Findings Citing § 200.303

FINDING 2024-219 The Medicaid Enterprise System was not properly updated for members deemed ineligible, resulting in capitation payments issued to Managed Care Organizations for ineligible members within the Medicaid program. Type of Finding: Material Weakness, Material Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Eligibility Questioned Costs: $78 Known, $2,051,295 Projected Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 435.10 states that a state plan must: (a) Provide that the requirements of this part are met; and (b) Specify the groups to whom Medicaid is provided, as specified in subparts B, C, and D of this part, and the conditions of eligibility for individuals in those groups. The Uniform Guidance included in 42 CFR 438.3(c)(2) states that capitation payments may only be made by the state and retained by the Managed Care Organization, Prepaid Inpatient Health Plans, or Prepaid Ambulatory Health Plans for Medicaid-eligible enrollees. Condition: During our review of the eligibility determination for Medicaid members, we tested 78 claims that included capitation payments. Capitation payments are payments made by the State to Managed Care Organizations (MCO), Prepaid Inpatient Health Plans, or Prepaid Ambulatory Health Plans for Medicaid eligible enrollees. For each MCO, capitation payments are calculated per member per month. The Department makes payments to an MCO based on the total number of members per month. Out of 78 claims tested, 3 capitation payments (or 3.8 percent) were paid to the MCOs for Medicaid members that were no longer eligible; 2 of the 3 capitation payments were paid for a Medicaid member that was eligible through May 2023; and 1 of the 3 capitation payments was paid for a Medicaid participant that was eligible through the end of April 2023. Questioned costs were calculated based on a sample error of $78 of known questioned costs paid that was projected out to the overall population for $2,051,295 of projected questioned costs. Cause: During May 2023, eligibility was re-evaluated in the Idaho Benefit and Eligibility System (IBES). The members in some MCO plans were determined ineligible in IBES. The updates to eligibility status were not forwarded to the Medicaid Enterprise System (MES). Capitation payments were still paid on behalf of these members despite being deemed ineligible in IBES. The MES relies on member eligibility information from IBES and interfaces nightly; however, the eligibility status in IBES was not appropriately updated in MES. No claims were paid on behalf of those members during fiscal year 2024. Effect: Though we did not identify claims in our sample that were paid on behalf of the ineligible members during fiscal year 2024, the Department did issue Medicaid capitation payments on behalf of ineligible members. Additionally, given the nature of the error in updating the MES, other capitation payments or claims may have been paid for ineligible members. Recommendation: We recommend that the Department properly design, implement, and maintain internal controls to ensure that MES and IBES data are properly interfacing, complete, and accurate, ensuring that capitation payments are issued only for eligible members. In addition, we recommend that the Department review those recipients that were deemed ineligible to determine which would have contributed to capitation payments and if any more had been made in error. Management’s View: The Department Agrees with this finding. Corrective Action: Medicaid recognizes that this appears to be an interface issue with Self Reliance, and their inability to send correct eligibility records to Medicaid in certain instances. Medicaid will investigate and work with Self Reliance to mitigate these issues while working through our new system implementations and interfaces. Self-Reliance is looking at the issue to identify root causes and will work closely with MC to determine next steps to implement. System integration is expected in 2028. In the interim, we’ll identify issues and develop implementation strategies by 2027. Strategies will align with system updates and builds for both Self-Reliance and Medicaid. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-220 The expenditures reported on the Quarterly Medicaid Statement of Expenditures for the Medical Assistance Program form (CMS-64) were understated by $16,348,275 for the Medicaid program. Type of Finding: Material Weakness, Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 302.15(a)(3) states that the agency should maintain the necessary records for the proper and efficient operation of the State plan, including records regarding amount and sources of support collections and the distribution of these collections. In addition, the Uniform Guidance included in 42 CFR 430.30(c)(1) states that the State must submit the CMS-64 to the central office (with a copy to the regional office) not later than 30 days after the end of each quarter. Condition: The CMS-64 is used by the Department to report its actual program benefit costs and administrative expenses to the Centers for Medicare and Medicaid Services (CMS). We reviewed two of the four quarters submitted during fiscal year 2024. One of the two tested quarters on the CMS-64 (or 50 percent) was submitted 207 days late. The other quarter was submitted 185 days late. The Department notified CMS and received return communications acknowledging that reporting for Idaho would be delayed due to the implementation of Luma. In addition, one of the two quarters tested on the CMS-64 (or 50 percent), the state and local administration amount was understated by $16,348,275. Cause: The implementation of Luma resulted in significant reporting issues and caused the Department to submit the CMS-64 forms late. In addition, staff turnover and insufficient training caused the misstatement of the state and local administration amount on the CMS-64, and the review of the report was not performed at a level sufficient to identify errors. Effect: The late submission of the CMS-64 caused the Department to be noncompliant with the federal requirements. Additionally, the state and local administration amount reported on the CMS-64 was understated by $16,348,275 for one quarter during fiscal year 2024 for the Medicaid program. The understatement was eventually corrected in the June 30,2025, CMS report. Recommendation: We recommend that the Department strengthen internal controls to ensure accurate amounts are reported and timely submission of the CMS-64. Management’s View: The Department Agrees with this finding. Corrective Action: As noted in the finding, the late submission and understated expenditures were primarily the result of the Luma system implementation and the unavailability of required data for CMS reporting. During the development phase, concerns were raised regarding the system’s ability to meet federal reporting requirements—specifically the CMS-64 and CMS-21 reports for Medicaid. The Budget Team requested sample output reports to proactively update workpapers and ensure accurate and timely reporting; however, these requests were not fulfilled. During the delay in timely reporting, DHW maintained ongoing communication with our federal partners. The Budget Team developed the necessary reports and revised internal processes to bring reporting current. The Budget Team also worked closely with our federal auditors to ensure no reporting elements were inadvertently omitted. During this review, we identified that our initial submission excluded indirect expenditures associated with the federally approved Cost Allocation Plan. This allocation process cannot be completed within Luma and requires coordination among the State Controller’s Office, two external vendors, and the Cost Allocation Budget Analyst. These dependencies created significant delays. As a result, indirect cost allocation charges were substantially delayed, and the first successful import for July 2023 did not occur until November 2023. Upon receiving the complete data, the Reporting Team corrected the process, documented the updates, and submitted a prior period adjustment to capture previously under-reported expenditures. As we entered SFY 2025, we had a more comprehensive understanding of the new processes and required timelines. This resulted in improved timeliness: the December 2024 submission was five days late submitted 2/4/25, the March 2025 submission was two days late submitted 4/30/25 and resubmitted 7/31/25, and the June 2025 submission was only one day late submitted 7/31/25. We are pleased to report that the September 2025 submission was certified on time and submitted 10/30/25. While some reporting adjustments were needed, CMS and the Budget Team collaborated effectively to update and recertify the report to ensure accuracy. We have updated all relevant process documentation and continue to automate steps where feasible to further improve efficiency and reduce turnaround times. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-221 The Division of Medicaid did not document the review and approval of the audited financial reports of the Managed Care Organizations (MCO). Type of Finding: Material Weakness Related to Prior Finding: 2023-224 AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 438.3(m) requires the contract with MCO to include the requirement to submit audited financial reports specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. Condition: We reviewed all 4 MCO contracts with the Department that were active during fiscal year 2024. The Department did include requirements for the MCOs to submit audited financial reports in the contracts but did not have documented reviews and approvals in places over those audited financial reports provided for 2 out of 4 MCO contracts (or 50 percent). Cause: The Department did not realize that the annual submission of the audited financial reports provided by the MCO was not included in the monitoring spreadsheet until we requested clarification which led to a lack of a documented review. Effect: Audited financial reports provide information about internal controls and compliance with laws, rules, and regulations. Collecting and reviewing audited financial reports provides additional oversight and the ability to react to the risk of noncompliance occurring at the MCO. Recommendation: We recommend that the Department follow intended procedures to monitor and document the receipt, and review, of the audited financial reports. Management’s View: The Department Agrees with this Finding. Corrective Action: The division has signed and [sic] MOU with the Department of Insurance to review audited financial reports. The first reports will be sent to the Division of Insurance December 2025 with the exception of the Magellan report which is [sic] will be sent to the Division of Insurance in January 2026 as they are finalizing their report currently. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-222 Four providers lacked documentation to support continued eligibility within the Medicaid program. Type of Finding: Significant Deficiency, Noncompliance Related to Prior Finding: 2023-223 AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: Undetermined Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 455.412 states that the state Medicaid agency must: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any state is licensed by such state. (b) Confirm that the provider’s license has not expired, and that there are no current limitations on the provider’s license. In addition, the Uniform Guidance included in 42 CFR 455.414 states that the state Medicaid agency must re-validate the enrollment of all providers regardless of provider type at least every five years. Condition: During testing, we identified 4 out of 60 providers (or 6.7 percent) that did not submit maintenance documents over 5 years. The specific maintenance documents that are required to be submitted depend on the type of provider. The Gainwell Provider Enrollment Specialist did not ensure that provider eligibility was properly maintained prior to updating the provider’s eligibility in the MES. Cause: Idaho Medicaid provider re-validation was scheduled to be completed in March 2025. The service organization, Gainwell Technologies, was unable to complete re-validation due to their own constraints. This is a known issue to the Department, and it anticipates completion of the provider re-validation by December 2025. Effect: If providers are not properly validated every five years, they may be ineligible to participate in the Medicaid program and still receive payments for services. Recommendation: We recommend that the Department strengthen internal controls to ensure provider validation is completed timely and in compliance with federal requirements. This may include providing for alternative procedures when a contractor does not perform agreed upon services. Management’s View: The Department Agrees with this finding. Corrective Action: Medicaid is currently under a Corrective Action Plan with CMS requiring all Managed Care providers to enroll with Medicaid. This project is currently underway. The initial date of completion of having all providers enroll was 12/31/2025. However, there were unforeseen system enrollment issues that delayed the project. The go live date is now April 1, 2026. Once all providers are enrolled Medicaid will audit provider rosters throughout the year to ensure those providers are in fact enrolled within Medicaid's system. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-223 The submission of a Child Care and Development Fund (CCDF) financial report used to support compliance with the Matching, Level of Effort (LOE), and Earmarking requirement was not completed timely. Type of Finding: Significant Deficiency, Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Matching, Level of Effort, Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 98.65(g) states that Lead Agencies shall submit financial reports, in a manner specified by the Administration for Children and Families (ACF), quarterly for each fiscal year until funds are expended. Additionally, the Administration for Children and Families (ACF) Form ACF-696 (Financial Reporting Form for State and Territory Child Care and Development Fund (CCDF) Lead Agencies) states that this form must be submitted quarterly. These reports are due 30 days after the end of the quarter: Quarter 1 by October 31, Quarter 2 by April 30, Quarter 3 by July 31, and Quarter 4 by January 31. Condition: The Department is required to complete a CCDF financial report, Form ACF-696 on a quarterly basis for each grant. Each report must be submitted within 30 days after the end of the applicable quarter. The final report for the quarter ended September 30, 2023, that included earmarking and level of effort amounts was submitted 1 month later, on November 30, and was signed off by the Department’s financial executive officer about 5 months after the deadline, on March 25, 2024. We did not note errors related to maintenance of effort and earmarking compliance requirements in the reports. Cause: Staff turnover, insufficient training, and the implementation of Luma caused the Department’s late submission of the required Form ACF-696 for the quarter ended September 30, 2023. The Department requested an extension from the ACF to complete necessary adjustments, but the request was denied. Effect: Late submission of the report resulted in the Department’s noncompliance with federal requirements. Additionally, the documentation of a review by the financial officer almost 4 months after submission calls into question how effective the review would be in detecting and correcting errors prior to submission. Recommendation: We recommend that the Department strengthen internal controls to ensure the timely and reviewed submission of the CCDF financial report, Form ACF-696. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department has seen an increased time commitment related to financial grant reporting since the implementation of Luma in July 2023. This was particularly relevant in SFY 2024 as Luma implementation, training and interfaces were still evolving, resulting in a tremendous increase in time commitments without the corresponding staff increases needed. In many cases, this resulted in late filings and/or filing reports that were not reviewed in sufficient detail. The Division of Financial Services continues to work through the inefficiencies encountered and design processes that include sufficient review and other internal controls while also allowing for timely completion of required reports. One FTE was transferred from another team to the Cash and Grants team. This position is expected to assist in completing preliminary tasks so that Grant Reporters have necessary data at their fingertips when drafting financial reports. As Department staff continue to learn nuances of the Luma system, both accuracy and timeliness of financial reporting is expected to improve. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-224 Some expenditures were misclassified on the Child Care and Development Fund (CCDF) financial report resulting in an overstatement of Child Care Administration expenditures and an understatement of Direct Services. Type of Finding: Material Weakness, Material Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 98.65(g) states that Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended. Also, 45 CFR 98.54(a) states that not more than 5 percent of the aggregate funds expended by the Lead Agency from each fiscal year's allotment, including the amounts expended in the state pursuant to 45 CFR 98.55(b), shall be expended for administrative activities. Additionally, Form ACF-696 (Financial Reporting Form for State and Territory Child Care and Development Fund (CCDF) Lead Agencies) states that the CCDF program has a number of fiscal requirements associated with multiple funding streams that comprise the block grant. Form ACF-696 has separate columns for reporting expenditures from each of these component funding streams. Condition: The Department is required to complete a CCDF financial report, Form ACF-696 on a quarterly basis for each grant. The Department compiles reports using quarterly supporting workpapers which are broken out by source, including the mandatory fund, the matching fund, and the discretionary fund. We found 1 out of 4 Form ACF-696 tested (or 25 percent), in which the Department misclassified the expenditures included in the mandatory funds, reporting $2,867,578 under the Child Care Administration line instead of Direct Services Line. Cause: Staff turnover and the implementation of Luma contributed to the human error that caused the expenditure misclassification. In addition, the review of Form ACF-696 was not completed at a level sufficient to identify errors. Effect: Expenditures in CCDF Direct Services included in mandatory funds were misclassified as Child Care Administration expenditures. With an incorrect amount being reported, the spending requirements applicable to the Child Care Administration expenditures were also not met. Recommendation: We recommend that the Department strengthen internal controls over the compilation and submission of the CCDF financial report, Form ACF-696, to ensure the amounts are classified properly and accurately. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department's Grant Reporting team has been developing additional internal controls to put in place with the utilization of the Luma ERP. Some of the controls include conducting reconciliations between internal workpapers and Luma records as well as reconciling to external parties such as the Payment Management System. The deeper reviews being performed during reconciliations are also highlighting areas where workpaper adjustments may be needed as some of the templates used may be outdated. We believe these increased focused efforts will alleviate issues like this in the future and are ongoing as the Department identifies opportunities for advancements in our own processes and working with SCO to implement better Luma reports and controls within the grant reconciliation process. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-225 Amounts reported as provided to subrecipients by financial services on the Schedule of Expenditures of Federal Assistance (SEFA) are not properly supported. Type of Finding: Significant Deficiency, SEFA Misstatement Related to Prior Finding: 2023-208; 2022-211; 2021-206 AL Title: Special Supplemental Nutrition Program for Women, Infants, and Children, Temporary Assistance for Needy Families, Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 10.557, 93.558, 93.575, 93.596 Federal Award Number: Various Program Year: Various Federal Agency: Department of Health and Human Services Requirement: Code of Federal Regulations (CFR) 2 CFR 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR Section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Management objectives should include the preparation and fair presentation of the SEFA in relation to the basic financial statements as a whole and in compliance with requirements contained in 2 CFR 200.510(b), which states, in part, it must include: • Total federal awards expended as determined in accordance with 2 CFR 200.502, and • Total amount provided to subrecipients from each federal program (2 CFR 200.510(b)(4)) The Office of the State Controller (Office) requires agencies to complete the SEFA closing package and uses the reported information to compile the statewide SEFA. Condition: Amounts reported on the SEFA closing package as expenditures to subrecipients did not agree to amounts provided by program staff to auditors for testing purposes. The following programs had discrepancies between what was reported on the SEFA closing package and what was retained by program personnel: • An overstatement of $4,503,700 for the Child Care and Development Block Grant (Assistance Listing Number (AL) 93.575) • An overstatement of $29,079 for the Child Care and Development Block Grant (AL 93.596) • An understatement of $1,014,475 for the Temporary Assistance for Needy Families (AL 93.558) • An understatement of $362,470 for the Special Supplemental Nutrition Program for Women, Infants, and Children (AL 10.557) Cause: Contradicting information was provided by financial services personnel and program personnel related to expenditures to subrecipients reported on the Schedule of Expenditures of Federal Awards (SEFA) closing package for three major programs. A new statewide accounting system (Luma) was implemented in July 2023. The Office provided guidance to the Department on how to code expenditures to subrecipients, using specific account codes. According to financial services personnel, some expenditures to subrecipients were incorrectly coded causing incorrect amounts to be included on the SEFA. The Department has a review process in place for closing packages that is intended to detect and correct errors. However, the review of the fiscal year 2024 SEFA closing package was not completed at a level of detail sufficient to properly identify and correct errors. In addition, Department financial services personnel and program personnel are not communicating effectively to discover and resolve any discrepancies related to expenditures to subrecipients reported on the SEFA. Effect: The amounts provided to subrecipients were misstated in the Department’s SEFA closing package as detailed in the condition section above. The net overstatement is a combination of over and under statements that total $3,155,834 in the Department’s SEFA closing package. Recommendation: We recommend that the Department improve the process of gathering information to prepare the SEFA closing package and review for accuracy at a level of detail sufficient to detect and correct errors in the SEFA closing package. In addition, we recommend that the Department improve training of program personnel regarding the proper coding of the expenditures to subrecipients. Management’s View: The Department Agrees with this finding. Corrective Action: For major grants, Financial Services staff will send a summary of transactions coded as subrecipient payments to the program manager to review prior to inclusion in the SEFA closing package. The review will be requested to be twofold: to ensure that everything that should be included as a subrecipient payment is and to ensure that nothing that should not be considered a subrecipient payment is included. This process helps to identify that we are reporting the accurate amount of expenditures for each subrecipient. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-226 The Bureau of Facility Standards within the Department failed to complete timely health and safety surveys for three long-term care facilities. Type of Finding: Material Weakness, Material Noncompliance AL Title: State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.777, 93.778 Federal Award Number: 2305ID5000, 2405ID5000, 2305ID5CAA, 2405ID5CAA, 2305ID50C3, 2305ID5MAP, 2305ID5ADM, 2405ID5MAP, 2405ID5ADM, NH23IP922633, NU51PS005169 Program Year: July 1, 2019 – June 30, 2025, May 1, 2021 – April 30, 2026, October 1, 2022 – September 30, 2023, October 1, 2023 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Special Tests and Provisions Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 488.330(a)(i) states that the survey agency surveys all facilities for compliance or noncompliance with requirements for long-term care facilities. Also, 42 CFR 488.308(a) states that the survey agency must conduct a survey of each nursing facility not later than 15 months after the last day of the previous survey. Additionally, 42 CFR 488.308(b) states that the statewide average interval between standard surveys must be 12 months. The Centers for Medicare and Medicaid Services (CMS) provided the QSO-22-02-ALL memo on November 12, 2021, which stated that as of November 2021, the Bureau of Facility Standards (Bureau) should be able to resume re-certification surveys on a regular basis and should do so by establishing new intervals based on each facility’s next survey, not based on the last survey that was conducted prior to the COVID-19 Public Health Emergency (PHE). Condition: The Bureau is required to conduct unannounced standard re-certification surveys, which provide a comprehensive review of the quality of care furnished in a facility. For long-term care facilities, these recertification surveys must be conducted no later than 15 months after the previous recertification survey with a statewide average interval of 12 months or less. We identified 3 out of 18 providers tested (or 16.6 percent) that did not have a survey completed within 15 months of the previous survey as required. The timing of the re-certification surveys was 27 months, 42 months, and 38 months, respectively. Collectively, the timing of the re-certification surveys caused the Department to be noncompliant with the statewide average interval of 12 months or less requirement as well. Cause: The Bureau experienced staffing shortages that delayed survey completions. The Bureau also stated that they followed the guidance provided by CMS QSO-22-02-ALL memo by prioritizing facility recertification surveys for facilities that had a history of noncompliance or allegations of noncompliance. Effect: Delays in the completion of health and safety surveys increases the risk of inadequate care for Medicaid recipients and that Medicaid providers are not complying with health and safety standards. In addition, ineligible providers could be receiving federal funds. Recommendation: We recommend that the Department ensure that surveys required are conducted not later than 15 months after the last day of the previous survey and ensure that the statewide average interval between standard surveys must be 12 months. Management’s View: The Department Agrees with this finding. Corrective Action: During SFY24, Bureau of Facility Standards (BFS) was still coming out of the COVID response for recertification time frames and actively recruiting new health facility surveyors to ensure proper multidisciplined teams were available to complete the overdue surveys. BFS also contracted with Healthcare Management Solutions, LLC. to supplement overdue recertification surveys. On October 3, 2025, during the government shutdown, we were able to complete the final overdue surveys to be compliant with 15.9 months between surveys. Due to the government shutdown, CMS paused recertification surveys for nursing facilities. This may restrict our ability to maintain the required recertification timeline of 15.9 months. We have recruited and maintained staffing posture but are still actively recruiting to round out of staffing to meet the statutory timelines. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We appreciate the Department’s efforts to reduce the time between required surveys to 15.9 months; however, the United States Code of Federal Regulations Title 42 Section 488.308(a) requires the survey agency to conduct a survey of each nursing facility not later than 15 months after the last day of the previous survey. Based on our interpretation of the very specific language in the requirement that the reviews be completed not later than 15 months after the last day of the previous survey, we assert that the Department was not compliant with the requirement during the audit period and still not compliant as of October of 2025.

FINDING 2024-227 The review and approval of the annual updates to the Low-Income Home Energy Assistance Program (LIHEAP) benefits matrix were not documented. Type of Finding: Material Weakness Related to Prior Finding: 2023-211 AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLWC6, 2201IDLIEA, 2301IDLIEA, 2301IDLIEE, 2301IDLIEI Program Year: May 28, 2021 – March 31, 2024, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 Federal Agency: Department of Health and Human Services Requirement: Eligibility Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP program staff utilizes software to determine eligibility and benefit amounts for applicants based on energy burden and qualifying factors. There is a benefits matrix within the software, which is updated annually. Each year, the Department’s LIHEAP program staff update the benefits matrix with any required changes. The review and approval of the changes were completed by program staff, who met in-person and completed testing scenarios to verify the accuracy of the information. After the test results were reviewed and no errors identified, the matrix information was uploaded into software production. Verbal confirmation was provided to the program manager. The review and approval of the changes to the benefits matrix were not documented during fiscal year 2024. The documented review and approval procedures were implemented in February 2025. Cause: The Department did not consider that documentation to support the review and approval of the updates to the benefits matrix was necessary during fiscal year 2024. Effect: We did not identify errors in the 60 approved and 60 denied eligibility determinations that were reviewed. However, without a documented review, there is an increased risk of errors in the benefits matrix. Recommendation: We recommend that the Department maintain sufficient documentation to support the review and approval of the updates to the benefits matrix. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The corrective action referenced was not completed, by the Department’s own admission, until March 6, 2025 which would have been significantly after the fiscal year 2023 issuance of the Single Audit Report, and also would have left fiscal year 2024 and most of fiscal year 2025 without proper internal controls in place. Without an appropriate control in place the Department continued to risk errors in the matrix going undetected and uncorrected until March of 2025.

FINDING 2024-228 The review of the Low-Income Home Energy Assistance Program (LIHEAP) earmarking compliance requirements was not documented. Type of Finding: Material Weakness Related to Prior Finding: 2023-212 AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLIE4, 2201IDLIE4, 2301IDLIEE, 2401IDLIEA, 2401IDLIEI Program Year: October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025 Federal Agency: Department of Health and Human Services Requirement: Matching, Level of Effort, Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The LIHEAP requires earmarking, which limits the percentage of grant funds that can be spent on administration, weatherization, and leveraging programs. The monitoring of LIHEAP earmarking requirements was completed by the program manager on a spreadsheet that tracked expenditures and appropriate limitations to ensure compliance was met. There was no documented review for accuracy nor approval of the tracking spreadsheet during fiscal year 2024. The documented review and approval procedures were implemented in February 2025. Cause: The Department did not consider that documentation to support the review and approval of the earmarking tracking spreadsheet was necessary to ensure accuracy and compliance during fiscal year 2024. Effect: We did not identify any errors in compliance with earmarking requirements during completion of audit procedures, but the lack of a documented review increases the risk of errors occurring and going undetected. Recommendation: We recommend that the Department maintain sufficient documentation to support the review and approval of the earmarking tracking spreadsheet. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The corrective action referenced above was not completed, by the Department’s own admission, until March 25, 2025 which would have been significantly after the fiscal year 2023 issuance of the Single Audit Report, and also would have left fiscal year 2024 and most of fiscal year 2025 without proper internal controls in place. Without an appropriate control in place the Department continued to risk errors in the spreadsheet going undetected and uncorrected until March of 2025 which could lead to noncompliance with earmarking requirements.

FINDING 2024-229 Low-Income Home Energy Assistance Program (LIHEAP) special reports did not include a review for accuracy and compliance prior to submission. Type of Finding: Material Weakness Related to Prior Finding: 2023-210 AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLIE4, 2201IDLIE4, 2301IDLIEE, 2401IDLIEA, 2401IDLIEI Program Year: October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: During fiscal year 2024, the Department was required to submit 6 LIHEAP special reports to the Federal Government. The Department’s LIHEAP program manager compiled the program special reports. The reports are submitted by the same program manager to the Office of Community Services. The reviews and approvals for 2 out of 6 program special reports tested (or 33 percent) were not documented. The LIHEAP program manager indicated that there were no documented review and approval of the program special reports between July 2023 and January 2024 for fiscal year 2024. Review and approval procedures were designed in April 2024 and implemented in February 2025. Cause: The Department staff indicated that there was no official approval process as reports are submitted online and the data source was either collaborated or provided by internal sources and verified during fiscal year 2024. The Department did not consider that documentation to support the review and approval of these reports was necessary to ensure accuracy and compliance with reporting requirements. Effect: We did not identify any errors in the LIHEAP special reports. However, without a documented internal control, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department maintain sufficient documentation to support the completion of a review for accuracy and compliance of required LIHEAP special reports prior to submission. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. We would like to clarify that while the Department has indicated that review and approval procedures were developed in April 2024, the program manager stated that they were not implemented until February 2025, which is outside of our audit period. As a result, the Department was at risk for errors occurring and going undetected and uncorrected during fiscal year 2024.

FINDING 2024-230 The Department did not provide documented support to verify the accuracy of a Low-Income Home Energy Assistance (LIHEAP) performance report. Type of Finding: Significant Deficiency, Noncompliance AL Title: Low-Income Home Energy Assistance AL Number: 93.568 Federal Award Number: 2101IDLIE4, 2201IDLIE4, 2301IDLIEE, 2401IDLIEA, 2401IDLIEI Program Year: October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.302(b)(3) states that the recipient's financial management system must maintain records that sufficiently identify the amount, source, and expenditure of federal funds for federal awards. These records must contain information necessary to identify federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: During fiscal year 2024, the Department was required to submit one LIHEAP performance report to the Federal Government. The Department’s LIHEAP program manager compiled and submitted the report to the Office of Community Services. The Department was unable to provide the supporting documentation to confirm the accuracy of the information included in the report. Cause: The Department did not design and implement an internal control to ensure that sufficient documentation was maintained to support the accuracy of the required report. Effect: Without documented support for the LIHEAP performance report, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department maintain sufficient documentation to support information in LIHEAP performance reports. Management’s View: The Department Agrees with this Finding. Corrective Action: A process was developed that includes obtaining and documenting approval by the Bureau Chief. This process was shared with LSO following receipt of the FY23 review findings. Supporting documents can be provided again as needed. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit. The corrective action referenced above was not completed, by the Department’s own admission, until March 25, 2025, which would have been significantly after the fiscal year 2023 issuance of the Single Audit Report, and also would have left fiscal year 2024 and most of fiscal year 2025 without proper internal controls in place. Without an appropriate control in place the Department continued to risk errors in the report going undetected and uncorrected until March of 2025 which could lead to noncompliance.

FINDING 2024-231 Supporting documentation for subrecipient risk assessments for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program was not available for review. Type of Finding: Significant Deficiency, Noncompliance Related to Prior Finding: 2023-222 AL Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises AL Number: 93.391 Federal Award Number: 1 NH75OT000105-01-00, 6 NH75OT000105-01-00 Program Year: June 1, 2021 – May 31, 2024 Federal Agency: Department of Health and Human Services Requirement: Subrecipient Monitoring Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 2 CFR 200.332(b) states that all pass-through entities must evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Additionally, 2 CFR 200.332(c)(2) states that all pass-through entities must evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the results of previous audits. This includes considering whether the subrecipient receives a Single Audit in accordance with 2 CFR 200 subpart F and the extent to which the same or similar subawards have been audited as a major program. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises program had a total of 6 subrecipients during fiscal year 2024. During testing, the Department was unable to provide a subrecipient risk assessment for 2 out of 6 subrecipients tested (or 33 percent). In the risk assessment, the Department documents the need for a subrecipient to have a Single Audit, if necessary, and the Department’s review of required subrecipient Single Audits. The Department was compliant with all other aspects of the subrecipient monitoring compliance requirements for the subrecipients. Cause: Staff turnover led to the documentation creation and retention shortcomings as new staff were being trained and onboarded when risk assessments should have been completed and documented, including Single Audit requirements. Effect: The Department is exposed to increased risk of noncompliance related to subrecipients and improper payments in the STLT Health Department Response to Public Health or Healthcare Crises program. Recommendation: We recommend that the Department strengthen internal controls to ensure required risk assessments are completed and supporting documentation is retained. Management’s View: The Department Agrees with this Finding. Corrective Action: The Division of Public Health updates its standard operating procedures annually and communicates updates to staff. The DPH Federal Compliance Officer is conducting monthly trainings to cover all required steps in the process and will begin conducting mini audits in calendar year 2026 to ensure all steps are being followed consistently. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-232 An incorrect Federal Medical Assistance Percentage (FMAP) rate was applied while calculating the federal and state share of expenditures for the Child Care and Development Fund (CCDF) financial report resulting in an understatement of $1,064,932 of the federal share of costs. Type of Finding: Significant Deficiency, Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Matching, Level of Effort, Earmarking Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 42 CFR 98.55(a) states that federal matching funds are available for expenditures in a state based upon the formula specified in 42 CFR 98.63(a). Also, 42 CFR 98.55 (b) states that expenditures in a state under paragraph (a) of this section will be matched at the federal medical assistance rate for the applicable fiscal year for allowable activities, as described in the approved State Plan, that meet the goals and purposes of the Act. Additionally, 42 CFR Section 98.55 (c) states that in order to receive federal matching funds for a fiscal year under paragraph (a) of this section: (1) States shall also expend an amount of non-Federal funds for child care activities in the State that is at least equal to the State's share of expenditures for fiscal year 1994 or 1995 (whichever is greater) under sections 402(g) and (i) of the Social Security Act as these sections were in effect before October 1, 1995; and (2) The expenditures shall be for allowable services or activities, as described in the approved State Plan if appropriate, that meet the goals and purposes of the Act. (3) All Mandatory Funds are obligated in accordance with Section 98.60(d)(2)(i). Condition: The Department is required to complete a CCDF financial report, Form ACF-696, on a quarterly basis for each grant. We found that 1 out of 4 CCDF financial reports tested (or 25 percent), had an incorrect FMAP rate applied while calculating the federal and State share of expenditures, understating federal funds by $1,064,932. Cause: Staff turnover, insufficient training, and the implementation of Luma caused an incorrect FMAP rate to be applied while calculating the federal and state share of expenditures on the CCDF financial report. In addition, the review procedures were not completed at a level sufficient to identify an error. Effect: An incorrect FMAP rate was applied causing federal funds to be understated by $1,064,932. Recommendation: We recommend that the Department strengthen internal controls over the application of FMAP rates and review the reports at a level sufficient to identify errors. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department's Grant Reporting team has been developing additional internal controls to put in place with the utilization of the Luma ERP. These controls include conducting reconciliations between internal workpapers and Luma records as well as reconciling to external parties such as the Payment Management System. This has streamlined our approach and has allowed management more opportunity to review items with higher risk factors, such as the quarterly change in FMAP rates during the stepdown from enhanced FMAP rates during COVID. We believe these increased focused efforts will alleviate issues like this in the future and are ongoing as the Department identifies opportunities for advancements in our own processes and working with SCO to implement better Luma reports and controls within the grant reconciliation process. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-233 The submission of Child Care and Development Fund (CCDF) financial report was not completed timely. Type of Finding: Significant Deficiency, Noncompliance AL Title: Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund AL Number: 93.575, 93.596 Federal Award Number: 2001IDCCDF, 2001IDCCC3, 2401IDCCDD, 2401IDCCDF, 2401IDCCDM Program Year: October 1, 2019 – September 30, 2022, March 27, 2020 – September 30, 2023, October 1, 2023 – September 30, 2025, October 1, 2023 – September 30, 2026 Federal Agency: Department of Health and Human Services Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The Uniform Guidance included in 45 CFR 98.65(g) states that Lead Agencies shall submit financial reports, in a manner specified by the ACF, quarterly for each fiscal year until funds are expended. Additionally, Form ACF-696 (Financial Reporting Form for State and Territory Child Care and Development Fund (CCDF) Lead Agencies) states that this form must be submitted quarterly, reports are due 30 days after the end of the quarter: Quarter 1 by October 31, Quarter 2 by April 30, Quarter 3 by July 31, and Quarter 4 by January 31. Condition: The Department is required to complete a CCDF financial report, Form ACF-696, on a quarterly basis for each grant. Each report must be submitted within 30 days after the end of the applicable quarter. We found 1 out of 4 ACF-696 tested (or 25 percent) was submitted 2 months after the due date. The report for the quarter ended September 30, 2023, was submitted in January 2024. No other compliance or substantive errors were noted related to the report submission. Cause: Staff turnover, insufficient training, and the implementation of Luma caused the Department’s late submission of the required Form ACF-696 for the quarter ended September 30, 2023. The Department requested an extension from the ACF to complete necessary adjustments, but the request was denied. Effect: Late submission of the report resulted in the Department’s noncompliance with federal requirements. Recommendation: We recommend that the Department strengthen internal controls to ensure the timely submission of the CCDF financial report, Form ACF-696. Management’s View: The Department Agrees with this Finding. Corrective Action: The Department has seen an increased time commitment related to financial grant reporting since the implementation of Luma in July 2023. This was particularly relevant in SFY 2024 as Luma implementation, training and interfaces were still evolving, resulting in a tremendous increase in time commitments without the corresponding staff increases needed. In many cases, this resulted in late filings and/or filing reports that were not reviewed in sufficient detail. The Division of Financial Services continues to work through the inefficiencies encountered and design processes that include sufficient review and other internal controls while also allowing for timely completion of required reports. One FTE was transferred from another team to the Cash and Grants team. This position is expected to assist in completing preliminary tasks so that Grant Reporters have necessary data at their fingertips when drafting financial reports. As Department staff continue to learn nuances of the Luma system, both accuracy and timeliness of financial reporting is expected to improve. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-234 Payroll adjustments lacked sufficient internal controls. Type of Finding: Significant Deficiency AL Title: Immunization Cooperative Agreements, Temporary Assistance for Needy Families, Child Care and Development Block Grant, Child Care Mandatory and Matching Funds of the Child Care and Development Fund, State Survey and Certification of Health Care Providers and Suppliers (Title XVIII) Medicare, Medical Assistance Program AL Number: 93.268, 93.558, 93.575, 93.596, 93.777, 93.778 Federal Award Number: Various Program Year: Various Federal Agency: Department of Health and Human Services Requirement: Activities Allowed or Unallowed, Allowable Costs/Costs Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The State implemented a new Enterprise Resource Planning system, Luma, in July 2023. Due to the implementation, and insufficient experience, some transactions were entered incorrectly into Luma. Necessary adjustments were completed by both the Department and the Office. We noted 21 out of 42 payroll adjustments tested (or 50 percent) that were not properly reviewed and approved, and of those 21 noted payroll adjustments, 4 were completed by the Office, and 17 were completed by the Department. Additionally, of those 21 noted payroll adjustments, 6 were completed by the Department and had the same personnel submitting, approving, and releasing the adjustment. The remaining 15 payroll adjustments had no documented review and approval information. Cause: The majority of the noted deviations were processed in the beginning of fiscal year 2024. According to the Department’s personnel, the reviews of payroll adjustments were not consistently documented following the implementation of Luma. The significant number of adjustments processed and time constraints were provided as the reason the Department had the same personnel submit, approve, and release the adjustments. In addition, according to Office personnel, multiple adjustments were processed due to a statewide correction to the benefit coding in the beginning of fiscal year 2024. An incorrect account was used to record benefits. This correction was reviewed by the Department’s payroll team and followed the financial payroll correction process. However, there was no documentation of the review process. Effect: We did not identify any substantive or compliance errors during testing over payroll adjustments. However, without documentation of a review and approval, there is an increased risk of errors occurring and going undetected. Recommendation: We recommend that the Department consistently maintain documentation of implemented review and approval procedures over payroll adjustments. We further recommend that the Department request that it be provided appropriate documentation of any adjustments made by the Office on its behalf. Management’s View: The Department Agrees with this Finding. Corrective Action: The department has established internal controls to ensure appropriate separation of duties and proper documentation of all reviews. When an accounting adjustment is required, staff prepare the adjustment using either an Infor Spreadsheet Designer (ISD) template or an Excel template. ISD is used for adjustments involving large volumes of data. Because ISD-generated adjustments cannot be reviewed within the system after entry, the completed template is sent to a Financial Specialist Principal (or higher) for review prior to upload. Email approval is obtained and attached to the adjustment record when it is entered into the system. For adjustments involving smaller amounts of data, staff use the Excel template. The Excel template, original GL lines, supporting documentation, and any other relevant information are attached when the adjustment is entered. After the manual adjustment is submitted, it is automatically routed to a Financial Specialist Principal (or higher) for approval before final posting. These procedures ensure that all adjustments undergo an independent review and that documentation is consistently maintained. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-235 Quarterly financial reports for the Social Security Disability (DI) grant were submitted after the required deadline. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Social Security Disability Insurance Assistance Listing Number: 96.001 Federal Award Number: 23-04IDD100; 24-04IDD100 Program Year: October 1, 2022 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: Social Security Administration Compliance Requirement: Reporting Questioned Costs: None The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Social Security Administration (SSA) oversees the administration of the DI program with comprehensive guidance provided in the Program Operations Manual System (POMS). At the end of each quarter, the State Disability Determination Services (DDS) submits a Form SSA-4513, State Agency Report of Obligations for SSA Disability Programs, to account for program disbursements and obligations, and a Form SSA-4514, Time Report of Personnel Services for Disability Determination Services, to account for employee time. The State DDS is required to submit the forms to the designated SSA regional office, which, pursuant to POMS sections DI 39506.202 and DI 39506.230, is responsible for setting the submission deadlines for quarterly reports. The State’s designated regional office has mandated a deadline of thirty days following the conclusion of each fiscal quarter. Condition: The Department submitted four reports during our audit period. We selected a sample of 2 quarterly reports, each including forms SSA-4513 and SSA-4514, to test for compliance and internal controls. The Department has a control procedure in place for the reports to be reviewed by a qualified person prior to submission. Our testing found that reports were submitted 17 and 23 days after the established deadline set by SSA’s regional office. However, no substantive errors were identified in our testing, and we confirmed that the internal control procedure for accuracy was operating as designed. Cause: Reports were submitted late due to delays in obtaining the payroll data needed to comply with the U.S. Department of Labor’s modified accrual-based grant reporting requirements. Payroll is processed biweekly for the prior timesheet period, creating a delay in the availability of the previous month’s data. In prior years, the Department estimated payroll costs, which led to inaccuracies in federal quarterly reports. Although adjustments were made in the following quarter, they did not align with the actual payroll reporting periods. With the implementation of the State’s current accounting system (Luma), the Department prioritized using actual payroll data to improve accuracy, even if it resulted in late report submissions. Effect: Late report submissions may hinder timely oversight by the federal regulator and delay identification of potential financial or compliance issues. Recommendation: We recommend that the Department consider additional methods to ensure timely submission of reports. Management’s View: The Idaho Department of Labor agrees with the audit finding. Prior to Luma go-live, our legacy cost accounting system was programmed to accrue payroll monthly by grant. The process was programmed into our system to provide estimated payroll earlier than when it paid out in the state system, meaning cost accounting could close the period on a timeline that allowed our reporting staff to file our quarterly federal reports before their due date. Our legacy process then called for a quarterly true-up in the subsequent quarter of our internal cost accounting system to the state system (STARS). This lag between the accrual and the true-up meant that expenses were not fully accounted for or reported in the quarter in which they were incurred. In Luma, complete accrued monthly payroll data is not available until the final payroll for the prior month pays out. There is no mechanism for us to estimate payroll to close the month early like we did in legacy. Because of the timing of the bi-weekly payrolls, there are some months when the final payroll for the quarter does not pay out in Luma until close to the due date for some of our quarterly federal reports. Once that payroll is posted in Luma, it currently takes approximately 10 days to do final entries for the month and then close the period. Many of our federal reports are not due until 45 days after the end of the quarter. Since Luma go-live we have made significant process improvements that now allow us to close the period and file those reports in time. For a couple of our grants, the federal report’s due date is 30 days after the end of the month. Filing those reports within the 30-day filing window has been very challenging due to the lag in payroll and closing described above. The DDS program is one such program where the federal report is due 30 days from the end of the quarter. Corrective Action: The department is taking several steps to provide for a faster month-end close: Step 1: Process Mapping of Cost Accounting Closing a. As part of our strategic planning initiative, document the new closing process in Luma through process maps b. Review process maps internally in accounting and with executive leadership to help identify areas where efficiencies could be achieved c. Implement identified areas of efficiency Step 2: Assess potential for expedited close on quarter-end months a. Cost Accounting manager, supervisor and financial executive officer to review calendar and timing of payroll for quarter-end closings b. Cost Accounting manager, supervisor, and financial executive officer to develop plans for expedited close with potential for overtime, pulling additional resources from other teams and any other options that may help shorten the close period to allow us to file quarterly federal reports timely. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-236 The review and approval of quarterly special reports for the Unemployment Insurance (UI) program were not consistently documented, and the reports were submitted after the required deadline. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Unemployment Insurance Assistance Listing Number: 17.225 Federal Award Number: 24A55UI000030-01; 23A03UI039319-01; UI-35645-21-55-A-16; 23A55UI034712-01 Program Year: October 1, 2023 – December 31, 2026; October 1, 2022 – December 31, 2025; October 1, 2020 – December 31, 2023; April 1, 2020 – June 30, 2024 Federal Agency: U.S. Department of Labor Compliance Requirement: Reporting Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include items such as approvals, authorizations, verifications, reconciliations, and segregation of duties. The Quarterly UI Above-Base (UI-3) report requires information on staff years worked and paid by program category. The reports are due within 30 days after the end of the reporting quarter as required by the U.S. Department of Labor, per the Employment and Training (ET) Handbook No. 336, Unemployment Insurance State Quality Service Plan Planning and Reporting Guidelines. Condition: We tested all 4 UI-3 quarterly reports that were due during our audit period. Our evaluation determined that 3 out of the 4 reports were submitted after the established deadline. Only the first quarterly report, covering the period ending June 30, 2023, and prepared using the State’s prior accounting system (STARS), was submitted by the deadline. The 3 subsequent quarterly reports, prepared after the State’s transition to Luma, were submitted 13, 31, and 35 days late. The Department has a control procedure in place for the reports to be reviewed by a qualified person prior to submission. Our testing found that 1 of the 4 quarterly reports was missing documented approval, typically retained via e-mail. Cause: Reports were submitted late due to delays in obtaining the payroll data needed to comply with the U.S. Department of Labor’s modified accrual-based grant reporting requirements. Payroll is processed biweekly for the prior timesheet period, creating a delay before the previous month’s data is available. In prior years, the Department estimated payroll costs, which led to inaccuracies in federal quarterly reports. Although adjustments were made in the following quarter, they did not align with the actual payroll reporting periods. With the implementation of Luma, the Department prioritized using actual payroll data to improve accuracy, even if it resulted in late report submissions. The Department was in the process of updating their reporting procedures and did not require documentation of the controls to be retained at the time. Effect: Without a documented review, there is an increased risk that the reports contain inaccurate data. Further, late report submissions may hinder timely oversight by the federal regulator and delay identification of potential financial or compliance issues. Recommendation: We recommend that the Department design and implement internal controls to ensure reports are submitted on time and sufficient documentation is maintained to support the completion of a review for accuracy and compliance. Management’s View: The Idaho Department of Labor agrees with the audit finding. During the period in question, our federal reporting team was in the process of transitioning reporting duties from the financial specialist principal over reporting to the financial specialist senior over reporting. During the training process, one report was completed and reviewed in tandem as part of the training process and no paper trail was retained to document that the report had been properly reviewed by the financial specialist principal. Once the handoff of the task was completed, subsequent reports were prepared by the financial specialist senior and then queued to the principal for review, and the paper trail was properly captured and retained. Prior to Luma go-live, our legacy cost accounting system was programmed to accrue payroll monthly by grant. The process was programmed into our system to provide estimated payroll earlier than when it paid out in the state system, meaning cost accounting could close the period on a timeline that allowed our reporting staff to file our quarterly federal reports before their due date. Our legacy process then called for a quarterly true-up in the subsequent quarter of our internal cost accounting system to the state system (STARS). This lag between the accrual and the true-up meant that expenses were not fully accounted for or reported in the quarter in which they were incurred. In Luma, complete accrued monthly payroll data is not available until the final payroll for the prior month pays out. There is no mechanism for us to estimate payroll in order to close the month early like we did in legacy. Because of the timing of the bi-weekly payrolls, there are some months when the final payroll for the quarter does not pay out in Luma until close to the due date for some of our quarterly federal reports. Once that payroll is posted in Luma, it currently takes approximately 10 days to do final entries for the month and then close the period. Many of our federal reports are not due until 45 days after the end of the quarter. Since Luma go-live we have made significant process improvements that now allow us to close the period and file those reports in time. For a couple of our grants, the federal report’s due date is 30 days after the end of the month. Filing those reports within the 30-day filing window has been very challenging due to the lag in payroll and closing. The UI program is one such program where the UI-3 report is due 30 days from the end of the quarter. Corrective Action: The department has taken measures to ensure proper documentation of the review process: Step 1: Provide a designated place on the UI-3 back-up documentation and quarterly report work papers for reviewer to sign off directly in the work papers. Step 2: The individual who enters the report into the federal system will not proceed with entering the report into the system unless the workpapers have the review and approval in the workpapers. The department is taking several steps to provide for a faster month-end close: Step 3: Process Mapping of Cost Accounting Closing a. As part of our strategic planning initiative, document the new closing process in Luma through process maps b. Review process maps internally in accounting and with executive leadership to help identify areas where efficiencies could be achieved c. Implement identified areas of efficiency Step 4: Assess potential for expedited close on quarter-end months a. Cost Accounting manager, supervisor and financial executive officer to review calendar and timing of payroll for quarter-end closings b. Cost Accounting manager, supervisor, and financial executive officer to develop plans for expedited close with potential for overtime, pulling additional resources from other teams and any other options that may help shorten the close period to allow us to file quarterly federal reports timely. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

FINDING 2024-237 The Division could not provide supporting documentation for amounts included on the Rehabilitation Services Administration (RSA) reports required under the Rehabilitation Services-Vocational Rehabilitation Grants to States. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Reporting Questioned Costs: $1,445,110 Known Criteria: The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out throughout the operation. Verifications, approvals, and authorizations are all control activities that support this objective. The U.S. Code of Federal Regulations (CFR), 2 CFR 200.303, states that the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Section CFR 200.302 – Financial Management states that federal award recipient’s financial management system must identify all federal awards received and expended and the federal programs under which they were received. Additionally, they must maintain records that sufficiently identify the amount, source, and expenditure of federal funds for federal awards. These records must contain information necessary to identify federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. Condition: The RSA requires the Division to submit financial reports (RSA-17) every 6 months. The reports are cumulative and cover the entire grant period through to the end of the reporting period. Reporting periods end on March 31 and September 30. If the reporting period is the final report for the grant, the report is due 120 days after the close of the period. All other reports are due 30 days after the close of the period. Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. In State fiscal year 2024, there were 3 grants open – federal fiscal years 2022, 2023, and 2024. The Division was required to submit 4 reports for these grants. We compared the federal expenditure amounts reported for the grant in total and for the Pre-Employment Transition Services (Pre-ETS) to the amounts in Luma and found errors in all 4 as follows: Total Expenditures Grant Year Report Period End RSA-17 Amount Luma Amount Difference Federal Fiscal Year 2022 9/30/23 $14,601,067 $13,941,207 $659,860 Federal Fiscal Year 2023 9/30/23 $7,633,338 $7,465,827 $167,511 Federal Fiscal Year 2023 3/31/24 $16,823,595 $16,661,795 $161,800 Federal Fiscal Year 2024 3/31/24 $2,007,420 $2,077,874 $(70,454) TOTAL $918,717 Pre-ETS Grant Year Report Period End RSA-17 Amount Luma Amount Difference Federal Fiscal Year 2022 9/30/23 $2,579,855 $2,991,527 $(411,672) Federal Fiscal Year 2023 9/30/23 $3,083,866 $2,869,311 $214,555 Federal Fiscal Year 2023 3/31/24 $5,596,382 $5,005,941 $590,441 Federal Fiscal Year 2024 3/31/24 $211,681 $78,612 $133,069 TOTAL $526,393 Cause: Reports were prepared by former employees, and the current personnel could not determine why the reported amounts did not match Luma. Further, supporting documentation was not retained by the Division, which might have provided insight into the differences. Effect: The RSA uses the RSA-17 reports to determine compliance with federal statutes, regulations, and the terms and conditions of the federal award. Incorrect reporting can affect both the ability to cover current obligations and the amount of future federal grant awards received by the State of Idaho. We are questioning the amount that Division cannot support for reported total expenditures and pre-ETS expenditures of $918,717 and $526,393, respectively. Recommendation: We recommend that the Division design and implement procedures to ensure accurate federal grant reporting and retain appropriate documentation to support the amounts reported. We also recommend that the Division review prior submissions, identify correct reporting, and communicate with the federal grantor about resubmitting corrected reports. Management’s View: The issues uncovered during the single audit are in alignment with challenges and weaknesses uncovered over the last 17 months. As such, we are in agreement with the seven identified findings specified in the Management letter. The Division will ensure the accuracy, reliability, and sufficient supporting documentation of financial data pulled from the state accounting system of record (LUMA) that is reported on all RSA-17 reports by implementing effective internal controls, verification procedures, and record retention practices in compliance with 2 CFR 200.302 and 2 CFR 200.303. Corrective Action: 1.1 Establish Accurate Reporting Procedures: Develop and implement procedures for preparing, reviewing, and approving all RSA financial reports, including step-by-step reconciliation. 1.2 Ensure Documentation and Audit Trail: Maintain comprehensive supporting documentation for all amounts reported, including detailed reconciliations, adjustments, and source data, in accordance with requirements for traceable and verifiable records. 1.3 Strengthen Internal Controls and Oversight: Implement Strategic Leadership review of all reports prior to submission to the Rehabilitation Services Administration to confirm data accuracy and compliance with reporting requirements. 1.4 Complete a Restatement of RSA-17 Reports: Review previously submitted RSA-17 reports for fiscal years 2022–2024, determine accurate expenditure amounts, and coordinate with RSA to correct and resubmit revised reports, if necessary. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. While the Division’s corrective action plans indicate that portions are complete, because they have occurred outside of the period under audit, we have not reviewed those actions to see that they are effective at addressing the issues identified.

FINDING 2024-238 The Division did not comply with Matching, Level of Effort, and Earmarking requirements for the fiscal year 2022 Rehabilitation Services-Vocational Rehabilitation Grants to States program. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Matching, Level of Effort, Earmarking Questioned Costs: $51,728 Known Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 361.62, Maintenance of effort requirements, states (a) General requirements. The Secretary (of Education) reduces the amount otherwise payable to a State for any fiscal year by the amount by which the total expenditures from non-Federal sources under the vocational rehabilitation services portion of the Unified or Combined State Plan for any previous fiscal year were less than the total of those expenditures for the fiscal year two years prior to that previous fiscal year. Condition: Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. In State fiscal year 2024, there were 3 grants open – federal fiscal years 2022, 2023, and 2024. Maintenance of effort is one part of the level of effort grant requirements. The federal fiscal year 2022 grant period ended on September 30, 2023. It is the only grant that we could evaluate for level of effort compliance because it is the only one that ended within State fiscal year 2024, which is the period of our audit. The Division is required to spend at least the amount of State funds expended in the fiscal year two years prior. We compared State expenditures for the federal fiscal years 2020 and 2022 grants based on amounts reported on the RSA-17 reports. RSA-17 Report RSA-17 Report Federal Fiscal Year 2020 Grant Expenditures Federal Fiscal Year 2022 Grant Expenditures Difference $4,508,835 $4,222,109 $(286,726) This analysis found that the Division did not meet level of effort requirements because State spending for the federal fiscal year 2022 grant was $286,726 less than State spending for the federal fiscal year 2020 grant. We performed additional analysis on the amounts reported and compared them to the underlying information in Luma and STARS due to errors we identified in the RSA-17 reports; also described in Finding 2024-237. We found that the amounts reported for the federal fiscal years 2020 and 2022 grants did not match the amounts recorded in Luma or STARS, and the Division could not provide documentation to support the differences. We compared the State expenditures for federal fiscal years 2020 and 2022 grants based on the amounts recorded in Luma and STARS. Accounting System Accounting System Federal Fiscal Year 2020 Grant Expenditures (STARS) Federal Fiscal Year 2022 Grant Expenditures (Luma and STARS) Difference (STARS) $4,072,786 $4,021,058 $(51,728) In both of our analyses, the Division still failed to meet level of effort requirements. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. The staff in place during our single audit procedures were not the same as the staff who compiled the RSA-17 reports for the federal fiscal years 2020 or 2022 grants and could not locate any documentation to support the amounts reported or verify that the Division had internal controls in place to monitor the matching, level of effort, or earmarking requirements for compliance. Effect: We did not identify any errors with the matching or earmarking requirements, however, reporting errors, when corrected, could result in noncompliance. The noncompliance with the level of effort requirements could result in the RSA reducing the federal grant award to the Division for the federal fiscal year 2025 grant. Recommendation: We recommend that the Division design and implement procedures to ensure compliance with matching, level of effort, and earmarking requirements. We also recommend the Division contact the federal grantor to resolve the noncompliance related to the level of effort requirement. Management’s View: The Division will ensure compliance with all matching, level of effort, and earmarking requirements by developing and implementing internal control processes, accurate financial tracking mechanisms, and adequate supporting documentation for all federal grant expenditures. Corrective Action: 2.1 Develop and Implement Written Policy (Grants Management Manual Section) and Procedures: Establish documented procedures for monitoring and validating compliance with state match funds, maintenance of effort (MOE), and earmarking requirements for each active RSA grant. 2.2 Training and Staff Accountability: Train fiscal and leadership staff responsible on grant calculation methods, documentation standards, and compliance monitoring for matching and level of effort requirements. 2.3 Ongoing Monitoring: Conduct annual compliance reviews before report submission to verify that all level of effort and earmarking requirements are satisfied and adequately supported. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. While the Division’s corrective action plans indicate that portions are complete, because they have occurred outside of the period under audit, we have not reviewed those actions to see that they are effective at addressing the issues identified.

FINDING 2024-239 The Division does not have documented control procedures in place to ensure compliance with period of performance requirements for the Rehabilitation Services-Vocational Rehabilitation Grants to States. Type of Finding: Material Weakness Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Period of Performance Questioned Costs: Undetermined Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: Grants are issued for an initial 12-month period. If State match requirements are met within the initial period, recipients qualify for an additional 12-month carryover period to spend any unobligated federal funds. Including the carryover period, the federal fiscal year 2024 grant period is October 1, 2023, through September 30, 2025. In State fiscal year 2024, there were 3 grants open – federal fiscal years 2022, 2023, and 2024. The Division uses Aware, a case management system which documents clients’ Individual Plans for Employment (IPE). The IPEs have employment goals, planned services, estimated costs, client responsibilities, and criteria for evaluating progress. Expenditures are initially entered into Aware and uploaded into Luma for payment. The Division uses project codes in Aware to designate expenditures to specific grant periods. The project codes correlate to grant codes in Luma when transactions are uploaded from Aware. Grant codes are used to track expenditures and period of performance for each grant award. Client expenditures are entered into Aware, and Regional Managers review the entries for accuracy, including the correct project code for the period of performance. As grant periods begin and end, the project codes in Aware need to be changed to correlate to new grant codes in Luma. The Division stated that, in past years, the changes to the project codes would be discussed among the fiscal staff and communicated to the regional managers, and the final changes were reviewed for accuracy and inclusion in the proper period. The Division made changes to the project codes but could not provide documentation to confirm these changes were reviewed and approved in fiscal year 2024. Further, the Division could not provide documentation of any additional procedures to evaluate period of performance at an overall program level that would detect errors in the coding of project codes or federal grant codes. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. This likely contributed to internal controls not being properly executed. Documentation was not retained to verify internal controls. Effect: Regional managers review transaction entries to ensure they are for allowable costs and coded to the correct project codes to comply with period of performance requirements. This control procedure is ineffective if the project codes in Aware are not linked to the correct grant codes in Luma. The Division does not have any other control procedures in place to evaluate period of performance at an overall program level, which increases the risk of noncompliance. Our testing did not identify any noncompliance with period of performance requirements, however, without effective controls in place, errors could be made and remain undetected. Recommendation: We recommend that the Division design and implement control procedures to ensure compliance with period of performance requirements and maintain documentation to demonstrate both that controls were operating as intended and compliance was achieved. Management’s View: To ensure that all federal grant expenditures are properly recorded within their authorized period of performance by implementing documented internal controls, verification processes, and documentation retention procedures. Corrective Action: 3.1 Document Control Procedures: Develop and implement formal, written procedures (Grants Management Manual Chapter) for verifying that expenditures are assigned to the correct period of performance in both Aware and Luma. 3.2 Training: Train IDVR team members on policies and procedures tied to Period of Performance. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We would like to emphasize that staff training should be an ongoing activity to ensure that staff are knowledgeable about the program and the requirements to accepting federal assistance. Additionally, implementation of internal controls as identified in the grants management manual will be critical to ensuring compliance. Also, while the Division’s corrective action plans indicate that portions are complete, because they have occurred outside of the period under audit, we have not reviewed those actions to see that they are effective at addressing the issues identified.

FINDING 2024-240 The Division is not following Idaho Administrative Rules for Purchasing as required by federal requirements. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include approvals, authorizations, verifications, reconciliations, and segregation of duties. The CFR procurement standards at 2 CFR 200.317 states that, when procuring property and services under a federal award, a state must follow the same policies and procedures it uses for procurements from its nonfederal funds. The state of Idaho purchasing rules within the Idaho Administrative Procedures Act (IDAPA) contain the following provisions: IDAPA 38.05.01.32. Total Cost: The acquisition cost of property, including all components, options, and add-ons available under the contract, related services, and, in the case of ongoing services, the cost of the full term of the contract, including all authorized renewals. Unless a different total term is provided in the contract, the term used for purposes of total cost is five (5) years. IDAPA 38.05.01.041. Acquisition Procedures: • Small Purchases: Services with less than $25,000 total cost; software with less than $15,000 total cost; property with less than $15,000 total cost; a mix of property and services less than $15,000. o Small purchases do not require acquisition through competitive solicitation. Agencies must comply with the division’s small purchase policy. Property available under single agency or open contracts shall be purchased under such contracts and are not a small purchase under this rule unless otherwise authorized by the administrator. • Informal Purchases: Acquisition of property with a total cost exceeding the dollar limits established in this rule for a small purchase and less than the formal sealed procedure limit are informal purchases. o Informal Purchases may be made using:  An informal solicitation issued through e-procurement, unless exempted by the administrator; or  The formal sealed procedure, when the purchasing authority makes a written determination that using a formal solicitation is in the best interest of the state, including where selection based solely on cost is not appropriate. o Agencies procuring property under this rule shall maintain a purchasing file containing:  The solicitation document posted and quotes received. If the acquisition was not publicly posted, the agency shall include a statement describing the justification for determining that posting was impractical or impossible, along with the administrator’s authorization.  If not using e-procurement, the agency shall document the quotes received (or its attempt to obtain quotes) from at least three (3) vendors having a significant Idaho economic presence as defined in Section 67-2349, Idaho Code. • Formal Sealed Procedure: o The sealed procedure limit is one hundred fifty thousand dollars ($150,000). o Purchases of property in excess of the sealed procedure limit are made using the formal sealed procedure, unless exempted by these rules or the administrator. IDAPA 38.05.01.042.01. Exceptions requiring written administrator approval. The administrator may exempt the following purchases from the requirement for competitive solicitation by issuing a written determination to the purchasing authority. • Rehabilitation Agency Acquisitions. Acquisitions of property that is provided by non-profit corporations and public agencies operating rehabilitation facilities serving the handicapped and disadvantaged and that is offered for sale at fair market price as determined by the administrator in accordance with these rules. The buyer must submit a written request to the administrator to purchase from a rehabilitation agency and a written approval from the administrator. The purchase must comply with the division’s policy for rehabilitation agency acquisitions. Condition: We identified a population of 75 vendors that were paid more than $25,000 in fiscal year 2024 by the Division. The total dollar value of that population is $7,366,145 and we also identified 18 vendors within that population that received total payments that were large enough to be considered individually significant, based on materiality. We reviewed all of those 18 vendors and also selected a random sample of 6 vendors from the remaining 57 vendors in our population to arrive at a total testing group of 24 vendors. We evaluated if the Division’s internal controls were properly designed, in place, and effective in preventing or detecting errors. We also assessed if the Division was in compliance with procurement policies, both as required by the Rehabilitation Services – Vocational Rehabilitation Grants to States program and the State. The main internal control that the Division relies on to ensure compliance is that appropriate personnel review the procurement documents and approve the contract or purchase made prior to payment. The Division could not provide evidence that the review and approval occurred for 3 of the 6 (or 50 percent) randomly sampled vendors, and for 2 of the 18 (or 11 percent) vendors that had significant payments. We also found that the Division could not provide documentation to show that State procurement policies were followed for 4 of the 6 (or 67 percent) sampled vendors and 4 of the 18 (or 22 percent) individually significant vendors. Cause: The Division misunderstood several purchasing requirements. It believed that an exemption for rehabilitation agencies applied to more vendors than just not-for-profit entities and public agencies. The Division also believed that the State purchasing policies did not apply to vendors with many small purchases that are individually below, but collectively exceed, the purchasing thresholds. This misunderstanding led to noncompliance with purchasing requirements. Effect: The State’s purchasing policies are designed to ensure that State and federal funds are expended efficiently to meet the goals of State and federal programs. By not following these policies, the Division could be overpaying for products and services and is not in compliance with federal grant requirements. Recommendation: We recommend that the Division design and implement procedures to ensure that State purchasing policies are followed. This should include training to ensure that staff understand what purchases require additional procedures. We further recommend that the Division design and implement procedures to ensure that appropriate documentation is retained to demonstrate compliance and that internal controls were operating as intended. Management’s View: The Division will ensure full compliance with Idaho Administrative Rules for Purchasing and applicable federal procurement standards by developing, implementing, and maintaining internal controls, procedures, and documentation of practices that verify all procurements, regardless of funding source or transaction size adhere to State and Federal purchasing requirements. Corrective Action: 4.1 Policy Alignment: Review and revise internal procurement policies and procedures to align with IDAPA 38.05.01, 2 CFR 200.317, and 2 CFR 200.303 requirements. 4.2 Training and Awareness: Provide training to all staff to ensure understanding of: 4.2.1 Purchasing thresholds and categories (small, informal, and formal purchases). 4.2.2 Documentation and approval requirements. 4.2.3 Process and documentation requirements for purchases requiring exemptions. 4.3 Internal Control Strengthening: Develop and implement internal control mechanisms to ensure compliance with State and Federal purchasing requirements. 4.4 Monitoring and Accountability: Establish a quality assurance and compliance monitoring process to perform monitoring of procurement transactions to verify compliance with Division policies and procedures. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2024-241 The Division did not verify that vendors receiving payments from the Rehabilitation Services – Vocational Rehabilitation Grants to States program, were not suspended or debarred prior to making federal grant payments. Type of Finding: Material Weakness, Material Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Procurement and Suspension and Debarment Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR) contains guidance that nonfederal entities must follow as a condition of receiving federal awards. This guidance in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 180.300) requires grantees to verify an entity is not suspended or debarred or otherwise excluded before entering into a covered transaction. The verification is accomplished by (1) checking the System for Award Management (SAM) exclusions maintained by the General Services Administration and available online, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Nonfederal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions, as defined by 2 CFR 180.220, include contracts for goods and services awarded under a non-procurement transaction (for example, grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria. Condition: We identified 75 vendors that were paid more than $25,000 in total expenditures in fiscal year 2024 by the Division. The total dollar value of that population is $7,366,145 and we identified 18 vendors within that population that received total payments that were large enough to be considered individually significant, based on materiality. We reviewed those 18 vendors and selected a random sample of 6 vendors from the remaining 57 vendors in our population to arrive at a total testing group of 24 vendors. The Division relies on appropriate personnel reviewing the documents that support verification that the vendor is not suspended or disbarred, and then indicate approval by e-mail, as its primary internal control to assure compliance with federal regulations. Our testing found that the Division could not provide the documentation to show that the review and approval occurred for 5 of the 6 (or 83 percent) sampled vendors and for 7 of the 18 (or 39 percent) vendors identified as individually significant. Cause: The Division has procedures in place to retain documentation showing the suspension and debarment reviews were completed, reviewed, and approved for new vendors added during fiscal years 2022, 2023, and 2024. However, the Division could not provide documentation to show that vendors added prior to fiscal year 2022 were subject to this process. Further, the Division does not perform any subsequent checks to ensure that vendors did not become suspended or debarred after they were initially added to the current statewide accounting system (Luma) or prior statewide accounting system (STARS) which increases the risk that payments could be made to a suspended or disbarred vendor. Effect: We reviewed all vendors selected as part of our testing and verified that none of them were on the SAM list as suspended or debarred. However, the Division does not have adequate controls in place to ensure that they are not entering into covered transactions with suspended or debarred vendors. Vendors can be suspended or debarred for many reasons including financial crimes such as fraud, embezzlement, or bribery, and other issues such as consistently poor performance on previous contracts or violations of laws. Taking steps to ensure vendors are not suspended or debarred is important to prevent fraud, waste, and abuse. Recommendation: We recommend that the Division develop and implement procedures to ensure that they are regularly reviewing vendors with whom it is contracted to ensure compliance with suspension and debarment requirements. Management’s View: The Division will ensure full compliance with federal suspension and debarment requirements by establishing and maintaining effective internal controls and procedures that verify and document vendor eligibility prior to contract execution and throughout the vendor relationship. 5.1 Corrective Action: Policy Development and Alignment: Revise the Division’s procurement and grant management procedures to include mandatory ongoing verification and documentation of suspension and debarment status for all vendors involved in covered transactions. 5.2 Systematic Verification Process: Implement a standardized process to verify vendor eligibility by: 5.2.1 Checking the System for Award Management (SAM.gov) exclusion list. 5.2.2 Retaining a copy of the verification record or certification in the procurement or vendor file. 5.2.3 Incorporating a suspension/debarment verification clause into agreements, contracts, authorizations for purchase, and purchase orders. 5.3 Ongoing Monitoring: Establish a control to periodically re-verify vendor status at least annually to identify changes in eligibility after the initial onboarding. 5.4 Training and Accountability: Provide training to all fiscal staff on: 5.4.1 Federal suspension and debarment requirements. 5.4.2 Verification methods and documentation expectations. 5.4.3 Proper retention of evidence. 5.4.4 Compliance Reviews: Implement periodic internal compliance reviews to ensure continued adherence to suspension and debarment verification requirements. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2024-242 The Division did not accurately report federal grant expenditures on the Schedule of Expenditures of Federal Awards (SEFA) Closing Package. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b ) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Additionally, 2 CFR 200.510 requires the State to prepare the SEFA, which must include the total federal awards expended for each individual federal award program. The Office of the State Controller requires agencies to complete the SEFA closing package and uses this information to compile the statewide SEFA. Condition: The Division prepared the SEFA closing package as required but could not provide documentation to show that the closing package was reviewed for accuracy prior to submission. Additionally, amounts on the SEFA did not agree with the underlying accounting records in Luma, and Division staff could not provide an explanation for the differences. We identified the following errors based on expenditure transactions that were coded to specific grants in the Federal Grant Fund in Luma: Assistance Listing SEFA Amount Luma Amount Difference 84.126A $18,785,454 $18,285,440 $500,014 93.369 $282,568 $242,954 $39,614 Total Difference $539,628 The Federal Grant Fund also contained transactions that were not directly coded to any specific grant in the amount of $1,168,908. The Division could not provide documentation to show how these expenditures were allocated to individual programs. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. Staff did not retain documentation to support amounts reported. Effect: The Division overstated expenditures, according to Luma, by $500,014 for the Rehabilitation Services-Vocational Rehabilitation Grants to States and also overstated expenditures, according to Luma, by $36,614 for the Independent Living State Grant. Additionally, expenditures in the amount of $1,168,908 were charged to the federal grant fund in Luma but are not identified by grant indicating that errors could be larger. Recommendation: We recommend that the Division design and implement procedures to accurately calculate the amounts reported in the SEFA closing package and to retain documentation supporting the amounts reported. Management’s View: The Division will ensure the accuracy, completeness, and appropriate documentation of all federal grant expenditures reported on the SEFA closing package by implementing effective reconciliation processes, internal review controls, and documentation retention procedures in compliance with 2 CFR 200.303 and 2 CFR 200.510. Corrective Action: 6.1 Develop and Implement Written SEFA Procedures: Create formal written procedures describing how SEFA amounts are compiled, reconciled, reviewed, and approved prior to submission within Grants Management Manual. 6.2 Strengthen Internal Controls and Oversight: Implement internal review and approval steps that require documented verification of SEFA amounts against Luma accounting records. 6.3 Ensure Accurate Grant Coding: Review and correct all federal grant fund transactions not assigned to specific grants, ensuring proper coding and allocation in Luma. 6.4 Training and Staff Development: Provide training to fiscal staff on SEFA preparation, reconciliation, and documentation requirements. 6.5 Establish Continuous Monitoring: Perform periodic reviews of federal expenditure coding and SEFA data to identify discrepancies before year-end reporting. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit. We would like to clarify that the SEFA closing package for the state fiscal year 2025 contains several grant phases including, but not limited to, the federal fiscal year (FFY) 2024 award and was due prior to this progress note so it is unclear which SEFA preparation the Division intends to have the improved internal controls impact.

FINDING 2024-243 The Division did not properly evaluate costs related to the Rehabilitation Services-Vocational Rehabilitation Grants to States program resulting in direct costs incorrectly being recorded as indirect costs for the grant. Type of Finding: Significant Deficiency, Noncompliance Assistance Listing Title: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Federal Award Number: H126A240016, H126A220016, H126A210016 Program Year: October 1, 2020 – September 30, 2022; October 1, 2021 – September 30, 2023; October 1, 2023 – September 30, 2024 Federal Agency: U.S. Department of Education, Rehabilitation Services Administration Compliance Requirement: Allowable Costs/Cost Principles Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions in the federal award. Section 2 CFR 200.403(d) describes factors affecting the allowability of costs. Except where otherwise authorized by statute, costs must meet a consistency treatment criterion to be allowable under federal awards. A cost should not be assigned to a federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the federal award as an indirect cost. This also applies for misapplying indirect costs as direct costs. Condition: We tested a sample of 60 transactions, plus 15 individually significant transactions, from the population of indirect costs incurred in State fiscal year 2022. Those costs were used to calculate the indirect cost rate used in fiscal year 2024. We identified 2 transactions from the sample of 60 (or 3 percent) and 1 (or 7 percent) individually significant transactions that should have been charged as direct costs. The 2 sampled transactions were $30 for training and $269 for postage. The individually significant transaction was $46,922 for laptops. We also tested a sample of 60 employee payroll transactions from the population of direct costs in fiscal year 2024 to determine that the costs were allowable and the Division’s internal control procedures were operating as intended. The Division could not provide documentation to confirm that 2 transactions (or 3 percent) were approved prior to entry in Luma. Cause: The Division has experienced a large amount of turnover in fiscal staff positions. Prior staff did not retain documentation, and current staff was unable to produce documentation to support the expenditure transactions or verify controls were in place and operating. Effect: The 3 indirect cost transactions that should have been recorded as direct costs caused the Division to draw a lower amount of grant funds than allowed. We did not find any compliance errors in our testing of payroll transactions; however, if control procedures are not operating as designed, errors could occur and not be detected. Recommendation: We recommend that the Division provide training to employees to correctly distinguish direct costs and indirect costs and design and establish procedures to ensure that documentation is retained to support transactions. Management’s View: To ensure all costs charged to federal grants are accurately classified as direct or indirect in accordance with federal cost principles, and to maintain documentation supporting all expenditures, approvals, and internal control activities in compliance with 2 CFR 200.303 and 2 CFR 200.403(d). Corrective Action: 7.1 Establish and Document Clear Cost Classification Procedures: Develop written procedures defining and distinguishing between direct and indirect costs. 7.2 Strengthen Internal Controls Over Cost Allocation: Implement review and approval controls to verify proper cost classification before posting transactions to Luma or inclusion in the indirect cost pool. 7.3 Enhance Staff Training and Knowledge: Provide targeted training for fiscal staff to ensure understanding of allowable cost principles and consistent application of cost classification policies. 7.4 Ensure Documentation Retention and Review: Maintain complete documentation supporting all cost allocations, including approval records, cost pool calculations, and reconciliations. 7.5 Perform Regular Monitoring and Verification: Conduct periodic reviews of both direct and indirect cost transactions to confirm classification accuracy and identify any required adjustments. Auditor’s Concluding Remarks: We thank the Division for its cooperation and assistance throughout the audit.

FINDING 2024-244 The Department’s original Schedule of Expenditures of Federal Awards submitted to the Office of the State Controller underreported the amount disbursed to subrecipients by $3,500,000 under the Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) program. Type of Finding: Significant Deficiency, SEFA Misstatement Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Federal Award Number: SLFRP0142 Program Year: March 3, 2021 – December 31, 2024 Federal Agency: Department of Treasury Compliance Requirement: U.S. Code of Federal Regulations (CFR) 200.510(b) Questioned Costs: None Criteria: The U.S. Code of Federal Regulations (CFR), 2 CFR 200.510(b), requires that the State prepare a Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year that must include the total federal awards expended. In addition, the total federal awards expended must be the total amount provided to subrecipients from each federal program. State agencies are required to report federal expenditures incurred for each federal program during the State fiscal year to the Office of the State Controller (Office) through the SEFA closing package. The Office provides instruction on the completion of the closing package. The Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) included in 2 CFR 200.303 requires that a nonfederal entity receiving federal awards establish and maintain internal controls that provide reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. The Internal Control Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies control activities that help ensure management directives are carried out and risks are mitigated. These activities include things like approvals, authorizations, verifications, reconciliations, and segregation of duties. Condition: The Department failed to report one subrecipient of CSLFRF program on the SEFA in fiscal year 2024. Cause: The Department does not have sufficient controls in place to prevent or detect errors on the SEFA before submission to the Office. Program staff determined that one recipient of CSLFRF funding was a subrecipient. However, review procedures were not performed at the level of detail necessary to ensure amounts passed on to the subrecipient were appropriately identified on the SEFA closing package and did not report all funds passed through. Effect: The statewide SEFA amounts reported as disbursed to subrecipients were underreported by $3,500,000. Recommendation: We recommend that the Department improve training and the review process for the SEFA closing package to ensure appropriate reporting of subrecipient expenditures on the SEFA. Management’s View: The Department of Water Resources agrees with the finding. Corrective Action: The Department will improve training and the review process for the SEFA closing package to ensure appropriate reporting of subrecipient expenditures on the SEFA. The Department will review the FY 20025 SEFA closing package that was submitted to the Office of the State Controller to ensure the appropriate subrecipient expenditures were reported. Auditor’s Concluding Remarks: We thank the Department for its cooperation and assistance throughout the audit.

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Government-Wide Guidance for Federal Financial Assistance. Part 170 – Reporting Subaward and Executive Compensation Information. Subpart A – General. § 170.100 Purpose of this part This part provides guidance to Federal agencies on establishing requirements for recipients of Federal awards to report information on subawards and executive total compensation, as required by the Federal Funding Accountability and Transparency Act of 2006 (Pub. L. 109-282), as amended by the Digital Accountability and Transparency Act of 2014 (Pub. L. 113-101) and other Public Laws, hereafter referred to as the “Transparency Act.” § 170.105 Applicability. (a) Applicability in general. This part applies to a Federal agency’s Federal financial assistance as defined in § 170.300. This part applies to all recipients and subrecipients of Federal awards who meet the reporting requirements of paragraph (c) of this section, unless exempt under Federal statute or by paragraph (d) of this section. (b) Non-applicability to individuals. This part does not apply to an individual who applies for or receives Federal financial assistance as a natural person (that is, unrelated to any business or nonprofit organization an individual owns or operates). (c) Reporting Requirements. 1) The names and total compensation of an entity’s five most highly compensated executives must be reported if: a) In the entity’s preceding fiscal year, it received: i) 80 percent or more of its annual gross revenue in Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and ii) $25,000,000 or more in annual gross revenue from Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and b) The public does not have access to information about the compensation of senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986. Appendix A to Part 170 — Award Term. I. Reporting Subawards and Executive Compensation (2 CFR 170): (a)(2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. (b)(2) Reporting Requirements. (i) As part of the recipient’s registration profile at https://www.sam.gov. (ii) No later than the month following the month in which this Federal award is made, and annually after that. Condition: Audit procedures included a review of 60 FFATA reporting submissions associated with subrecipients. During this review, we assessed compliance with federal reporting requirements and evaluated the adequacy of internal controls over the FFATA reporting process. Of the 60 subrecipients examined, we identified that FFATA reporting was not performed for 59 subrecipients. The audit procedures also identified a lack of effective internal controls to ensure timely and accurate reporting, as there were no documented procedures or monitoring mechanisms in place to verify that subrecipient data was submitted in accordance with federal guidelines. Questioned costs: None Context: See “Condition.” Cause: Procedures to perform the required FFATA reporting were not established by the Department. The absence of documented policies, assigned responsibilities, and monitoring mechanisms create an environment which may result in noncompliance with federal reporting. Effect: The lack of established procedures and internal controls for FFATA reporting resulted in noncompliance, with 59 out of 60 subrecipients not reported as required. Repeat Finding: This is not a repeat finding. Recommendation: The Department should implement and robust process and related internal controls to ensure timely and accurate FFATA reporting. These controls should include developing written policies and procedures that outline the steps for collecting subrecipient data, preparing reports, and submitting them within required timelines; assigning accountability by designating specific personnel responsible for compliance; and implementing a monitoring and review process to verify completion and accuracy of reporting. Additionally, training programs should be established to ensure staff understand reporting requirements, and automated tracking tools or checklists should be utilized to provide transparency and reduce the risk of missed submissions. By introducing these internal controls, the Department can strengthen its compliance framework, mitigate the risk of federal funding repercussions, and enhance overall operational integrity. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a review of 54 Form 9130 reports for administrative expenses and noted that none of the reports agreed to the Administrative Fund (870) general ledger. The total variance observed was $126,353,070. The audit procedures also identified a lack of effective internal controls to ensure timely and accurate reporting, as there were no documented procedures or monitoring mechanisms in place to verify that subrecipient data was submitted in accordance with federal guidelines. Questioned costs: None Context: See “Condition.” Cause: The discrepancy occurred because there is no formal reconciliation process between Form 9130 administrative expense reports and the Administrative Fund (870) general ledger. Additionally, roles and responsibilities for validating report accuracy are not clearly defined. Effect: The lack of a reconciliation process between Form 9130 reports and the Administrative Fund (870) general ledger may lead to inaccurate reporting. Repeat Finding: This is not a repeat finding. Recommendation: Management should establish a formal reconciliation process to ensure that Form 9130 administrative expense reports align with the Administrative Fund (870) general ledger. This process should include assigning responsibility to a designated finance team member for performing and documenting reconciliations, implementing a monthly reconciliation schedule, and promptly investigating and resolving any variances with documented approvals. Additionally, financial reporting policies should be updated to incorporate reconciliation requirements, and staff should receive training on compliance and reconciliation procedures to strengthen internal controls and reduce the risk of reporting inaccuracies. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 20 – Employees’ Benefits. Chapter V – Employment and Training Administration, Department of Labor. Part 614 – Extended Benefits in the Federal-State Unemployment Compensation Program. Subpart B – Administration of Extended Benefits Program. § 614.11 Determinations of eligibility; notices to individuals (20 CFR 614.11): (f) Application of State law. (1) Except as indicated in paragraph (a) of this section, any provision of State law that may be applied for the recovery of overpayments or prosecution for fraud, and any provision of State law authorizing waiver of recovery of overpayments of unemployment compensation, shall be applicable to UCX. (2) In the case of any finding of false statement of representation under the Act and paragraph (a) of this section, or prosecution for fraud under 18 U.S.C. 1919 or pursuant to paragraph (f)(1) of this section, the individual shall be disqualified or penalized in accordance with the provision of the applicable State law relating to fraud in connection with a claim for State unemployment compensation. Condition: Audit procedures included a review of 60 beneficiary overpayments. Of the sample examined, we identified that one claimant voluntarily quit employment and did not demonstrate that the separation was necessary or that all reasonable alternatives were explored prior to quitting. Under applicable regulations, this disqualifies the claimant from receiving unemployment benefits and a penalty should have been assessed. However, no disqualification penalty was applied to the claimant’s benefits. The audit procedures also identified a lack of effective internal controls to ensure timely and accurate reporting, as there were no documented procedures or monitoring mechanisms in place to verify that subrecipient data was submitted in accordance with federal guidelines. Questioned costs: None Context: See “Condition.” Cause: Procedures to ensure that all applicable penalties and assessments are applied were not sufficiently detailed or comprehensive to guarantee consistent enforcement of program requirements. Effect: The lack of established procedures and internal controls overpayment penalties resulted in noncompliance, with one out of 60 overpayments lacking appropriate penalties. Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Department implement and strengthen internal controls over the application of penalties. This includes enhancing current procedures to outline the steps for reviewing claimant eligibility and applying disqualification penalties. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Per 2 CFR 200.303(a), California Department of Transportation (Caltrans) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The process for establishing funding priorities in the financial system lacks sufficient controls to ensure accurate application of required federal and state match percentages. During testing, we noted that when a new funding priority was created, the state match requirement was not properly carried forward, resulting in the federal share being incorrectly set at 100%. Questioned costs: None Context: See “Condition.” Cause: The error occurred due to insufficient validation procedures and system checks during the setup of new funding priorities. Effect: Failure to meet matching requirements may result in a reduction in federal funding. Furthermore, failure to calculate, review, and approve final matching expenditures may lead to noncompliance with the terms of the grant and questioned costs. Repeat Finding: This is not a repeat finding. Recommendation: We recommend management strengthen internal controls over funding priority setup by implementing system validations and requiring independent review to confirm that federal and state match percentages are accurately applied before finalizing funding configurations. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Per 2 CFR 200.303(a), California Department of Transportation (Caltrans) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes identification of the (ii) Subrecipient's unique entity identifier. (iii) Federal Award Identification Number (FAIN) (xiii) Identification of whether the Federal award is for research and development. Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted. For 60 of 60 samples, the contract did not include neither Subrecipients unique entity identifier, Federal Award Identification Number (FAIN), nor the identification of whether the Federal award is for research and development. Questioned costs: None Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not being done correctly. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by Caltrans. Repeat Finding: This was reported in the previous year as finding 2023-006. Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Per 2 CFR section 200.303(a), California Department of Technology (CDT) and State Water Resources Control Board (SWRCB) must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The California Department of Finance (CDOF) is the prime recipient of federal funds awarded from the Department of Treasury for this program. Each quarter, CDOF requires all state agencies that received pass-through awards to report their obligations and expenditures through a dedicated portal. These reported amounts are then compiled into the Statewide Project and Expenditure Report, which CDOF submits to the Department of the Treasury. The reconcilers include key line items with critical information as follows: • Current period obligations • Cumulative obligations • Current period expenditures • Cumulative expenditures Condition: Audit procedures included testing of two quarters of the Project and Expenditure Report for each Department that were submitted for expenditures for the fiscal year. During our testing, we noted the following: • There was no evidence of review and approval of the reported amounts prior to submission to the Department of Finance at CDT for both quarters reviewed. • There was no evidence of review and approval of the reported amounts prior to submission to CDOF for quarter two ending December 2023 for SWRCB Questioned costs: None Context: See “Condition.” Cause: Employees who were responsible for the approvals are no longer employed at CDT. Management was unable to locate documentation that would support the review and approval of reports. During the reporting period, SWRCB used an informal, verbal process to approve report amounts prior to submission in the CDOF portal. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: This is not a repeat finding. Recommendation: We recommend CDT and SWRCB enforce establish document retention processes to ensure it has access to documentation for review in the event of management turnover. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Government-Wide Guidance for Grants and Agreements. Part 180 – OMB Guidelines to Agencies on Government-Wide Debarment and Suspension (Non-procurement). Subpart C – Responsibilities of Participants Regarding Transactions Doing Business With Other Persons §180.300 (2 CFR 180.300): When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You may do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or a condition to the covered transactions with that person. Condition: We noted that 25 out of the 32 vendor contract agreements reviewed did not include a suspension and debarment certification clause indicating the contractor was not suspended or debarred from participation in federally funded contracts. There was no other documentation available to demonstrate that the verification of suspension and debarment was performed prior to entering into the covered transactions. Based on the subsequent review of the System for Award Management (SAM) exclusions, these contractors were not suspended or debarred. Questioned costs: None Context: See “Condition.” Cause: The ELC program personnel responsible for administering these federal funds were unaware of the suspension and debarment requirements. Effect: Failure to verify suspension and debarment results in noncompliance with 2 CFR §180.300, as well as a risk that federal funds could be used to pay vendors that are suspended or debarred. Repeat Finding: This was reported in the previous year as finding 2023-008. Recommendation: Public Health should review and strengthen its procedures for verifying the suspension and debarment status of vendors before entering into any agreement involving federal funds and ensure that the verification documentation is maintained. Alternatively, incorporate a clause in vendor contracts requiring vendors to certify their suspension or debarment status. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Per 2 CFR section 200.303(a), the Department must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. §200.332 Requirements for pass-through entities (2 CFR 200.332): All pass-through entities must: (a) Verify that the subrecipient is not excluded or disqualified in accordance with §180.300. Verification methods are provided in §180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. 1) Federal award identification. a) Subrecipient name (which must match the name associated with its unique entity identifier); b) Subrecipient’s unique entity identifier; c) Federal Award Identification Number (FAIN); d) Federal Award Date (see the definition of Federal award date in § 200.1 of this part) of award to the recipient by the Federal agency; e) Subaward Period of Performance Start and End Date; f) Subaward Budget Period Start and End Date; g) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; h) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; i) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; j) Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); k) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; l) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; m) Identification of whether the award is R&D; and n) Indirect cost rate for the Federal award (including if the de minimis rate is charged) per §200.414. (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraphs (f) of this section. When evaluating a subrecipient’s risk, a passthrough entity should consider the following: 1) The subrecipient’s prior experience with the same or similar subawards: 2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with Subpart F and the extent to which the same or similar subawards have been audited as a major program; 3) Whether the subrecipient has new personnel or new or substantially changed systems; and 4) The extent and results of Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Condition: Public Health established a formal risk assessment process over its subrecipients of federal awards by which to determine the frequency and extent of subrecipient monitoring to be performed, however the process was established after the period under audit and applied prospectively. In addition, Public Health used a Department Allocation Letter (DAL) for the COVID-19 program instead of an agreement or contract for the subaward to subrecipients. Certain required information for the subaward federal award information such as Assistance Listings number and Title and Federal Award Identification Number (FAIN) were not clearly identified in the DAL. Questioned costs: None Context: See “Condition.” Cause: Procedures to ensure that all relevant information is included in the grant agreements and risk assessments are performed were not in place at the time of the agreements which resulted in the oversight. Effect: By not properly evaluating the risk of noncompliance, Public Health may inadvertently award grant funds to subrecipients who lack the necessary mechanisms or understanding to comply with federal statutes. This increases the likelihood of noncompliance arising during the performance of the grant-funded activities. Furthermore, failure to provide the necessary documentation to subrecipients may result in misuse or misreporting of funding. Repeat Finding: This was reported in the previous year as finding 2023-009. Recommendation: Public Health should ensure every subaward includes all requirements imposed on the subrecipient so that the federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the federal award. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Per 2 CFR 200.303(a), California Department of Health Care Services (CDHCS) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a review of 40 CHIP beneficiaries associated with current eligible participants. Of the 40 participants, we identified one beneficiary coded erroneously to an obsolete aid code. Although participation appears to meet the criteria for eligibility, the aid code is used in the determination of the rates paid and therefore payments for this participant were paid at an incorrect rate. Questioned costs: $15,524,158 (known costs $332.64) Context: See “Condition.” Cause: The exceptions noted were due to a lack of system interface issue between CalSAWS and MEDS for aid codes that have been discontinued and a subsequent review was not completed. Effect: Failure to properly terminate benefits in the eligibility system resulted in individuals receiving improper benefit payments and noncompliance with grant award terms and conditions. Repeat Finding: This was reported in the previous year as finding 2023-015. Recommendation: CDHCS should enforce existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timeline. Additionally, DHCS should conduct periodic reviews of aid code usage to ensure obsolete codes are not being applied. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Per 2 CFR 200.303(a), California Department of Health Care Services (CDHCS) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912, state Medicaid agencies must establish and adhere to timeliness and performance standards for determining and redetermining eligibility. These standards are intended to ensure that eligibility decisions are made promptly and accurately, and that benefits are not continued beyond the period of eligibility. Condition: Audit procedures included a review of 60 Medicaid beneficiaries associated with current eligible participants. Of the 60 participants, we identified two beneficiaries for which were considered eligible based on a pregnancy aid code, however the participants were no longer pregnant at the time of testing. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to a system interface issue between CalSAWS and MEDS. The termination of Medicaid benefits was not properly registered in MEDS after the case was closed in CalSAWS for failure to complete the annual redetermination. Effect: Failure to properly terminate benefits in the eligibility system may result in individuals receiving improper benefit payments and noncompliance with grant award terms and conditions. Repeat Finding: This is not a repeat finding. Recommendation: CDHCS should enhance its procedures for monitoring and resolving MEDS alerts, ensuring timely review and action on system-generated discrepancies. Additionally, staff should receive ongoing training on the importance of accurately updating pregnancy end dates in CalSAWS to ensure proper aid code closure and prevent inappropriate continuation of benefits. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our audit procedures, we reviewed 60 CMS Form 1539 documents related to provider recertification under the Medicaid program. We identified that three forms were not reviewed or signed by Public Health, indicating a breakdown in internal control processes. Questioned costs: None. Context: See “Condition.” Cause: Public Health did not review these forms because the surveys were conducted by Accrediting Organizations. However, CMS Form 1539 must still be completed and reviewed for all recertified providers, regardless of the agency conducting the survey. Effect: Failure to review CMS Form 1539 may result in noncompliance with federal grant provisions and oversight of provider eligibility for Medicaid participation. Repeat Finding: This was reported in the previous year as finding 2023-016. Recommendation: Public Health should strengthen internal controls to ensure that CMS Form 1539 is reviewed and signed for all provider recertifications, including those surveyed by Accrediting Organizations. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Government-Wide Guidance for Federal Financial Assistance. Part 170 – Reporting Subaward and Executive Compensation Information. Subpart A – General. § 170.100 Purpose of this part This part provides guidance to Federal agencies on establishing requirements for recipients of Federal awards to report information on subawards and executive total compensation, as required by the Federal Funding Accountability and Transparency Act of 2006 (Pub. L. 109-282), as amended by the Digital Accountability and Transparency Act of 2014 (Pub. L. 113-101) and other Public Laws, hereafter referred to as the “Transparency Act.” § 170.105 Applicability. (a) Applicability in general. This part applies to a Federal agency’s Federal financial assistance as defined in § 170.300. This part applies to all recipients and subrecipients of Federal awards who meet the reporting requirements of paragraph (c) of this section, unless exempt under Federal statute or by paragraph (d) of this section. (b) Non-applicability to individuals. This part does not apply to an individual who applies for or receives Federal financial assistance as a natural person (that is, unrelated to any business or nonprofit organization an individual owns or operates). (c) Reporting Requirements. 1) The names and total compensation of an entity’s five most highly compensated executives must be reported if: a) In the entity’s preceding fiscal year, it received: i) 80 percent or more of its annual gross revenue in Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and ii) $25,000,000 or more in annual gross revenue from Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and b) The public does not have access to information about the compensation of senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986. Appendix A to Part 170 — Award Term. I. Reporting Subawards and Executive Compensation (2 CFR 170): (a)(2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. (b)(2) Reporting Requirements. (i) As part of the recipient’s registration profile at https://www.sam.gov. (ii) No later than the month following the month in which this Federal award is made, and annually after that. Condition: Audit procedures included a review of 60 FFATA reporting submissions associated with subrecipients. During this review, we assessed compliance with federal reporting requirements and evaluated the adequacy of internal controls over the FFATA reporting process. Of the 60 subrecipients examined, we identified that FFATA reporting was not performed for 60 subrecipients. The audit procedures also identified a lack of effective internal controls to ensure timely and accurate reporting, as there were no documented procedures or monitoring mechanisms in place to verify that subrecipient data was submitted in accordance with federal guidelines. Questioned costs: None Context: See “Condition.” Cause: Procedures to perform the required FFATA reporting were not established by the Department. The absence of documented policies, assigned responsibilities, and monitoring mechanisms create an environment which may result in noncompliance with federal reporting. Effect: The lack of established procedures and internal controls for FFATA reporting resulted in noncompliance, with 39 out of 40 subrecipients not reported as required. Repeat Finding: This is not a repeat finding. Recommendation: The Department should implement and robust process and related internal controls to ensure timely and accurate FFATA reporting. These controls should include developing written policies and procedures that outline the steps for collecting subrecipient data, preparing reports, and submitting them within required timelines; assigning accountability by designating specific personnel responsible for compliance; and implementing a monitoring and review process to verify completion and accuracy of reporting. Additionally, training programs should be established to ensure staff understand reporting requirements, and automated tracking tools or checklists should be utilized to provide transparency and reduce the risk of missed submissions. By introducing these internal controls, the Department can strengthen its compliance framework, mitigate the risk of federal funding repercussions, and enhance overall operational integrity. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Government-Wide Guidance for Federal Financial Assistance. Part 170 – Reporting Subaward and Executive Compensation Information. Subpart A – General. § 170.100 Purpose of this part This part provides guidance to Federal agencies on establishing requirements for recipients of Federal awards to report information on subawards and executive total compensation, as required by the Federal Funding Accountability and Transparency Act of 2006 (Pub. L. 109-282), as amended by the Digital Accountability and Transparency Act of 2014 (Pub. L. 113-101) and other Public Laws, hereafter referred to as the “Transparency Act.” § 170.105 Applicability. (a) Applicability in general. This part applies to a Federal agency’s Federal financial assistance as defined in § 170.300. This part applies to all recipients and subrecipients of Federal awards who meet the reporting requirements of paragraph (c) of this section, unless exempt under Federal statute or by paragraph (d) of this section. (b) Non-applicability to individuals. This part does not apply to an individual who applies for or receives Federal financial assistance as a natural person (that is, unrelated to any business or nonprofit organization an individual owns or operates). (c) Reporting Requirements. 2) The names and total compensation of an entity’s five most highly compensated executives must be reported if: a) In the entity’s preceding fiscal year, it received: i) 80 percent or more of its annual gross revenue in Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and ii) $25,000,000 or more in annual gross revenue from Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and b) The public does not have access to information about the compensation of senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986. Appendix A to Part 170 — Award Term. I. Reporting Subawards and Executive Compensation (2 CFR 170): (a)(2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. (b)(2) Reporting Requirements. (i) As part of the recipient’s registration profile at https://www.sam.gov. (ii) No later than the month following the month in which this Federal award is made, and annually after that. Condition: CDSS did not submit its Federal Funding Accountability and Transparency Act (FFATA) reports timely for the fiscal years ended June 30, 2024 Questioned costs: None Context: See “Condition.” Cause: CDSS has had turnover in positions responsible for filing the required FFATA reports. In addition, when CDSS assumed responsibilities over the CCDF Cluster, this function and responsibility was not clearly identified. Effect: CDSS is not in compliance with 2 CFR Part 170. Repeat Finding: This was reported in the previous year as finding 2023-010. Recommendation: We recommend that CDSS compile a report tracking process and identify all fiscal and compliance reports to be submitted with clear position responsibilities and workflow to ensure reports include accurate information and are timely prepared. CDSS should have a centralized tracking mechanism and assign and document a responsible position instead of a responsible individual person, which will reduce the risk of reports not being filed if turnover occurs. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 45 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart G – Financial Management. § 98.65 Audits and financial reporting. (45 CFR 98.65) (d) Lead Agencies shall submit financial reports, in a manner specified by ACF, quarterly for each fiscal year until funds are expended OMB #0970-0510 – Instructions for Completion of Form ACF-696 Financial Reporting Form for the Child Care and Development Fund (CCDF) State & Territory Lead Agencies Pursuant to CCDF regulations at 45 CFR 98.65(g), and as part of the terms and conditions of the grant award, States and Territories are required to complete and submit a quarterly financial status report (ACF-696) in accordance with these instructions on behalf of the CCDF Lead Agency. Condition: For the fiscal year ended June 30, 2024, $2,864,939,555 was reported on the schedule of expenditures of federal awards (Schedule) for the CCDF Cluster; however, CDSS is unable to reconcile the ACF-696 reports submitted to the amount reported on the Schedule. The Schedule is $366,953,250 greater than the cumulative quarterly reports which totaled $2,497,986,305 for the fiscal year ended June 30, 2024. The audit procedures also identified a lack of effective internal controls to ensure timely and accurate reporting. Questioned costs: None Context: See “Condition.” Cause: The expenditures tracked and recorded by CDSS and CDE are reported together on the ACF-696 quarterly reports. CDSS, the department responsible for filing the reports for the fiscal year ended June 30, 2024, cannot identify the expenditures at the department level and therefore is unable to reconcile the discrepancy. Effect: CCDF Cluster expenditures were not accurately reported in the quarterly ACF-696 reports submitted. Repeat Finding: This was reported in the previous year as finding 2023-011. Recommendation: We recommend that CDSS review its procedures for capturing and reporting quarterly information in the AC-696 reports to ensure information is complete and accurate and maintain documentation supporting the amounts reported. Furthermore, we recommend that CDSS perform a year-end reconciliation of the ACF-696 reports to the amount reported in the Schedule and enhance internal control procedures related to the review of the reports. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 42 – Public Welfare. Subtitle A – Department of Health and Human Services. Subchapter A – General Administration. Part 98 – Child Care and Development Fund. Subpart E – Program Operations (Child Care Services)—Lead Agency and Provider Requirements. §98.41 Health and safety requirements: (a) Each Lead Agency shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part. Such requirements, which are subject to monitoring pursuant to §98.42, shall: (1) Include health and safety topics consisting of, at a minimum: (i) The prevention and control of infectious diseases (including immunizations); with respect to immunizations, [et. al.] (ii) Prevention of sudden infant death syndrome and use of safe sleeping practices; (iii) Administration of medication, consistent with standards for parental consent; (iv) Prevention and response to emergencies due to food and allergic reactions; (v) Building and physical premises safety, including identification of and protection from hazards, bodies of water, and vehicular traffic; (vi) Prevention of shaken baby syndrome, abusive head trauma, and child maltreatment; (vii) Emergency preparedness and response planning for emergencies resulting from a natural disaster, or a man-caused event (such as violence at a child care facility), within the meaning of those terms under section 602(a)(1) of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5195a(a)(1)) that shall include procedures for evacuation, relocation, shelter-in-place and lock down, staff and volunteer emergency preparedness training and practice drills, communication and reunification with families, continuity of operations, and accommodation of infants and toddlers, children with disabilities, and children with chronic medical conditions; (viii) Handling and storage of hazardous materials and the appropriate disposal of biocontaminants; (ix) Appropriate precautions in transporting children, if applicable; (x) Pediatric first aid and cardiopulmonary resuscitation; (xi) Recognition and reporting of child abuse and neglect, in accordance with the requirement in paragraph (e) of this section; and (xii) May include requirements relating to: 1. Nutrition (including age-appropriate feeding); 2. Access to physical activity; 3. Caring for children with special needs; or 4. Any other subject area determined by the Lead Agency to be necessary to promote child development or to protect children’s health and safety. 2) Include minimum health and safety training on the topics above, as described in §98.44. Condition: The CDSS has not established health and safety monitoring procedures to ensure licensed-exempt providers serving children who receive subsidies comply with all applicable health and safety requirements. Accordingly, no monitoring procedures were performed on licensed-exempt providers during the fiscal year ended June 30, 2024. Questioned costs: None Context: See “Condition.” Cause: Although CDSS is in process of developing a health and safety monitoring process for licensed-exempt contractors, finalization and implementation is subject to statutory and budget actions which delay the process Effect: The CDSS is not in compliance with 45 CFR §98.41. Repeat Finding: This was reported in the previous year as finding 2023-014. Recommendation: We recommend CDSS complete its development and implementation of a monitoring process over the health and safety standards and develop a mechanism to identify and track all contracts requiring health and safety compliance monitoring. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Subrecipient Monitoring and Management. §200.332 Requirements for pass-through entities (2 CFR 200.332): A pass-through entity must: (c) Evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient’s risk, a passthrough entity should consider the following: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to crosscutting audit findings in accordance with section §200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. California Code of Regulations. Title 5 Education. § 18023. Compliance Reviews of Contractors. (b) At least once every three (3) years and as resources permit, the California Department of Education shall conduct reviews at the contractor's office(s) and operating facility(ies) to determine the contractor's compliance with applicable laws, regulations or contractual provisions. Child Care and Development Fund (CCDF) Plan for State/Territory California FFY 2022-24, Amendment 4. Chapter 8 Ensure Grantee Program Integrity and Accountability. 8.1 Internal Controls and Accountability Measures to Help Ensure Program Integrity. 8.1.1 Process to train about CCDF requirements and program integrity. States and territories are required to describe effective internal controls that are in place to ensure program integrity and accountability (98.68(a)), including processes to train child care providers and staff of the Lead Agency and other agencies engaged in the administration of CCDF about program requirements and integrity. v. Monitor and assess policy implementation on an ongoing basis. The Lead Agency conducts announced Categorical Program Monitoring (CPM)/Contract Monitoring Reviews (CMRs) for each contractor on a three- or four-year cycle for non-LEAs and LEAs respectively. The Lead Agency’s Governance and Administration Unit (GAU) conducts ongoing review of individual contractors by sampling the eligibility and need documentation in family files to estimate and reduce error rates. Additionally, the Lead Agency provides ongoing training and technical assistance to contractors in regional sessions, in one-on-one sessions, and/or in cluster with webinars or during face to-face presentations. These sessions address CCDF program administration, requirements, and integrity Condition: We selected 60 subrecipient contracts (21 local educational agency (LEA) contracts and 39 non-LEA contracts) from 60 subrecipient entities and tested compliance with subrecipient monitoring requirements. We noted the following: LEA • 2 LEA contracts/contractors had no record of on-site monitoring over five years. Non-LEA • 3 non-LEA contracts/contractors had no records available to demonstrate risk assessment of the contractor. • 11 non-LEA contracts/contractors had no record of on-site monitoring over five years. Questioned costs: None Context: See “Condition.” Cause: In fiscal year 2021, the administration of the CCDF Cluster program was transitioned from the California Department of Education (CDE) to CDSS. CDSS has been in the process of revising certain policies and procedures, including contractor monitoring. In addition, certain records related to CDE monitoring activities for the contracts selected were unavailable for review. Effect: CDSS is at risk for contractor noncompliance if monitoring procedures are not properly designed or executed, and/or documents demonstrating monitoring are not maintained. Repeat Finding: This was reported in the previous year as finding 2023-012. Recommendation: To enhance the effectiveness of the annual risk assessment process, we recommend a thorough evaluation that focuses on the identification and inclusion of all subrecipients and defined risk criteria as mandated in 2 CFR 200.332. Furthermore, it is crucial to establish and document a transparent basis for risk profiling that directly correlates such profiles with compliance monitoring activities across fiscal, program, and single audit requirements. Furthermore, we recommend CDSS perform a comprehensive post-transition review to ensure all monitoring responsibilities transferred from CDE have been fully identified and assigned. This review should validate robust mechanisms are in place for the accurate documentation and proper retention of records. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Per 2 CFR 200.303(a), California Department of Fish and Wildlife (CDFW) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes identification of the (xii) Assistance Listing Number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings number at time of disbursement. (xiii) Identification of whether the award is R&D. Per 2 CFR §200.332(f), pass-through entities must verify that subrecipients expected to be audited as required by Subpart F have met this requirement. This verification may be performed as part of the monitoring required under §200.332(d)(2), which includes ensuring subrecipients take timely and appropriate action on deficiencies detected through audits. Condition: Audit procedures included a review of a sample of subrecipient contracts for required information with the following results noted. For 10 of 10 samples, the contract did not include neither the Assistance Listing Number nor the identification of whether the award is R&D. Furthermore, the agency did not perform required monitoring to verify that subrecipients subject to the Single Audit requirement (2 CFR Part 200, Subpart F) completed their audits and addressed any findings. Specifically, the agency did not obtain or review subrecipient audit reports for the fiscal year under audit. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls in place to ensure a review of subaward agreements is taking place to verify that all required elements are included per 2 CFR 200 §200.332 are not being done correctly. The agency lacked formal procedures and internal controls to ensure timely collection and review of subrecipient audit reports. CDFW was not performing requirements to document verification of audit completion and corrective actions. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by CDFW. Without proper monitoring, the agency cannot ensure that subrecipients comply with federal audit requirements or that corrective actions are taken on identified deficiencies. This increases the risk of noncompliance and potential misuse of federal funds. Repeat Finding: This is not a repeat finding. Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. We recommend that management establish and implement comprehensive procedures to ensure compliance with subrecipient monitoring requirements. These procedures should include identifying which subrecipients are subject to Single Audit requirements, obtaining and reviewing their audit reports on an annual basis, documenting verification of compliance, and ensuring timely follow-up on any corrective actions related to audit findings. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter II – Office of Management and Budget Guidance. Part 200 – Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. Subpart D – Post Federal Award Requirements. Standards for Financial and Program Management. §200.303 Internal controls (2 CFR 200.303): The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Title 2 – Grants and Agreements. Subtitle A – Office of Management and Budget Guidance for Grants and Agreements. Chapter I – Office of Management and Budget Government-Wide Guidance for Federal Financial Assistance. Part 170 – Reporting Subaward and Executive Compensation Information. Subpart A – General. § 170.100 Purpose of this part This part provides guidance to Federal agencies on establishing requirements for recipients of Federal awards to report information on subawards and executive total compensation, as required by the Federal Funding Accountability and Transparency Act of 2006 (Pub. L. 109-282), as amended by the Digital Accountability and Transparency Act of 2014 (Pub. L. 113-101) and other Public Laws, hereafter referred to as the “Transparency Act.” § 170.105 Applicability. (a) Applicability in general. This part applies to a Federal agency’s Federal financial assistance as defined in § 170.300. This part applies to all recipients and subrecipients of Federal awards who meet the reporting requirements of paragraph (c) of this section, unless exempt under Federal statute or by paragraph (d) of this section. (b) Non-applicability to individuals. This part does not apply to an individual who applies for or receives Federal financial assistance as a natural person (that is, unrelated to any business or nonprofit organization an individual owns or operates). (c) Reporting Requirements. 1) The names and total compensation of an entity’s five most highly compensated executives must be reported if: a) In the entity’s preceding fiscal year, it received: i) 80 percent or more of its annual gross revenue in Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and ii) $25,000,000 or more in annual gross revenue from Federal procurement contracts (and subcontracts) and Federal awards (and subawards) subject to the Transparency Act, as defined at §170.300; and b) The public does not have access to information about the compensation of senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986. Appendix A to Part 170 — Award Term. I. Reporting Subawards and Executive Compensation (2 CFR 170): (a)(2) Reporting Requirements. (i) The recipient must report each subaward described in paragraph (a)(1) of this award term to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) at http://www.fsrs.gov. (ii) For subaward information, report no later than the end of the month following the month in which the subaward was issued. (b)(2) Reporting Requirements. (i) As part of the recipient’s registration profile at https://www.sam.gov. (ii) No later than the month following the month in which this Federal award is made, and annually after that. Condition: Audit procedures included a review of 60 FFATA reporting submissions associated with subrecipients. During this review, we assessed compliance with federal reporting requirements and evaluated the adequacy of internal controls over the FFATA reporting process. Of the 60 subrecipients examined, we identified that FFATA reporting was not performed for 18 subrecipients. The audit procedures also identified a lack of effective internal controls to ensure timely and accurate reporting, as there were no documented procedures or monitoring mechanisms in place to verify that subrecipient data was submitted in accordance with federal guidelines. Questioned costs: None Context: See “Condition.” Cause: Procedures to perform the required FFATA reporting were not established by the Department. The absence of documented policies, assigned responsibilities, and monitoring mechanisms create an environment which may result in noncompliance with federal reporting. Effect: The lack of established procedures and internal controls for FFATA reporting resulted in noncompliance, with 18 out of 60 subrecipients not reported as required. Repeat Finding: This is not a repeat finding. Recommendation: The Department should implement and robust process and related internal controls to ensure timely and accurate FFATA reporting. These controls should include developing written policies and procedures that outline the steps for collecting subrecipient data, preparing reports, and submitting them within required timelines; assigning accountability by designating specific personnel responsible for compliance; and implementing a monitoring and review process to verify completion and accuracy of reporting. Additionally, training programs should be established to ensure staff understand reporting requirements, and automated tracking tools or checklists should be utilized to provide transparency and reduce the risk of missed submissions. By introducing these internal controls, the Department can strengthen its compliance framework, mitigate the risk of federal funding repercussions, and enhance overall operational integrity. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

Criteria or specific requirement: Per 2 CFR 200.303(a), the State Administering Departments must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: For awards with period of performance beginning dates and ending dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first and last month of the award. We noted the following instances of noncompliance: Pacific Coast Salmon Recovery Pacific Salmon Treaty Program- R&D Audit procedures included testing 5 sampled transactions from projects with period of performance ending dates during the fiscal year totaling $122,346. One of the expenditures, totaling $18,915, was related to costs incurred after the period of performance end date. The Project Period End Date for the grant award was August 31, 2023, however costs were incurred through September 30, 2023. Wildlife Restoration and Basic Hunter Education and Safety- R&D Audit procedures included testing 40 sampled transactions from projects with period of performance ending dates during the fiscal year totaling $540,319. One of the expenditures, totaling $2,784, was related to costs incurred after the period of performance end date. The Project Period End Date for the grant award was June 30, 2024, however costs were incurred on July 11, 2024. Highway Planning- R&D Audit procedures included testing 3 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,089. One of the expenditures, totaling $107, was related to costs incurred prior to the period of performance begin date. The Project Period Start Date for the grant award was July 1, 2023, however costs were incurred on June 8, 2023. Questioned costs: $21,699 Context: See “Condition.” Cause: Management failed to code the expenditure to the correct grant. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. Repeat Finding: This is not a repeat finding. Recommendation: The Departments should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Views of responsible officials: Management’s response is reported in “Management’s Response and Corrective Action Plan” included in a separate section at the end of this report.

FA 2024-001 Improve Controls over Procurement Compliance Requirement: Procurement and Suspension and Debarment Internal Control Impact: Material Weakness Compliance Impact: Material Noncompliance Federal Awarding Agency: U.S. Department of Agriculture Pass-Through Entity: Georgia Department of Education AL Numbers and Titles: 10.553 – School Breakfast Program 10.555 – National School Lunch Program COVID-19 - 10.555 – National School Lunch Program 10.582 – Fresh Fruit and Vegetable Program Federal Award Numbers: 245GA324N1199 (Year: 2024) 245GA324L1603 (Year: 2024) 245GA324L1603 (Year: 2024) Questioned Costs: $5,380.74 Description: A review of expenditures charged to the Child Nutrition Cluster revealed that the School District’s internal control procedures were not operating appropriately to ensure that the School District’s procurement procedures were followed. Background Information: The Child Nutrition Cluster (CNC) is comprised of various programs that are intended to assist states in administering and overseeing food service program operators that provide healthful, nutritious meals to eligible children in public and non-profit private schools, residential child care institutions, and summer programs. This Cluster of programs also fosters healthy eating habits in children by providing fresh fruits and fresh vegetables to children attending elementary and secondary schools and encourages the domestic consumption of nutritious agricultural commodities. CNC funding was granted to the Georgia Department of Education (GaDOE) by the U.S. Department of Agriculture. GaDOE is responsible for distributing funds to local educational agencies (LEAs) and overseeing the various CNC programs. CNC funds totaling $450,874.38 were expended and reported on the Quitman County Board of Education’s Schedule of Expenditures of Federal Awards (SEFA) for fiscal year 2024. Criteria: As a recipient of federal awards, the School District is required to establish and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Additionally, provisions included in the Uniform Guidance, Section 200.318 – General Procurement Standards state in part that “(a) the non-Federal entity must use its own documented procurement procedures, which reflects applicable State and local laws and regulations and… (b) non-Federal entities must maintain oversight to ensure that contractors perform in accordance with the terms, conditions, and specifications of their contracts or purchase orders.” In addition, provisions included in the Uniform Guidance, Section 200.320 – Methods of Procurement to Be Followed provide guidance for procurement through small purchase procedures and state “If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources…” Condition: A sample of 22 procurement transactions was randomly selected for testing using a non-statistical sampling approach. These transactions were reviewed to determine if appropriate internal controls were implemented and applicable compliance requirements were met. The School District could not provide evidence that an adequate number of rate or price quotations were obtained from qualified sources for ten small purchase expenditures. Questioned Costs: Upon testing a sample of $25,223.43 in procurement transactions, known questioned costs of $5,380.74 were identified for expenditures that did not follow the School District’s procurement procedures. Using the total population of $302,197.99 in procurement transactions, we project the likely questioned costs to be approximately $64,465.81. The following Assistance Listing Numbers were affected by known and likely questioned costs: 10.553, 10.555, and 10.582. Cause: In discussing these deficiencies with the School District, they indicated the errors occurred due to oversight in following board-approved policies related to procurement. Effect: The School District is not in compliance with the Uniform Guidance and GaDOE guidance. Failure to appropriately implement procedures to address procurement compliance requirements exposes the School District to unnecessary risk of error and misuse of federal funds and could result in the expenditure of federal funds with unqualified vendors. In addition, this deficiency could lead to the return of grant funds associated with unallowable expenditures in the future. Recommendation: The School District should evaluate and improve internal control procedures to ensure that required procurement methods are properly identified and followed and appropriate procurement documentation is obtained and retained on-file. In addition, management should develop a monitoring process to ensure that these procedures are operating appropriately. Views of Responsible Officials: We concur with this finding

Federal agency: Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Numbers: 84.063 – Federal Pell Grant Program 84.268 – Federal Direct Student Loans Award Period: July 1, 2023, to June 30, 2024 Type of Finding: Other Matters Finding related to Compliance within Uniform Guidance and Significant Deficiency in Internal Controls over Compliance. Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035) (Pell, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309). Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. There are two categories of enrollment information with separate record types;“"Campus Level" and "Program Level,"”both of which need to be reported accurately and timely. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that roster file. Additionally, the College is required to ensure adequate internal controls over compliance are established and maintained in accordance with 2 CFR 200.303. Condition: During our testing of the Direct Loan and Pell Grant programs, we selected a sample of 40 students to test for timeliness and accurate reporting of student status changes to the National Student Loan Data System (NSLDS). 10 Students had one or more noncompliant reporting elements noted below. - 2 Instances where a student’s campus-level and program level enrollment effective date did not match the institution’s records. - 9 Instances where students campus level enrollment was not certified every 60 days to NSLDS during active enrollment period. - 3 Instances in which Program Level Program Begin Date per the NSLDS Program Enrollment Detail did not agree to institutional records. Questioned costs Known: None. Context: Out of a sample of 40 enrollment changes selected for testing for the requirement noted above, we noted 10 students with exceptions. 4 students had multiple instances of noncompliance. Cause: Turnover within the registrar department and lack of structured review and approval process. Effect: The NSLDS system is not updated with the student information in time which can cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes, 2023-001. Recommendation: We recommend that the College continue to enhance its policies and procedures regarding enrollment reporting including additional monitoring over the third-party service provider to ensure that reporting is completed accurately and timely. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.

2024-010 Program: COVID-19 Coronavirus State and Local Fiscal Recovery Funds passed-through the State Water Resources Control Board Federal Financial Assistance Listing Number: 21.027 Federal Grantor: U.S. Department of Treasury Award No. and Year: A00059, 2024 Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control Criteria: 2 CFR Section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During testing of the City’s compliance with activities allowed or unallowed and allowable costs/cost principles requirements, it was noted that the City did not obtain proper Council approval to charge the overall arrearage expenditures to the ARPA Program. Cause: The City did not have internal controls in place to ensure that the expenditures charged to the ARPA Program were properly approved. Effect: The City charged arrearage expenditures for reimbursement that had not been previously reviewed or approved by Council. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sample of 23 transactions out of 98 total transactions were selected for testing, which accounted for $2,474,044 of $3,095,657 federal program expenditures. The error applied to 1 transaction and totaled $413,431. Repeat Finding from Prior Year: No Recommendation: We recommend the City implement internal controls to ensure all costs charged to the program are properly reviewed and approved prior to being charged to the program. Views of Responsible Officials: Management agrees with the finding. See separate corrective action plan.

2024-009: Internal Control Documentation Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Section 8 Choice Housing Vouchers Assistance Listing Number: 14.871 Federal Award Identification Number and Year: CA103AF0154-0160, CA103AFR323, CA103EH0005-0006, CA103VO0201-0206, CA103VO0208-0211, and CA103VOPR23; All 2024 Award Period: July 1, 2023 – June 30, 2024 Compliance Requirements Affected: E. Eligibility, L-Reporting, and N-Special Tests and Provisions Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or Specific Requirement: 2CFR § 200.303 Internal controls require a recipient of federal awards to: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Evidence of the Housing Manager’s review and approval of certain internal control processes and the timing of those reviews was not clearly documented. Questioned Costs: None noted. Context: 40 tenant files were selected to test for various compliance requirements. While the tenant files contained sufficient evidence that the City was in compliance with grant requirements, documentation of the review and approval process for HUD Form 50058, rent reasonableness calculations, and the Housing Authority application (with underlying applicant information) prior to approval of the applicant was not clearly documented. Cause: The City's applicant examination process includes a step where the Housing Manager reviews tenant files prepared by the Housing Specialists. However, the City was unable to provide documentation evidencing the Housing Manager’s review and approval process. Effect: Breakdowns in internal control over compliance may lead to ineligible applicants receiving inaccurate benefits. Repeat Finding: This is not a repeat finding. Recommendation: We recommend the City establish procedures to ensure that the review and approval processes are clearly documented within each tenant file. Views of Responsible Officials and Corrective Action: Management agrees with this finding. The RBHA will establish procedures to monitor and ensure proper file review. RBHA has created a new checklist for a supervising team member to review intake files for accuracy, to document approval, and to release the Housing Assistance Payment. RBHA will maintain records of the signed checklist for each tenant file.

2024-010: Monthly Reporting Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Section 8 Choice Housing Vouchers Assistance Listing Number: 14.871 Federal Award Identification Number and Year: CA103AF0154-0160, CA103AFR323, CA103EH0005-0006, CA103VO0201-0206, CA103VO0208-0211, and CA103VOPR23; All 2024 Award Period: July 1, 2023 – June 30, 2024 Compliance Requirement Affected: L. Reporting Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or Specific Requirement: 2CFR § 200.303 Internal controls require a recipient of federal awards to: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The City's system of internal control includes a process where grant management staff prepare, review and approve monthly reports for upload to HUD’s VMS system. However, the City was unable to provide documentation about the employee who performed each process or when each process was performed. In addition, the City did not retain documentation that supported the balances reported as part of the original submission to the VMS. Questioned Costs: None noted. Context: The 3 monthly reports selected for testing did not have any evidence of who reviewed and approved the reports prior to submission. Additionally, we were unable to trace certain significant information contained in the 3 monthly reports to supporting underlying data due to the City not retaining GL reports used to prepare the reports. Cause: Due to staff turnover in the Housing Department, evidence of internal controls over compliance and the supporting underlying data were not retained. Effect: Breakdowns in the internal controls over compliance may lead to inaccurate information being reported to HUD. Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the City review and update internal controls over the completion and submission of monthly program reports to ensure the accuracy of the information being reported and to ensure that supporting underlying documentation is properly retained. As part of this process, the City should consider utilizing members of the Finance Department as the monthly reports contain certain financial information. Views of Responsible Officials and Corrective Action: Management agrees with this finding. RBHA has established a process by which Housing will copy Finance on monthly VMS reports provided to the financial consultant for the VMS submissions; this will both document timing and ensure additional review. In addition, RBHA and Finance are coordinating to revise the City’s account structure for Housing-related expenses. Better aligning the City’s account setup with VMS reporting requirements will help ensure that VMS submissions are adequately supported and tie cleanly to the City’s General Ledger.