented, and consistent with the cost principles in 2 CFR 200 Subpart E. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not have adequate controls to ensure subrecipient costs charged to the Formula Grants for Rural Areas program were properly documented, resulting in payments that did not conform to federal cost principles. Questioned Costs: We identified $170,922 in known questioned costs. We questioned all project costs that appeared potentially unallowable or lacked adequate documentation based on the subrecipient’s descriptions. Of the total, $28,368 relates to nonprofit subrecipients and $142,553 relates to for-profit subrecipients. Because this was a systemic issue, additional questioned costs likely exist in reports we did not review. Context: Subrecipients report project costs to the department in quarterly financial reports, which staff review before approving reimbursement. We tested a random, nonstatistical sample of 40 of 280 nonprofit financial reports and 6 of 24 for-profit financial reports, focusing on costs that appeared potentially unallowable, miscategorized, or relatively significant in dollar amount. The sample identified inadequate documentation in five nonprofit reports and four for-profit reports. The following cost types lacked sufficient documentation to determine compliance with federal cost principles: Effect: Without adequate cost documentation, the department may have reimbursed unallowable costs with federal grant funds. Insufficient oversight also increases the risk that fraudulent expenses could be approved for payment. Cause: During the audit period, the department was short-staffed and a single employee reviewed all subrecipient financial reports. Subrecipient follow-up was handled by email or phone, and records of those communications were not retained with supporting documentation. The department began requiring subrecipients to submit supporting documentation with their financial reports in state fiscal year 2025. Recommendation: We recommend that the Montana Department of Transportation: A. Strengthen internal controls to ensure only allowable subrecipient costs are reimbursed. B. Require and retain documentation sufficient to demonstrate that subrecipient costs comply with federal cost principles. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-090 Federal Program Name Foster Care – Title IV-E (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services (HHS) State Agency Department of Public Health and Human Services (department) ALN # 93.658 Grant # 2001MTFOST, 2101MTFOST, 2201MTFOST, 2301MTFOST, 2401MTFOST, 2501MTFOST Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a)(1) and (a)(2)(ii), requires non-federal entities to report each subaward obligation of $30,000 or more to the Federal Funding Accountability and Transparency Act (FFATA) reporting system no later than the end of the month following the month the obligation is made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2024 and 2025, the department's internal controls were not sufficient to ensure Foster Care obligations of $30,000 or more were accurately and completely reported to the FFATA reporting system. As a result, required obligations were not reported, and some obligation amounts were over-reported. Context: We reviewed all obligations reported during the audit period and compared them to subaward agreements and amendments provided by the department. The department reported to us that they had awarded approximately $3 million in Foster Care obligations under three federal awards to 9 subrecipients. Based on those initial agreements and subsequent amendments, 21 FFATA reports should have been filed; however, 167 reports were filed across six federal awards. Of the 167 reports: • 17 matched current audit period obligations • 6 were reported with inaccurate amounts • 1 was reported under the wrong Federal Award Identification Number (FAIN) As the department indicated it was working during the audit period to correct prior-year errors, we also compared current-year reports to the prior-audit recommendation support. Current-year data did not match prior-year support. Subaward numbers from prior-year work were compared to current-year reported subaward numbers and no matches were found. The number of instances and corresponding dollar amounts for the reporting errors discussed are summarized in the following table. We did not test timeliness of the reports submitted and matched to current-year or prior-year subawards due to the column in Sam.gov data changing upon transaction modification. The department provided subaward agreements for 9 entities, but auditors identified 13 subrecipients across the audit period. For fiscal year 2024, the department provided agreements for 2 entities while auditors identified 7 subrecipients. For fiscal year 2025, the department provided agreements for 8 subrecipients while auditors identified only 6. This suggests the department is both missing required FFATA reports and filing reports for agreements not subject to the requirement. Our analysis was conducted using FFATA reporting system data as of July 2025. We considered each transaction submitted, or omitted, by the department and compared information against executed subaward agreements from the audit period, as provided by the department. Any corrections the department made during fiscal year 2026 were not considered in our testing for this audit but will be considered during the fiscal year 2026 audit. We did not provide our detailed analysis to the department. However, we believe the department has all necessary information in its possession, such as the FFATA reporting system data and its issued and amended subawards, to ensure necessary corrections are made to the FFATA reporting system. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2021, included finding #2021-065, and the Single Audit for the two fiscal years ended June 30, 2023, included finding #2023-070, both recommending enhanced internal controls over FFATA reporting and submit reports for the Foster Care program as required by federal regulation. Effect: The department is not in compliance with FFATA reporting requirements. Inadequate internal controls resulted in unreported and inaccurate subaward reporting. FFATA reporting provides transparency to federal grantor agencies and the public. The errors identified could mislead users of FFATA data. Cause: The department uses a central contracting system to capture contract obligations, which include both subrecipient and contractor relationships. The system is used to process payments and identify which agreements require FFATA reporting. However, information entered into the system did not distinguish between contractor and subrecipient relationships, was not consistently accurate and was not always entered at the time of obligation. Department personnel responsible for FFATA reporting indicated they are working with federal program staff to implement process changes to ensure FFATA reports are filed only for subrecipients and are accurate and timely. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure accurate and complete submission of FFATA reports for the Foster Care – Title IV-E program. B. Submit FFATA reports for the Foster Care – Title IV-E program in accordance with federal regulations. Views of Responsible Officials: The department partially concurs with the recommendation. The department agrees that internal control deficiencies existed in its FFATA subaward reporting processes during FY24-FY25 and that instances of noncompliance existed. The department disagrees with the quantified extent of exceptions because they have been unable to replicate the numbers and dollars presented in the finding context and they believe the auditor has not provided sufficient detail to address the identified errors. The department also points to ongoing processes to identify and correct duplicate and inaccurate records. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. While the department agrees with the need to improve internal controls and errors in FFATA reporting, management disagrees with the auditor’s quantification of the errors. We believe management has sufficient detail to address the finding because it has access to its subaward agreements as well as the information currently available in the federal FFATA reporting system. As such, our recommendation stands.

Finding 2025-091 Federal Program Name Foster Care - Title IV-E (COVID-19) Federal Awarding Agency U.S. Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.658 Grant # 2401MTFOST, 2501MTFOST Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles Type of Finding Significant Deficiency Questioned Costs $63,876 Criteria: Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department reimburses subrecipients for Foster Care program administration and training expenditures. Department staff review subrecipient documentation before issuing reimbursements. In fiscal year 2024, a miscalculation was not detected through staff reviews, resulting in an overpayment to a subrecipient. Questioned Costs: Because costs were not supported, we question $63,876 in Foster Care reimbursements in fiscal year 2024 based on the mathematical error on the invoice. Context: We tested a nonstatistical random sample of 23 out of 222 transactions involving payments to subrecipients administering Title IV-E programs. One transaction included a mathematical error. This was an isolated incident. Repeat Finding: This is a repeat finding. Montana’s Single Audit reports for the two fiscal years ended June 30, 2023, finding #2023-057; for the two fiscal years ended June 30, 2021, finding #2021-061; and for the two fiscal years ended June 30, 2019, finding #2019-017 contained findings related to the allowability of subrecipient expenditures. Effect: The department's controls did not detect the calculation error before reimbursing the subrecipient, resulting in $63,876 in questioned costs in fiscal year 2024 and noncompliance with federal regulations. Cause: Per department personnel, the identified error was a mistake that was not caught by the department’s review of the supporting documentation submitted by the subrecipient. However, the department implemented new control procedures in fiscal year 2025 and no similar issues were identified in that time period. If the department continues to operate under its new procedures, this recommendation should be resolved. Recommendation: We recommend the Department of Public Health and Human Services continue applying its improved internal control procedures by consistently reviewing and approving subrecipient payment transactions in order to ensure the allowability of the reimbursements. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-092 Federal Program Name Foster Care - Title IV-E (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.658 Grant # 2401MTFOST, 2501MTFOST Compliance Requirement M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 45 CFR 75.352(b), requires the department to evaluate each subrecipient's risk of noncompliance with federal statutes. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal year 2024, the department did not have controls in place to assess the risk of subrecipient noncompliance with federal regulations. Context: Subrecipients of the department’s Foster Care program include tribal governments and institutions of higher education. During fiscal years 2024 and 2025, department subrecipients expended approximately $2.6 and $1.2 million, respectively. However, in fiscal year 2024, the department did not assess subrecipient risk to determine the appropriate level of monitoring required. The department implemented a new risk assessment process for fiscal year 2025. Repeat Finding: Montana’s Single Audit report for the two fiscal years ended June 30, 2023, contained finding 2023-056 related to internal controls over and compliance with completing subrecipient risk assessments and communicating required subrecipient disclosures. For fiscal years 2024 and 2025, the department communicated the required subrecipient disclosures. Assessing risk of subrecipient noncompliance was still an issue for fiscal year 2024, rendering the recommendation partially implemented. Effect: Without controls in place to assess risk over subrecipients, the department was not in compliance with federal subrecipient monitoring requirements for fiscal year 2024. Without assessing risk, the department could not determine the appropriate level of oversight for each subrecipient. Cause: The department did not implement the required control until partway through the audit period, as it was responding to a prior audit recommendation. If the department continues to follow the new process, this issue should be resolved. Recommendation: We recommend the Department of Public Health and Human Services: A. Continue to utilize its new internal control procedures for assessing risk of subrecipient noncompliance with federal regulations, and B. Assess the risk of noncompliance for each subrecipient. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-025 Federal Program Name Highway Planning and Construction (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.205 Grant # Various Compliance Requirement I. Procurement and Suspension and Debarment Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 23 CFR 172.7(a)(1)(v), requires agencies to document contract negotiations, including developing an independent cost estimate before receiving the consultant's cost estimate and documenting the resources used to analyze costs. Federal regulation, 2 CFR 200.214 and 23 CFR 172.7(b)(3), require agencies to verify the suspension, debarment, and eligibility status of consultants and subconsultants before entering into a contract. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not design controls to ensure it procured engineering and design-related consultant services in compliance with federal requirements during state fiscal years 2024 and 2025, resulting in noncompliance. Context: During audit planning, we reviewed procurement documentation for four engineering consultant contracts and found: • The department did not document that it verified suspension, debarment, and eligibility status before executing any of the four contracts. • For two contracts, the department did not document that it developed its cost estimate before receiving the consultant's cost estimate. • For the other two contracts, the department documented that it actually received the consultant's cost estimate first. • For two contracts, the department did not document the sources used to develop its cost estimate. We independently verified that all four contractors were not suspended or debarred. Because we identified errors in planning, we were not required to test additional consultant contracts. Effect: The department's control weaknesses resulted in noncompliance with federal regulations. The department also faces risk of contracting with an ineligible entity or paying more in federal funds than necessary due to a flawed negotiation process. Cause: The department's contract management software requires staff to affirm they verified a consultant's suspension, debarment, and eligibility status before generating a contract, but the system does not save a record of that affirmation, and staff were not expected to retain one. Negotiation documentation practices were inconsistent across contract managers, and the department did not review procurement files to confirm compliance with federal requirements. Recommendation: We recommend the Montana Department of Transportation: A. Strengthen internal controls by retaining documentation of suspension and debarment verifications and conducting documented reviews of procurement files for compliance with federal requirements for engineering and design-related consultant contracts. B. Prepare an independent cost estimate before receiving or reviewing a consultant's cost proposal, as required by federal regulation. C. Retain documentation of all engineering and design-related consultant procurement activities, as required by federal regulation. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-026 Federal Program Name Highway Planning and Construction (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.205 Grant # Various Compliance Requirement B. Allowable Costs/Cost Principles Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200, Appendix VII(D)(1)(d), requires indirect cost proposals to be submitted within six months after the close of the fiscal year, unless the cognizant agency for indirect costs approves an exception. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not have sufficient controls to ensure its indirect cost rate plan was completed on time and accurately during state fiscal years 2024 and 2025, resulting in noncompliance. Context: The department submitted its indirect cost rate plan for state fiscal year (SFY) 2025 in early June 2024 and its plan for SFY 2026 in late June 2025, approximately five and six months late, respectively. The department indicated the cognizant agency was aware of the late submissions, but no documentation of an approved exception exists. The department uses a checklist to prepare and review its indirect cost rate proposal. Accounting staff prepares the proposal and the accounting manager reviews it; both steps are documented on the checklist. However, the review of the proposal for indirect cost rates effective in SFY 2024 was not documented on the checklist. Although the undocumented manager review is designed to ensure accuracy, we did not detect any inaccuracies in the indirect cost rate plan. Effect: The late submissions constitute material noncompliance with federal regulations. Without adequate review, the department also risks proposing an indirect cost rate that draws more federal funds than allowed. Cause: The department experienced staff turnover in the positions responsible for preparing and reviewing the indirect cost rate proposal. Replacement staff needed additional time and training from the cognizant agency to complete the proposals for SFY 2024 and 2025. Documentation of the SFY 2024 proposal review was lost during the transition. The department worked closely with the cognizant agency to ensure the proposal contents were complete and accurate. However, the department has no documentation of an approved exception to the submission deadline. Recommendation: We recommend the Montana Department of Transportation: A. Strengthen internal controls to ensure the annual indirect cost rate proposal is submitted before the statutory deadline. B. Submit the annual indirect cost rate proposal to the cognizant agency within six months after state fiscal year end, or obtain and retain written documentation that the cognizant agency approved an exception, as required by federal regulation. C. Retain documentation of the department's review of the annual indirect cost rate proposal. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-027 Federal Program Name Highway Planning and Construction (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.205 Grant # Various Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Montana Operations Manual, Information Security Controls, requires user accounts to be disabled or removed within 24 hours of a user's termination. It also requires that users and user roles be reviewed for appropriateness at least every six months. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department did not have sufficient controls to ensure regular review of user access or removal of terminated employees from its highway project management information system. Context: The department's highway project management system documents compliance with key federal requirements and is the originating source for contractor payments. During our review of user access accounts, we found that more than five percent of active accounts belonged to terminated employees. Standard department procedures require removing accounts when they are no longer needed, but several were overlooked and were not removed until we brought them to the department's attention. Audit evidence confirmed that no inappropriate access occurred after any employee's termination date. During the audit period, the department did not conduct regular reviews of user access or user roles. Instead, account maintenance was handled on an ad hoc basis. Accounts were added upon request, and termination emails were monitored for removals. Many termination emails were missed, leaving those accounts active. This ad hoc process also did not account for user role changes when employees moved to different positions within the department. Effect: Without regular user access role reviews, employees may retain access that exceeds what they need to do their jobs, a concept known as the principle of least privilege. Excess access could allow employees to bypass system controls or create inadequate separation of duties, meaning a single user could have enough access to misuse the system without detection. Cause: During the audit period, the department strengthened internal controls for user access reviews of its financial information systems but did not include the highway project management system. This gap existed despite the highway project management system being the originating source for contractor payment amounts. Recommendation: We recommend the Montana Department of Transportation strengthen internal controls to ensure: A. User access reviews are conducted at least every six months, and B. User accounts are removed within 24 hours of employee termination, as required by state IT policy. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-028 Federal Program Name Highway Planning and Construction (COVID-19) Federal Awarding Agency U.S. Department of Transportation State Agency Montana Department of Transportation (department) ALN # 20.205 Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Material Weakness and Material Noncompliance Questioned Costs Likely questioned costs exceed $25,000 Criteria: Federal regulation, 29 CFR 5.5, requires contractors to submit certified payrolls for each week in which any contract work is performed. Federal regulation, 29 CFR 5.6, states that no payment should be made if a contractor or subcontractor is not in compliance with 29 CFR 5.5. Department policy requires contractors to submit certified payrolls within 21 days of performing work. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department's controls were not designed to effectively collect certified payrolls from highway construction contractors during state fiscal years 2024 and 2025, resulting in noncompliance and likely questioned costs. Certified payrolls are the department's primary tool for verifying that contractors pay their employees at least the prevailing wages required by the U.S. Department of Labor. Questioned Costs: We did not identify any known questioned costs; however, we identified 424 certified payrolls submitted more than 30 days late. Because contractors are paid monthly, these contractors likely received payment while not in compliance with certified payroll requirements. The department withheld partial payment for only 28 of the 424 late payrolls. We therefore project likely questioned costs of more than $25,000. Determining the actual amount is not practicable, as it would require reviewing the payrolls, payments, and individual circumstances for all 424 instances. Context: We analyzed the timeliness of all certified payrolls expected to be submitted during the audit period using data from the department's highway project management software. Of the 9,622 required payrolls submitted, 1,726 (17.9%) were submitted after the department's 21-day expectation and did not result in withheld payment. Late payrolls were submitted an average of 29 days late, with a median of 11 days late. Sixteen payrolls were submitted more than one year after work was performed. Previous audits found that the department was issuing full payments to contractors not in compliance with wage rate provisions. Beginning in November 2024, the department started withholding partial payment for contractors with late outstanding certified payrolls. We analyzed construction activity and certified payroll submissions between October 2024 and June 2025 and found that, of 114 payrolls submitted more than 30 days late, the department withheld payment for only 28 (25%). The department's highway project management software tracks when construction work requires a certified payroll and allows contractors to submit payrolls directly in the system. When payments are generated, the system also produces exception reports for contracts with late outstanding certified payrolls. However, during the audit period, the system did not generate exception reports for inactive projects or inactive contractors. The department also did not require staff to document outstanding certified payrolls or contractor follow-up as part of the payment process. As a result, the department's controls were not designed effectively and did not adequately address the risk of noncompliance with wage rate requirements. Repeat Finding: This is a repeat finding and has been reported as the following Single Audit findings: In response to the most recent finding (2023-012), the department updated policy to define timely completion of daily work reports, completed the material portion of those reports within the expected timeframe, and provided training on system functionality. While these steps partially addressed the prior recommendation, the department continued to provide full payment to the material portion of noncompliant contractors. Effect: While the department is not solely responsible for contractor compliance, payment withholding is its primary enforcement tool and it is not being used consistently. During the audit period, the department did not consistently withhold payment from noncompliant contractors as required, resulting in more than $25,000 in likely questioned costs. The department also faces a risk of failing to detect instances where contractors or subcontractors pay workers less than the required minimum wages, which is the core purpose of federal wage rate requirements. Cause: During the second half of the audit period and after it ended, the department implemented several improvements: updating its project management system to flag exceptions for inactive contractors, creating new system reports to support wage rate enforcement, training department management and project managers, and updating department policies. However, these changes were made too late to affect overall compliance during the audit period. Recommendation: We recommend the Montana Department of Transportation: A. Continue to strengthen internal controls and supporting systems to withhold payment until contractors comply with weekly certified payroll requirements. B. Consistently withhold payments from contractors who do not submit weekly certified payrolls, as required by federal regulation. Views of Responsible Officials: The department partially concurs with this recommendation. Management agrees that internal controls require strengthening and that instances of noncompliance exist. However, management disagrees with the auditors' estimated noncompliance rate because the auditor used analytics to test the requirements. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. During the audit, we worked with the department to agree to parameters for our planned analytic approach. As noted above, our analysis indicates compliance issues exist in the population and the department agrees that instances of noncompliance exist. As such, our recommendation stands.

Finding 2025-036 Federal Program Name Homeowners Assistance Fund (COVID-19) Federal Awarding Agency U.S. Department of the Treasury State Agency Department of Commerce (department) ALN # 21.026 Grant # HAF0008 Compliance Requirement L. Reporting Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department submits the required HAF quarterly report called 1505-029 reports. We found no errors in our testing of quarterly reports submitted in fiscal years 2024 and 2025. However, the department did not have a process in place to review report contents before submission. Context: Only one staff member has permission to submit quarterly reports in the Treasury portal. The quarterly report is to collect data, plans, and compliance metrics to monitor how federal pandemic-relief funds are utilized to prevent homeowners from losing their homes. The submission does not document any consideration of the completeness or accuracy of the information reported. The department also lacks documentation demonstrating that the underlying support for reported data has been reviewed or that the data reported in the Treasury reporting system matches the support. Effect: Without adequate internal controls, the department is at increased risk that the quarterly reports may contain errors or be incomplete. Cause: The department staff indicated they relied on Treasury’s system for reasonableness checks. While the Treasury reporting system performs automated checks based on past entries, they do not constitute an internal control for the department given they are not part of the department’s process. Recommendation: We recommend the Department of Commerce establish, maintain, and document internal controls to ensure the quarterly reports are complete and accurate before submission. Views of Responsible Officials: The department concurs with the recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-073 Federal Program Name Immunization Cooperative Agreements (COVID 19) Federal Awarding Agency U.S. Department of Health and Human Services (HHS) State Agency Department of Public Health and Human Services (department) ALN # 93.268 Grant # NH23IP922574 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles H. Period of Performance Type of Finding Material Weakness (A, B, and H) and Material Noncompliance (A and B) Scope Limitation (H) Questioned Costs $5,346,667 Criteria: During the audit period, federal regulations, 2 CFR 200.333 and 45 CFR 75.353, allowed the department to issue fixed-amount subawards up to the Simplified Acquisition Threshold, provided certain requirements were met. Federal regulation, 48 CFR 2.101, defined the Simplified Acquisition Threshold as $250,000, with exceptions not applicable to the department’s subawards. Federal regulation, 2 CFR 200.403(g) and (h), require costs to be adequately documented and incurred during the approved budget period to be allowable. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: In fiscal years 2024 and 2025, the department issued fixed amount subawards to counties for the Immunization Cooperative Agreements Program. Five counties in 2024 and six in 2025 each received subawards exceeding the $250,000 maximum allowed by federal regulations. Internal controls did not prevent or detect this noncompliance. Because the department used fixed amount subawards above the allowed threshold, it did not obtain support for counties’ incurred costs. Payments were based on quarterly deliverable reporting and the department has no support to demonstrate that payments were only for costs incurred during the correct period of performance for the federal awards that funded the subgrants. Questioned Costs: We question the federal share of all payments to subrecipients whose subawards exceeded the maximum allowed for fixed-amount subawards. Total questioned costs are $5,346,667. Context: The department has historically used fixed-amount subawards for this program, as amounts were usually small. During the audit period, increased funding due to the COVID-19 emergency led to larger subawards. For counties with subawards exceeding $250,000: • In 2024, initial subawards were below the threshold, but amendments raised them above the limit. Subawards ranged from about $360,000 to $823,000. • In 2025, all initial subawards exceeded the threshold, ranging from about $342,000 to $781,000. After we communicated the issue, department staff consulted their Centers for Disease Control (CDC) contact and were told that the federally approved budgets showed intended spending, including the use of fixed-amount subawards. Additionally, the department noted that its 2024 federal budget review did not raise any concerns with the department using fixed-amount subawards. As part of the audit, we tried to speak with the department’s CDC contact but were told they were unauthorized to speak with us. Additionally, we could not confirm if the subaward mechanism was reviewed as part of the 2024 federal review. We found that CDC guidance allowed some flexibilities in response to COVID-19, but did not waive the dollar limitation for fixed-amount subawards. Effect: The department did not comply with federal regulations for the Immunization Cooperative Agreements program, resulting in about $5.3 million in questioned costs. When fixed-amount subawards are used, accountability is based on performance and results, and there is no expected routine monitoring of the actual costs incurred by the subrecipient. Because the department used this method for awards exceeding the allowed threshold, it cannot show that payments were limited to costs incurred during the correct period of performance for the federal awards that funded the subgrants. As a result, we cannot determine if county costs were incurred during the appropriate period of performance. Cause: The department received increased federal funds during the COVID-19 emergency. Program management stated they overlooked the maximum limit for fixed-amount subawards. indicating a need for stronger internal controls. Department management believed the CDC budget approval meant the federal limit did not apply. Recommendation: We recommend the Department of Health and Human Services: A. Strengthen internal controls for the Immunization Cooperative Agreements Program to ensure all fixed-amount subawards are within the federal maximum. B. Only issue fixed-amount subawards under the allowed maximum or obtain a documented waiver from the Centers for Disease Control. Views of Responsible Officials: The department does not concur with this recommendation. All subawards, including those referenced in the finding, were explicitly listed in the federally approved budget documents and Notice of Award. These materials contained the subaward amounts that the auditors questioned and were formally reviewed and approved by the CDC. The approval included the fixed-amount subaward methodology and the department’s planned use of funds. The department also points to the technical review conducted by CDC, which identified no findings or compliance issues, and its consultation with CDC program officials to support its position. Rebuttal of Views of Responsible Officials: We considered the department’s nonconcurrence with the recommendation. As noted above, the department's CDC contact did not respond to our inquiry during the audit. Additionally, we were unable to confirm through review of other information that the limit on fixed-amount subawards was waived. As such, our recommendation stands.

Finding 2025-074 Federal Program Name Immunization Cooperative Agreements (COVID-19) Federal Awarding Agency U.S Department of Health and Human Services (HHS) State Agency Department of Public Health and Human Services (department) ALN # 93.268 Grant # NH231P922574 Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a)(1) and (a)(2)(ii), requires non-federal entities to report each subaward obligation of $30,000 or more to the Federal Funding Accountability and Transparency Act (FFATA) reporting system no later than the end of the month following the month the obligation is made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2024 and 2025, the department's internal controls were not sufficient to ensure all Immunization obligations of $30,000 or more were accurately and completely reported to the FFATA reporting system. As a result, required obligations were not reported, and some obligation amounts were over-reported. Context: We reviewed all obligations reported during the audit period and compared them to subaward agreements and amendments provided by the department. The department awarded approximately $5.9 million in Immunization obligations under a single federal award to 41 subrecipients, which should have triggered FFATA reporting for original contract issuances or subsequent contract amendments. The department should have filed 41 reports but instead filed 106 across a single federal award. Of the 106 reports filed, 19 matched current audit period obligations; however, only one met the $30,000 reporting. As the department indicated it was working during the audit period to correct prior-year errors, we also compared current-year reports to prior-audit recommendation support. We identified 52 FFATA reports matched prior-year errors. All 52 were submitted on the same day for the full subaward amount, rather than the specific amount reported in error or not yet reported from the prior audit. Overreported amounts related to the prior audit period totaled $13,181,401. The number of instances and corresponding dollar amounts for the reporting errors discussed are summarized in the following table. We did not test timeliness of the reports submitted and matched to current-year or prior-year subawards due to the column in Sam.gov data changing upon transaction modification. Our analysis was conducted using FFATA reporting system data as of July 2025. We considered each transaction submitted, or omitted, by the department and compared information against executed subaward agreements from the audit period, as provided by the department. Any corrections the department made during fiscal year 2026 were not considered in our testing for this audit but will be considered during the fiscal year 2026 audit. We did not provide our detailed analysis to the department. However, we believe the department has all necessary information in its possession, such as the FFATA reporting system data and its issued and amended subawards, to ensure necessary corrections are made to the FFATA reporting system. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023, included finding #2023-072, recommending enhanced internal controls over FFATA reporting and submit reports for the Immunization program as required by federal regulations. Effect: The department is not in compliance with FFATA reporting requirements. Inadequate internal controls resulted in unreported and inaccurate subaward reporting. FFATA reporting provides transparency to federal grantor agencies and the public. The errors identified could mislead users of FFATA data. Cause: The department uses a central contracting system to capture contract obligations, which include both subrecipient and contractor relationships. The system is used to process payments and identify which agreements require FFATA reporting. However, information entered into the system did not distinguish between contractor and subrecipient relationships, was not consistently accurate and was not always entered at the time of obligation. Department personnel responsible for FFATA reporting indicated they are working with federal program staff to implement process changes to ensure FFATA reports are filed only for subrecipients and are accurate and timely. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure accurate and complete submission of FFATA reports for the Immunization Cooperative Agreements program. B. Submit FFATA reports for the Immunization Cooperative Agreements program in accordance with federal regulations. Views of Responsible Officials: The department partially concurs with the recommendation. The department agrees that internal control deficiencies existed in its FFATA subaward reporting processes during FY24-FY25 and that instances of noncompliance existed. The department disagrees with the quantified extent of exceptions because they have been unable to replicate the numbers and dollars presented in the finding context and they believe the auditor has not provided sufficient detail to address the identified errors. The department also points to ongoing processes to identify and correct duplicate and inaccurate records. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. While the department agrees with the need to improve internal controls and errors in FFATA reporting, management disagrees with the auditor’s quantification of the errors. We believe management has sufficient detail to address the finding because it has access to its subaward agreements as well as the information currently available in the federal FFATA reporting system. As such, our recommendation stands.

Finding 2025-089 Federal Program Name Low-Income Home Energy Assistance Program (LIHEAP) (COVID-19) Federal Awarding Agency U.S. Department of Health and Human Services (HHS) State Agency Department of Public Health and Human Services (department) ALN # 93.568 Grant # 18BMTLIEA, 2001MTLIEA, 2101MTE5C6, 2101MTLIEA, 2201MTLIEA, 2301MTLIEA, 2401MTLIEA, 2501MTLIEA Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a)(1) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity. The report must be submitted no later than the end of the month following the month in which the obligation is made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2024 and 2025, the department's internal controls were insufficient to ensure all LIHEAP obligations of $30,000 or more were accurately and completely reported to the FFATA reporting system. Required obligations were not reported as required by federal regulations, and the department overreported obligation amounts. Context: We reviewed all obligations reported during the audit period against obligations made through subaward agreements and amendments to subrecipients. The department provided subaward documents totaling approximately $17 million in LIHEAP obligations under 3 federal awards to 13 subrecipients. Based on our review of subrecipient agreements and amendments provided by the department, 69 FFATA reports should have been filed; instead, 490 were filed across eight federal awards. Of the 490 reports filed, 54 matched current audit period obligations, 30 contained inaccurate amounts. Additionally, one fell below the $30,000 reporting threshold and should not have been reported. The number of instances and corresponding dollar amounts are summarized in the table below. We did not test timeliness of the reports submitted and matched to current-year or prior-year subawards due to the column in Sam.gov data changing upon transaction modification. While the department provided contracts for 13 entities presented as subrecipients, auditors determined only 10 were actual subrecipients. The remaining 3 were not subrecipients and therefore not subject to FFATA reporting requirements. Our analysis was conducted using FFATA reporting system data as of July 2025. We considered each transaction submitted, or omitted, by the department and compared information against executed subaward agreements from the audit period, as provided by the department. Any corrections the department made during fiscal year 2026 were not considered in our testing for this audit but will be considered during the fiscal year 2026 audit. We did not provide our detailed analysis to the department. However, we believe the department has all necessary information in its possession, such as the FFATA reporting system data and its issued and amended subawards, to ensure necessary corrections are made to the FFATA reporting system. Effect: The department is not in compliance with FFATA reporting requirements. Insufficient internal controls resulted in missing and inaccurate subaward reporting. FFATA reporting provides transparency to federal grantor agencies and the public. The errors identified could mislead users of the reported data. Cause: The department uses a central contracting system to capture obligations, which includes both subrecipient and contractor relationships. The system is used to process payments and identify which obligations require FFATA reporting. However, information entered into the system did not distinguish between contractor and subrecipient relationships, was not consistently accurate and was not always entered at the time of obligation. Department personnel responsible for FFATA reporting indicated they are working with federal program staff to implement process changes to ensure FFATA reports are captured accurately and timely for subrecipients only. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure accurate and complete submission of FFATA reports for the Low-Income Home Energy Assistance program. B. Submit FFATA reports for the Low-Income Home Energy Assistance program in accordance with federal regulations. Views of Responsible Officials: The department partially concurs with the recommendation. The department agrees that internal control deficiencies existed in its FFATA subaward reporting processes during FY24-FY25 and that instances of noncompliance existed. The department disagrees with the quantified extent of exceptions because they have been unable to replicate the numbers and dollars presented in the finding context and they believe the auditor has not provided sufficient detail to address the identified errors. The department also points to ongoing processes to identify and correct duplicate and inaccurate records. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. While the department agrees with the need to improve internal controls and errors in FFATA reporting, management disagrees with the auditor’s quantification of the errors. We believe management has sufficient detail to address the finding because it has access to its subaward agreements as well as the information currently available in the federal FFATA reporting system. As such, our recommendation stands.

Finding 2025-006 Federal Program Name National Guard Military Operations and Maintenance (O&M) Projects Federal Awarding Agency U.S. Department of Defense State Agency Department of Military Affairs (department) ALN # 12.401 Grant # W9124V-18-2-1007, W9124V-18-2-1001, W9124V-21-2-1001, W9124V-18-2-1002, W9124V-21-2-1002, W9124V-21-2-1003, W9124V-21-2-1004, W9124V-21-2-1005, W9124V-21-2-1007, W9124V-21-2-1010, W9124V-21-2-1021, W9124V-21-2-1022, W9124V-21-2-1023, W9124V-21-2-1024, W9124V-21-2-1040, W9124V-22-2-1031 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles G. Matching, Level of Effort, Earmarking Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s internal controls were not sufficient to ensure that all payroll charged during fiscal year 2024 was allocated in accordance with the applicable governing agreements. Context: The department oversees Army and Air National Guard activities in Montana and receives federal funding through a master cooperative agreement with the National Guard Bureau (NGB). Each appendix to the master agreement specifies the NGB reimbursement percentage. The Centralized Personnel Plan (CPP) defines the reimbursable salary percentages for employees who provide administrative support across multiple appendices. These percentages are recalculated annually based on prior-year actual activity and are coded into the state’s accounting system to be automatically applied each pay period. During our review of payroll charged under the CPP and cooperative agreement appendices, we found three misallocation situations: 1. Five employees’ salaries were not allocated in accordance with the fiscal year 2024 CPP. Errors spanned nine consecutive pay periods beginning at the start of fiscal year 2024. We intended to test all employees under the plan, but stopped testing after five, as all five employees tested had the same error. 2. Thirty firefighters' salaries were charged to the wrong appendix in the first pay period of fiscal year 2024. 3. For one pay period in fiscal year 2024, a post engineer’s payroll was not correctly allocated between the state’s share and the amount the federal government would reimburse. The department became aware of issues with the employee’s payroll allocations during the fiscal year but did not make a journal entry to correct the allocation. Salary allocations are a routine, predictable element of program administration. The department is experienced with calculating and applying allocations under the CPP and various appendices. However, the misallocations persisted over multiple consecutive pay periods before being identified and corrected by the department. Because the department self-identified and corrected the errors, no questioned costs were identified. Nevertheless, the duration and volume of errors indicate an internal control deficiency. Effect: The department misallocated employee payroll, resulting in inaccurate federal reimbursement requests and the need for correcting journal entries. Internal controls did not detect the misallocations for multiple consecutive pay periods. Cause: The department did not make timely updates to the state accounting system to ensure the CPP allocations were correct for fiscal year 2024. The firefighter and post engineer misallocations were oversights due to human error. Recommendation: We recommend the Department of Military Affairs strengthen internal controls to prevent payroll misallocations, or to detect and correct them in a timelier manner. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-007 Federal Program Name National Guard Military Operations and Maintenance (O&M) Projects Federal Awarding Agency U.S. Department of Defense State Agency Department of Military Affairs (department) ALN # 12.401 Grant # W9124V-18-2-1007, W9124V-18-2-1001, W9124V-21-2-1001, W9124V-18-2-1002, W9124V-21-2-1002, W9124V-21-2-1003, W9124V-21-2-1004, W9124V-21-2-1005, W9124V-21-2-1007, W9124V-21-2-1010, W9124V-21-2-1021, W9124V-21-2-1022, W9124V-21-2-1023, W9124V-21-2-1024, W9124V-21-2-1040, W9124V-22-2-1031 Compliance Requirement C. Cash Management Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: National Guard Regulation 5-1, Section 3-15.c requires claims to be submitted within 60 days after the basis of the claim is known or should have been known, whichever is earlier. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked internal controls to consistently seek reimbursement for the federal portion of O&M grant expenditures within the required timeframe. We identified multiple instances of late reimbursement requests. Context: The department manages the operation and maintenance of National Guard facilities in the state as part of the O&M program. This is managed through a Master Cooperative Agreement and 12 appendices. The department spent $57,449,130 during the audit period. The department periodically requests reimbursement by submitting SF-270 forms, tracked per appendix, with each request covering multiple invoices. We reviewed reimbursement requests in two appendices and found seven instances totaling $387,514 where requests were submitted more than 60 days after transactions were posted in SABHRS. The delays ranged from 62 to 266 days. During audit planning, we also identified one invoice in another appendix submitted for reimbursement 78 days after the invoice date. During our review of the department's new expenditure process for fixed costs, we identified an additional 28 instances where more than 60 days elapsed between when a cost was recorded and paid in SABHRS and when it was coded to the applicable appendix for inclusion on a reimbursement request. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2023, included recommendation #2023-003, directing the department to enhance internal controls to ensure reimbursement requests are submitted within 60 days of expenditure and that claims are requested within 60 days of being known or paid. Effect: The department is not in compliance with federal regulations. Reimbursement requests submitted more than 60 days after the expenditure could result in the federal government denying payment. Cause: Late reimbursements occurred for several reasons. Two requests were held while the department corrected payroll allocation errors addressed in finding 2025-006. Three requests could not be submitted because the federal funding modification had not yet been signed, leaving no available funding. One request was delayed while waiting for all central technology charges from the Department of Administration under a single purchase order to be finalized. The remaining item was missed without a specific documented reason. The department implemented a new expenditure process for fixed costs during the audit period in response to slow federal approvals that ended up increasing the time between when costs are initially paid and when reimbursement is requested. Recommendation: We recommend the Department of Military Affairs: A. Enhance internal controls to ensure reimbursement requests are submitted within 60 days of the expenditure. B. Request reimbursement for expenditures within 60 days of expenditure claims being known or paid. Views of Responsible Officials: The department partially concurs with the recommendation. Management agrees they need to submit reimbursement requests timely and have taken steps to implement processes to do so. However, they reiterate they cannot submit requests until the applicable federal funding modification have been approved. Rebuttal of Views of Responsible Officials: We considered the department’s partial concurrence. We acknowledge federal funding modification delays impact the department’s ability to submit reimbursement requests. But these delays do not change the reimbursement timeline requirements. Additionally, these delays only impacted three of the exceptions we identified. As such, our recommendation stands.

Finding 2025-008 Federal Program Name National Guard Military Operations and Maintenance (O&M) Projects Federal Awarding Agency U.S. Department of Defense State Agency Department of Military Affairs (department) ALN # 12.401 Grant # W9124V-21-2-1005, W9124V-21-2-1040, W9124V-21-2- 1003, W9124V-21-2-1007, W9124V-21-2-1002, W9124V-21- 2-1001, W9124V-20-2-1001, W9124V-18-2-1002, W9124V- 18-2-1005, W9124V-18-2-1007, W9124V-18-2-1001, W9124V-21-2-1024 Compliance Requirement H. Period of Performance Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: National Guard Regulation, Section 11-10.b, requires the department to provide the United States Property and Fiscal Officer (USPFO) a final accounting of all funding and disbursements within 90 days after the end of the Federal fiscal year, or upon termination or closeout of an agreement, whichever is earlier. National Guard Bureau Grants and Cooperative Agreement Policy Letter 21-07, Section 3.e, extended this deadline to 120 days after the end of the budget period of performance or termination of the award. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department's internal controls were insufficient to ensure closeout reports were submitted on time and that final accounting was accurate and supported. We identified multiple instances where closeout reports were submitted after the 120-day deadline or lacked adequate support. Context: The department manages the operation and maintenance of National Guard facilities through a Master Cooperative Agreement and 12 associated appendices as part of the O&M program. The department spent $57,449,130 during the audit period. Each appendix is funded with one-year appropriations. If unspent funds remain at year-end, the department may receive an extension to liquidate remaining obligated costs. At the end of the year, or after the extension period, the department completes the closeout report for the award, which includes the final accounting. During the audit period, the department completed 28 closeout reports. Of those, the department submitted 15 closeout reports after the 120-day deadline, ranging from 135 to 2,146 days late. Additionally, we were unable to reconcile six final closeout reports to the department's accounting records. For some items, the department provided reconciliations prepared during the closeout process. However, we could not independently verify them or agree this information to the accounting records. Effect: The department did not comply with comply with federal regulations. Noncompliance could affect the amount of future federal funding awarded. Cause: Most exceptions involved older awards that predate current department staff. Staff stated that both the department and USPFO were unaware several awards were still open. Between August and December 2024, department and USPFO staff worked together to close these awards, including submitting late closeout reports and reconstructing prior expenditures. Because historical documentation was incomplete, full reconciliation required significant effort. Additionally, because the funds had already expired, reimbursement was not available. Department staff were verbally informed that no extensions were needed for these awards. Recommendation: We recommend the Department of Military Affairs: A. Enhance internal controls to ensure closeout reports are accurate and submitted within 120 days of the end of the award period. B. Complete all future closeout reports accurately and within the required timeframe. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-110 Federal Awarding Agency U.S. Department of Defense Federal Program Name National Guard Operations and Maintenance (O&M) Projects State Agency Department of Military Affairs ALN# 12.401 Grant # W9124V-18-2-1007, W9124V-21-2-1001, W9124V-21-2-1002, W9124V-21-2-1003, W9124V-21-2-1004, W9124V-21-2-1005, W9124V-21-2-1007, W9124V-21-2-1010, W9124V-21-2-1021, W9124V-21-2-1022, W9124V-21-2-1023, W9124V-21-2-1024, W9124V-21-2-1040, W9124V-22-2-1031 Compliance Requirement C. Cash Management Type of Finding Material Noncompliance and Material Weakness Questioned Costs No questioned costs identified Federal Awarding Agency U. S. Department of Health and Human Services Federal Program Name 1332 State Innovation Waivers State Agency State Auditor’s Office ALN# 93.423 Grant # SIWIW200014 Compliance Requirement C. Cash Management Type of Finding Material Noncompliance and Material Weakness Questioned Costs No questioned costs identified Criteria: Federal regulation, 31 CFR 205.9(b), requires the Treasury State Agreement (TSA) to include federal assistance programs subject to subpart A. (If they meet the threshold calculated using Table A in 31CFR 205.5). Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The TSA is a contract between the state of Montana and the federal government explaining how often large federal programs will process draw requests. The goal is that neither party loses money to interest. State Accounting Bureau prepares the TSA, with assistance from state agencies. The TSA was incomplete for both fiscal years 2024 and 2025, indicating that internal controls over its preparation needs improvement. Context: The O&M program at the Department of Military Affairs provides support to the Army and Air National Guard. It was incorrectly excluded from the TSA in fiscal year 2024. The State Innovation Waiver program at the State Auditor’s Office provides access to high-quality, affordable health insurance. It was incorrectly excluded from the TSA in fiscal year 2025. O&M fell just below the inclusion threshold in 2025 and was appropriately excluded that year. Likewise, the State Innovation Waiver program was under the threshold in 2024 and was appropriately excluded. Effect: The incomplete TSA constitutes noncompliance with federal regulations. Cause: For the O&M program, a miscommunication between the State Accounting Bureau and the Department of Miliary Affairs led the State Accounting Bureau to believe the entire program was ending when only the COVID-related element was concluding. For the State Innovation Waiver at the State Auditor’s Office, the State Accounting Bureau incorrectly believed federal funds flowed directly to the Montana Reinsurance Association. However, funding first passes through the office before being disbursed. Recommendation: We recommend the Department of Administration: A. Strengthen internal controls over the preparation of the Treasury State Agreement by obtaining outside verification of agency-provided information, such as when a program is discontinued. B. Ensure all required programs are included in the TSA prior to federal approval as required by federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-063 Federal Program Name Rehabilitation Services–Vocational Rehabilitation Grants to States Federal Awarding Agency U.S. Department of Education State Agency Department of Public Health & Human Services (department) ALN # 84.126 Grant # H126A220038, H126A230038, H126A240038, H126A250038 Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: The Case Service Report (RSA-911) instructions require that data submissions be accurate and submitted on time. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department's internal controls did not ensure data submission requirements were met for the RSA-911 Case Services Report. We identified multiple instances where reported information was not supported by underlying case documents. Context: The Vocational Rehabilitation program helps people with disabilities find and maintain employment that matches their individual strengths, interests, and goals. The department opens a case in the Madison computer system to track each participant's progress through the program. The department reports case information for over 7,000 cases on each quarterly Case Service Report. We selected 25 out of the 66,434 individual lines reported in the audit period for a nonrandom, nonstatistical sample but stopped testing after identifying errors in the first 2 reviewed. Both errors involved data element 350 – Start Date of Employment in Primary Occupation, which was blank even though the department's case management system, Madison, contained a start date. In both cases, data element 356 – Employment Status at Exit indicated employment had begun. We then analyzed the remaining population and found 954 additional items with a blank employment start date despite an employment status at exit indicating the individual was employed. Effect: The department is not compliant with program reporting requirements or the requirement to maintain effective internal control over federal awards. Inaccurate data hinders the Rehabilitation Services Administration's (RSA) ability to effectively manage the program at the federal level. Cause: The Madison system did not consistently capture data element 350 in the RSA-911 quarterly report export. This occurred when staff did not enter the program name in the program field on the Employment Verification screen. That field was not required. Additionally, neither the data validation tool on the RSA website nor the department's internal data validation tool verified that all participants with an employment status at exit also had an employment start date reported. Recommendation: We recommend the Department of Public Health and Human Services: A. Strengthen internal controls to ensure the necessary fields are completed within the Madison case management system in order to accurately complete the Start Date of Employment in Primary Occupation data element on the RSA-911 Case Service Report. B. Accurately report the Start Date of Employment in Primary Occupation case information as required by the federal reporting requirements for the Vocational Rehabilitation program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-083 Federal Program Name Temporary Assistance for Needy Families (TANF) (COVID-19) Federal Awarding Agency U.S Department of Health and Human Services (HHS) State Agency Department of Public Health and Human Services (department) ALN # 93.558 Grant # 1202MTTANF, 1302MTTANF, 1402MTTANF, 1701MTTANF, 1901MTTANF, 2201MTTANF, 2301MTTANF, 2401MTTANF, 2501MTTANF Compliance Requirement L. Reporting Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR Part 170, Appendix A(I)(a)(1) and (a)(2)(ii), requires non-federal entities to report to the Federal Funding Accountability and Transparency Act (FFATA) reporting system each action that equals or exceeds $30,000 in federal funds for a subaward to a non-federal entity. The report must be submitted no later than the end of the month following the month in which the obligation is made. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During fiscal years 2024 and 2025, the department's internal controls were insufficient to ensure all TANF obligations of $30,000 or more were accurately and completely reported to the FFATA reporting system. Required obligations were not reported as required by federal regulation and the department overreported obligation amounts. Context: We reviewed all obligations reported during the audit period against obligations made through subaward agreements and amendments to subrecipients. The department reported awarding approximately $24.4 million in TANF obligations under two federal awards to 18 subrecipients. Based on our audit work, 25 FFATA reports should have been filed; instead, 374 were filed across nine federal awards. Of the 374 reports, six matched current audit period obligations; one contained an inaccurate amount. As the department indicated it was working during the audit period to correct prior-year errors, we also compared current-year reports to prior-year recommendation support. We identified 29 reports that matched prior-year errors. Seventeen were reported in the prior-year and the current year report duplicated the prior report instead of correcting errors; nine did not meet the $30,000 threshold needing a report. Based on prior-year documentation all 29 reports reflected total federal and general fund obligations to the subrecipient, whereas the reporting requirement is limited to federal funds. The number of instances and corresponding dollar amounts for the reporting errors discussed are summarized in the following table. We did not test timeliness of the reports submitted and matched to current-year or prior-year subawards due to the column in Sam.gov data changing upon transaction modification. While the department provided subaward agreements for 18 entities presented as subrecipients, auditors identified 12 fiscal year 2024 subrecipients and one fiscal year 2025 subrecipient. The subaward agreements and amendments provided by the department covered fiscal year 2024 only and included six entities who were not subrecipients. Additionally, an agreement was not provided for one subrecipient. Our analysis was conducted using FFATA reporting system data as of July 2025. We considered each transaction submitted, or omitted, by the department and compared information against executed subaward agreements from the audit period, as provided by the department. Any corrections the department made during fiscal year 2026 were not considered in our testing for this audit but will be considered during the fiscal year 2026 audit. We did not provide our detailed analysis to the department. However, we believe the department has all necessary information in its possession, such as the FFATA reporting system data and its issued and amended subawards, to ensure necessary corrections are made to the FFATA reporting system. Repeat Finding: Montana's Single Audit for the two fiscal years ended June 30, 2021, included finding #2021-064, and the report for the two fiscal years ended June 30, 2023, included finding #2023-071. Both findings recommended the department enhance internal controls over FFATA reporting and submit reports for the TANF program as required by federal regulations. Effect: The department is not in compliance with FFATA reporting requirements. Insufficient internal controls resulted in missing and inaccurate subaward reporting. FFATA reporting provides transparency to federal grantor agencies and the public. The errors identified could mislead users of the reported data. Cause: The department uses a central contracting system to capture obligations, which includes both subrecipient and contractor relationships. The system is used to process payments and identify which obligations require FFATA reporting. However, information entered into the system did not distinguish between contractor and subrecipient relationships, was not consistently accurate, and was not always entered at the time of obligation. Additionally, as noted in finding #2025-085, the department’s subaward agreements with subrecipients do not identify the obligation amount by specific FAIN. This contributes to errors in FFATA reporting for the program because we are unable to determine if the correct subaward amounts by FAIN were reported. Department personnel responsible for FFATA reporting indicated they are working with federal program staff to implement process changes to ensure FFATA reports are captured accurately and timely for subrecipients only. Recommendation: We recommend the Department of Public Health and Human Services: A. Enhance internal controls to ensure accurate and complete submission of FFATA reports for the Temporary Assistance for Needy Families program. B. Submit FFATA reports for the Temporary Assistance for Needy Families program in accordance with federal regulations. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-084 Federal Program Name Temporary Assistance for Needy Families Federal Awarding Agency U.S. Public Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.558 Grant # 2301MTTANF, 2401MTTANF Compliance Requirement L. Reporting Type of Finding Material Weakness Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department’s internal controls were ineffective in preventing errors in the submission of Administration for Children and Families (ACF)-204 reports for federal fiscal years 2023 and 2024. Context: The ACF-204 is an annual report on the state’s maintenance-of-effort and contains nine key line items. Internal controls were ineffective in identifying multiple errors in the reports submitted during the audit period, as outlined below: • In the 2023 report, the department reported the "Purpose of Benefit" data on the "Financial Eligibility Criteria" line. These two lines require different information. • Federal oversight identified several discrepancies in the 2024 report and returned it to the department for correction. The department corrected and resubmitted the report accurately. • The 2023 report was initially submitted under 2024, and the 2024 report was initially submitted under 2025. The department revised the reports and resubmitted them for the correct fiscal years. Because most errors were corrected, we do not consider this to be material noncompliance. Effect: Ineffective internal controls resulted in the reporting errors described above. Inaccurate or untimely data may limit federal agencies' ability to make well-informed decisions regarding future TANF fund allocations. Cause: Department personnel indicated the errors in reporting were a combination of human error and challenges with the federal reporting system. Recommendation: We recommend the Department of Public Health and Human Services enhance internal controls to ensure accurate submission of the ACF-204 reports for the Temporary Assistance for Needy Families program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-085 Federal Program Name Temporary Assistance for Needy Families Federal Awarding Agency U.S. Public Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.558 Grant # 1802MTTANF,1902MTTANF, 2002MTTANF,2102MTTNAF, 2202MTTANF,301MTTANF, 2401MTTANF Compliance Requirement M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs No questioned costs identified Criteria: Federal Regulation, 2 CFR 200.332(b)(1), requires pass-through entities to provide federal award identification information specific to the subaward that identifies the federal award to the subrecipient. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department's internal controls did not ensure that subaward contracts included all required federal award identification elements. We identified multiple contracts with unclear elements. Context: The department issued subaward agreements and/or amendments to 13 entities during the audit period, using a standardized template designed to include all 14 federal award identification requirements. In our review, we noted that the department’s subaward agreements frequently list multiple federal awards as the funding source. While the department includes information to identify the federal awards, such as the Federal Award Identification Number (FAIN) and Assistance Listing Number (ALN), the agreements do not specify the award amount for each individual FAIN or ALN. Instead, the agreements report a single combined subaward amount. Because TANF federal awards allow an extended budget period rather than a fixed two-year period of performance, the department lists each FAIN with its award date and period of performance start date using an "until spent" end date. During the current audit period, up to six FAINs are listed per agreement, and some agreements include FAINs for both TANF and non-TANF programs. Based on our review, no subaward agreements issued during the audit period specified the award amount for individual FAINs. The total value of these agreements and amendments was $19.9 million. Effect: Without communicating amounts tied to individual FAINs, subrecipients cannot accurately track, report, or comply with the requirements of each federal award. As noted in finding 25-083, this also contributed to errors in FFATA reporting for the TANF program during the audit period. Cause: The department interpreted the open-ended nature of TANF FAINs as an exemption from the requirement to identify specific award amounts for each FAIN, which is not the case. Recommendation: We recommend the Department of Public Health and Human Services: A. Strengthen internal controls over federal award identification in TANF subaward agreements. B. Specify individual award amounts by Federal Award Identification Number (FAIN) and Assistance Listing Number (ALN) for each TANF subaward and amendment as required by federal regulation. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-086 Federal Program Name Temporary Assistance for Needy Families Federal Awarding Agency U.S. Department of Public Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.558 Grant # 2301MTTANF, 2401MTTANF, 2501MTTANF, Compliance Requirement L. Reporting Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department lacked testable controls over the Administration for Children and Family (ACF)-199 report for most of the audit period. Context: Federal requirements require the department submit ACF-199 reports quarterly. These are data reports that relay work participation rates, program compliance, and family demographics to the federal government. The department uses its Combined Healthcare Information and Montana Eligibility System-Enterprise Architecture (CHIMES) system to determine TANF eligibility and benefit amounts. The department's contractor prepares and submits the ACF-199 TANF Data Report directly from CHIMES as a text file. Due to the nature of text files, the department was not able to document its review of the information. In December 2024, the department began receiving Excel files alongside the text files. Excel files allow the department to document its review of the information prepared by the contractor. As a result, only 3 of the 8 reports submitted during the audit period had a testable review. Our work found minor errors in the reports that could have been caught with a review. Repeat Finding: Montana’s Single Audit report for the two fiscal years ended June 30, 2021, included finding #2021-056, and the Single Audit for the two fiscal years ended June 30, 2023, included finding #2023-058, both related to controls over the ACF-199 report. Effect: Without effective controls over the ACF-199 report, errors in the report may go undetected. Federal agencies rely on this data to make decisions about future TANF funding. Inaccurate or untimely reporting could affect those funding decisions. Cause: Prior to implementing new procedures, the department considered its up-front data collection and state/federal data file validation to be sufficient controls. The department later developed internal controls to help ensure report completeness and accuracy before submission. However, these procedures were not finalized and implemented until more than halfway through the audit period. Documenting the reviews on the excel files is a good next step to improving the ACF 199 internal controls. Recommendation: We recommend the Department of Public Health and Human Services continue to strengthen internal controls over the ACF-199 reports for the Temporary Assistance for Needy Families program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-087 Federal Program Name Temporary Assistance for Needy Families Federal Awarding Agency U.S. Department of Public Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.558 Grant # 2301MTTANF, 2401MTTANF, 2501MTTANF, Compliance Requirement A. Activities Allowed/Unallowed B. Allowable Costs/Cost Principles E. Eligibility Type of Finding Material Weakness Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Department staff can manually override benefit determinations and payment issuances in the program's Combined Healthcare Information and Montana Eligibility System-Enterprise Architecture (CHIMES) system. The department has no procedures in place to review each of these manual overrides. Context: We obtained a listing of all manual overrides in the department's information system during fiscal years 2024 and 2025, totaling 1,029 overrides. In a randomly selected nonstatistical sample, we attempted to test whether manual overrides were being reviewed. After testing 5, we saw no evidence of reviews being performed. The department confirmed that reviews are not performed on individual overrides. Department personnel indicated that they implemented an eligibility review in July of 2023 which includes overrides in the population. In the first year they sampled 15 cases and then took a 12-month break. In March of 2025, they started a process of reviewing 45 cases per month as able depending on other duties. Because the department indicated this review did not operate throughout our entire audit period, we did not test it and do not consider this a compensating control. Through the other testing in our sample, we observed one instance where benefits were incorrectly closed, one override needed to issue a payment that was never issued, and one override with no documentation explaining why it was necessary. Because of the number of overrides that happen and the possibility for errors, we consider this a material weakness. Effect: Without consistent oversight of manual overrides, the department risks ineligible individuals receiving benefits, eligible individuals having their cases incorrectly closed, and individuals receiving excessive benefit amounts. Cause: The department believes its existing sample-based review process, which includes manual overrides in the broader population, is sufficient. The department also noted that most overrides result from IT system issues, where staff work with IT to resolve the problem and then manually override to achieve the correct outcome. However, sampling this way does not guarantee they will sample an override in their sample and as our sample results demonstrate, these controls do not catch all errors. Recommendation: We recommend the Department of Public Health and Human Services improve internal controls to enhance reviews over manual overrides for the Temporary Assistance for Needy Families program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-088 Federal Program Name Temporary Assistance for Needy Families Federal Awarding Agency U.S. Department of Public Health and Human Services State Agency Department of Public Health and Human Services (department) ALN # 93.558 Grant # 2301MTTANF, 2401MTTANF Compliance Requirement M. Subrecipient Monitoring Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The department's internal controls were insufficient to ensure that all required Single Audit reports for subrecipients were obtained and reviewed. Context: Federal requirements require the department comply with subrecipient monitoring requirements. These requirements include verifying subrecipients receive a Single Audit when their federal funds expended reach a certain threshold and performing additional monitoring as necessary based on the results of those audits. In a randomly selected, nonstatistical sample of six of the department’s 12 subrecipients, we found that the department did not obtain two Single Audit reports for one subrecipient during the audit period. Follow-up work identified a second subrecipient whose fiscal year 2024 audit report was not requested. In total, the department did not obtain or review three Single Audit reports. Because the issue was limited to two subrecipients, and two of the three errors were in the final year of the contract, we do not consider this material noncompliance. Effect: Without effective internal controls, the department is at risk of not complying with federal subrecipient monitoring requirements. During the audit period, this resulted in the noncompliance discussed above. Not reviewing the Single Audit reports means the department cannot determine whether they need to perform federally required monitoring activities such as resolving audit findings and issuing management decisions. This puts the department at risk of additional noncompliance. Cause: While the department does have procedures in place to review Single Audit reports as part of its risk assessment process for ongoing subrecipients, the department did not think it was necessary to obtain Single Audit reports for subrecipients whose contracts were ending. There was no alternative process in place to ensure that Single Audit reports were received and reviewed for subrecipients whose contracts were ending. Recommendation: We recommend the Department of Public Health and Human Services enhance internal controls to ensure all required subrecipient single audit reports are reviewed for the Temporary Assistance for Needy Families program. Views of Responsible Officials: The department concurs with this recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-099 State Agency Department of Public Health and Human Services (department) Federal Awarding Agency U.S. Department of Agriculture Federal Program Name SNAP Cluster (COVID-19) ALN# 10.551 and 10.561 Grant # Various Compliance Requirement N. Special Tests and Provisions Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Federal Awarding Agency U.S Department of Health and Human Services (HHS) Federal Program Name Temporary Assistance for Needy Families (TANF) ALN # 93.558 Grant # 2301MTTANF, 2401MTTANF, 2501MTTANF Federal Program Name Low-Income Home Energy Assistance Program (LIHEAP) (COVID-19) ALN # 93.568 Grant # 2301MTLIEA, 2401MTLIEA, 2401MTLIEI, 2501MTLIEA, 2501MTLIEI Federal Program Name Children’s Health Insurance Program (CHIP) (COVID-19) ALN # 93.767 Grant # 2305MT3002, 2305MT5021, 2405MT5021, 2505MT5021 Federal Program Name Medicaid Cluster (COVID-19) ALN # 93.775, 93.777, and 93.778 Grant # Various Compliance Requirement A. Activities Allowed or Unallowed (TANF), B. Allowable Costs/Cost Principles (TANF), E. Eligibility (TANF, LIHEAP, CHIP, and Medicaid Cluster) N. Special Tests and Provisions (TANF) Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Section 2-15-114, Montana Code Annotated (MCA), outlines requirements for state agencies to maintain an adequate level of security for all data. This includes the requirement to implement appropriate cost-effective safeguards to reduce, eliminate, or recover from identified threats to data. Montana Operation Manual, Information Security Controls Standard, outlines baseline security controls for every state agency to implement for information technology systems they manage. Included among the baseline controls are requirements for documentation of access control policies and procedures, including periodic review of user access so that IT best practices are followed, and controls over computer systems are sufficient. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: Controls over the Combined Healthcare Information and Montana Eligibility System (CHIMES) did not ensure users had appropriate access and privileges. The department lacks an accounts matrix, and some privileged business users had unnecessarily elevated security permissions. Context: The CHIMES system is used by the department to gather and make eligibility determinations for multiple federal programs. Access to the system should adhere to the principles of separation of duties and least privilege. Separation of duties is the concept that no user has enough permissions to misuse the system on their own. At the same time, the principle of least privilege ensures that users have only the minimum access required to complete their assigned duties. While the department conducts routine access reviews, it does not ensure that users have appropriate access and privileges. An account matrix is needed to clearly outline access and privileges for each user role in the system. An accounts matrix would ideally incorporate the business decisions and safeguards related to least privilege and separation of duties. It can be used to verify which user permissions are appropriate during review. Additionally, audit work found that some privileged business users had elevated security permissions and that some staff who had moved into new roles still retained access that no longer aligned with their current responsibilities. Effect: Inappropriate access to CHIMES could allow unauthorized system changes or activity, leading to incorrect data or eligibility determinations. Cause: Department staff cited data entry errors, staff oversight, and position changes as causes. Recommendation: We recommend the Department of Public Health and Human Services: A. Complete the formal development of an accounts matrix for CHIMES, and B. Include the review of user permissions to improve routine access reviews. Views of Responsible Officials: The department concurs with the recommendation. For additional information regarding the department’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-057 Federal Program Name Title I Grants to Local Educational Agencies Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.010A Grant # S010A220026, S010A230026, S010A240026 Compliance Requirement G. Matching, Level of Effort, Earmarking Type of Finding Significant Deficiency Questioned Costs No questioned costs identified Criteria: Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office lacks internal controls to ensure that Maintenance of Effort (MOE) calculations for Local Education Agencies (LEA), which are generally school districts or schools, performed in the Montana Automated Education Financial and Information Reporting System (MAEFAIRS) are accurate. Context: In fiscal year 2024, 399 schools received Title I allocations from the office and in fiscal year 2025, 398 schools received allocations. For maintenance of effort, a school may receive funds only if the office determines that the school’s combined fiscal effort per student or total state and local expenditures on free public education in the preceding year were at least 90% of those same measures from the second preceding year, unless the U.S. Department of Education grants a specific waiver. Prior to 2024, the School Finance Manager annually recalculated a sample of seven schools that were determined to meet MOE compliance to verify that MAEFAIRS calculations were correct. The office did not perform these recalculations in 2024 or 2025 and had no mitigating internal control in place to ensure the accuracy of MAEFAIRS calculations. With turnover in the School Finance Manager position, this control was not documented and not continued after turnover occurred. Effect: Without accurate MOE calculations, the office risks distributing Title I funds to schools that do not meet level-of-effort requirements in future years, resulting in noncompliance with federal regulations. Cause: The office experienced turnover in the School Finance Manager position during the audit period. Controls were not documented when the position was filled, therefore they were not aware of the practice of recalculating MOE compliance for a selection of schools and did not perform these recalculations in 2024 or 2025. Recommendation: We recommend the Office of Public Instruction enhance internal control procedures to ensure MOE confirmation calculations are conducted by staff annually, even when turnover occurs. Views of Responsible Officials: The office does not concur with the recommendation and noted they review the values provided by School Finance and tests Enrollment, Avg Daily Attendance and Average Number Belonging, to determine if the LEA is subject to a percentage of MOE reduction. Rebuttal of Views of Responsible Officials: We considered the office’s nonconcurrence. We agree the office reviews values for LEAs that are flagged for not meeting MOE. However, the office does not complete reviews of the calculations if an LEA is not flagged. Therefore, there are no controls in place to ensure the calculations are accurate for all LEAs. As such, our recommendation stands.

Finding 2025-058 Federal Program Name Title I Grants to Local Educational Agencies Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (office) ALN # 84.010A Grant # S010A220026, S010A230026, S010A240026 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles M. Subrecipient Monitoring Type of Finding Material Weakness and Material Noncompliance Questioned Costs $174,111 Criteria: Federal regulation, 2 CFR 200.332 (d), requires pass-through entities to "Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved." Federal regulation, 2 CFR 200.403(a) and (g), states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation, 2 CFR 200.303, requires non-Federal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The office reimbursed Local Education Agencies (LEA), which are generally school districts or schools, without receiving and reviewing sufficient documentation to determine whether costs were allowable. The schools are subrecipients of the federal Title I funds. Internal controls were not adequate to ensure proper documentation was received before payment. Questioned Costs: We question $174,111 in Title I payments that were reimbursed without adequate support. This represents the total dollar amount of the ten sample items with errors. Based on the number of errors found, the timeframe during which the office was notified of documentation deficiencies, we project total questioned costs exceed $26 million or approximately 25% of the aggregate total for fiscal years 2024 and 2025. Context: We selected a random nonstatistical sample of 60 reimbursements. We tested the first 26 items and found ten exceptions. Because the error rate indicated material noncompliance, we did not test the remaining 34 items. The ten exceptions are mainly related to missing dates associated with when compensation and benefits were earned. The number of errors indicates a systemic problem. The office made 3,111 reimbursement payments totaling $104,414,057 to schools in fiscal years 2024 and 2025. Approximately $99 million of these requests were related to compensation and benefit costs incurred by schools. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2023-038 in the audit for the two fiscal years ended June 30, 2023. Effect: The office reimbursed schools for Title I costs that were not adequately supported at the time of payment. This increases the risk that schools used Title I funds for unallowable activities or costs. Subrecipient monitoring procedures were not sufficient to comply with federal regulations. Cause: This issue was originally communicated to the office in late fiscal year 2024, leaving only part of the audit period for the office to strengthen controls. The office implemented a new cash request review process in early 2025. Prior to that change, cash request reviews were minimal and limited to comparing the approved budget categories to the school’s cash request. However, the office continues to note that not all schools submit adequate documentation. During the current period, the office continued to distribute funds to schools even when supporting documentation lacked detail to ensure the cash request was for authorized purposes and was reasonably necessary for performance of the Title I program. During testing, we noted some improvement in documentation for fiscal year 2025 salary and benefit costs. Should the office continue to obtain increased documentation for salary and benefit costs, this issue should be resolved. Recommendation: We recommend the Office of Public Instruction: A. Continue to strengthen internal controls to ensure schools submit adequate documentation with reimbursement requests before payment is made. B. Only reimburse schools when documentation is sufficient to demonstrate the cost is for an allowable purpose and was incurred within the subaward period. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.

Finding 2025-059 Federal Program Name Title I Grants to Local Educational Agencies Federal Awarding Agency U.S. Department of Education State Agency Office of Public Instruction (Office) ALN # 84.010A Grant # S010A220026, S010A230026, and S010A240026 Compliance Requirement A. Activities Allowed or Unallowed B. Allowable Costs/Cost Principles Type of Finding Material Weakness & Material Noncompliance Questioned Costs $1,104,982 Criteria: Federal regulation 2 CFR 200.403(a) and (g) states costs are allowable when they are necessary and reasonable for the performance of the federal award and adequately documented. Federal regulation 2 CFR 200.430 (g) states salaries and wages charged to a federal award must be based on records that accurately reflect the work performed. Paragraph 430(g)(1)(vii) (A) and (B) allows for budgeted estimates if the estimates produce reasonable approximations of the activity actually performed and significant changes are identified and entered into the records in a timely manner. Federal regulation 2 CFR 200.303 requires non-Federal entities to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the entity manages the award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The Office of Public Instruction (OPI) controls were not adequate to ensure compliance with federal regulations related to personal service costs. Questioned Costs: We question $1,104,982 of costs. This is the total for personal services for Title I for the audit period, less any staff who indicated they worked all of their time on the program and further adjusted for staff time supported (that we tested) for April – June 2026 that was supported by agency records . Context: The office added a new internal control in April of 2025 requiring staff to track time for their time spent on each Federal program. However, this control was not in place for 21 months of the audit period and documentation for some staff’s work on Title I could not be provided after implementation of the control. Therefore, we question $1,104,982 of costs. Since the office was not tracking time spent on each Federal program for 21 months of the audit period and documentation for all requested staff after implementation of the new control could not be provided, this resulted in material noncompliance. Repeat Finding: This is a repeat finding and was reported as Single Audit finding 2023-034 in the audit for the two fiscal years ended June 30, 2023. Effect: The office lacked controls to ensure that only salary and benefit costs for time worked on Title I were charged to the award. There is insufficient support to show that personal services costs were allocated to the federal program where the work was performed, resulting in $1,104,982 in questioned costs. Cause: Before April 2025, the office had not implemented a control requiring staff to track time spent on each federal program. Without this control, employees did not complete periodic time and effort certifications, and time was not confirmed as allocated to the correct state and Federal programs. Staff time allocations relied solely on budget estimates. Recommendation: We recommend the Office of Public Instruction: A. Continue to use enhanced internal controls to ensure personal services costs are adequately documented and reflect actual time and effort for the Title I program. B. B. Allocate personal service costs based on support for actual time and effort on the Title I program, in accordance with federal regulations. Views of Responsible Officials: The office concurs with the recommendation. For additional information regarding the office’s planned corrective action see the Corrective Action Plan starting on page D-1.