Findings Citing § 200.303

Finding 2023-001: Procurement United States Department of Agriculture – Child Nutrition Cluster United States Department of Agriculture – Child and Adult Care Food Program Criteria: The non-federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rational for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price (2 CFR section 200.318(i)). The non-federal entity must also establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) (2 CFR section 200.303(a)). Condition: Records detailing which vendors were contacted, when they were contacted, and support for the rationale in choosing the vendor, is not documented. Questioned Costs: None Cause: Management did not maintain a detailed history of procurement and did not document a review process. Effect: There is no reasonable assurance that the Organization managed the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Recommendation: Purchasers should record, and keep on file, backup detailing which vendors were contacted, when they were contacted, support for the rationale in choosing the vendor. Management should implement a system of internal controls for this process. Views of Responsible Parties and Corrective Action Plan: Management concurs with the finding and will implement a process for documenting the procurement history and establishing a system of internal controls.

Finding 2023-001: Procurement United States Department of Agriculture – Child Nutrition Cluster United States Department of Agriculture – Child and Adult Care Food Program Criteria: The non-federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rational for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price (2 CFR section 200.318(i)). The non-federal entity must also establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) (2 CFR section 200.303(a)). Condition: Records detailing which vendors were contacted, when they were contacted, and support for the rationale in choosing the vendor, is not documented. Questioned Costs: None Cause: Management did not maintain a detailed history of procurement and did not document a review process. Effect: There is no reasonable assurance that the Organization managed the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Recommendation: Purchasers should record, and keep on file, backup detailing which vendors were contacted, when they were contacted, support for the rationale in choosing the vendor. Management should implement a system of internal controls for this process. Views of Responsible Parties and Corrective Action Plan: Management concurs with the finding and will implement a process for documenting the procurement history and establishing a system of internal controls.

: Per 2 CFR 200.302, the state's and the other non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. According to §200.303 Internal controls of 2 CFR Part 200, the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.

2023-001 Segregation of Duties Title and Assistance Listing Number of the Federal Program: ALN 94.006 AmeriCorps State and National and ALN 94.006 COVID 19 - AmeriCorps State and National Year Finding Originated: 2022 Compliance Requirement: 2 CFR 200.303 Internal Controls Name of Federal Agency: Corporation for National and Community Service Pass-through Agency: State of Louisiana/Volunteer Louisiana Questioned Costs: None. Condition: During our audit, we obtained an understanding and tested LDSC’s internal control for purposes of planning and performing our audit procedures. In obtaining our understanding and testing LDSC’s internal controls, we determined there were inadequate segregation of duties involving certain aspects of the financial reporting cycle. Criteria: As noted in 2 CFR 200.303 “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Cause: Due to the size of LDSC’s administrative staff, certain duties are performed by the same individual, as follows:  Initiate and approve vendor invoices for payment,  Write checks or initiating electronic disbursements,  Review and approve payroll, including the approver’s payroll  Initiate and approve reimbursements to themselves as the agency head,  Access to check stock, check signing authority, and approval authorization. The following responsibilities over cash receipts are performed by the same individual:  Receive and open mail,  Prepare bank deposits and deposit monies received,  Invoices customers for services provided (host sites). Effect: There is not adequate segregation of duties. Recommendation: To the extent possible, we recommend that board members or the contract accountant become further involved in the financial reporting process; such examples include, but are not limited to:  Approve monthly financial statements,  Bank statements and reconciliations,  Reimbursements (travel, expense, etc.) made to agency head,  Credit card activity initiated by the agency head,  The board of directors should adopt an annual budget and monitor on a periodic basis. We further recommend that management incorporate these recommendations to their financial policies and procedures handbook. This will ensure that financial policies are conducted consistently and in accordance with the expectations set by management and board governance. Additionally, such policies and procedures provide structure within LDSC in the event of employee turnover or absenteeism. Views of Responsible Officials: See views of responsible officials on page 29.

2023-002 Approval of Living Allowance Payments Title and Assistance Listing Number of the Federal Program: ALN 94.006 AmeriCorps State and National and ALN 94.006 COVID 19 - AmeriCorps State and National Year Finding Originated: 2023 Compliance Requirement: 2 CFR 200.303 Internal Controls, 2 CFR 200.404, 45 CFR 2522.230 Name of Federal Agency: Corporation for National and Community Service Pass-through Agency: State of Louisiana/Volunteer Louisiana Questioned Costs: None meeting the reporting threshold of $25,000. Condition: For two out of the thirteen living allowance periods tested, approval of the payroll disbursements was not able to be provided. For one of the thirteen living allowance payroll disbursement periods tested, approval was granted, however, the payment did not appear reasonable, as required by 2 CFR 200.404. In this instance, an individual completed approximately 68% of their hourly commitment in the program but was paid approximately 95% of their annual contracted amount. Our sample was not statistically valid. Criteria: As noted in 2 CFR 200.303 “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” As noted in 2 CFR 200.404 “A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person under the circumstances prevailing at the time the decision was made to incur the cost.” As noted in 45 CFR 2522.230 “An AmeriCorps program may release a participant from completing a term of service for compelling personal circumstances, as determined by the program, or for cause.” Cause: Internal controls over approval of living allowances are not operating effectively. Effect: Disbursements under the program may not have been for allowable purposes. Recommendation: LDSC should ensure internal controls over approval of living allowances are implemented as designed. Views of Responsible Officials: See views of responsible officials on page 29.

2023-001 Segregation of Duties Title and Assistance Listing Number of the Federal Program: ALN 94.006 AmeriCorps State and National and ALN 94.006 COVID 19 - AmeriCorps State and National Year Finding Originated: 2022 Compliance Requirement: 2 CFR 200.303 Internal Controls Name of Federal Agency: Corporation for National and Community Service Pass-through Agency: State of Louisiana/Volunteer Louisiana Questioned Costs: None. Condition: During our audit, we obtained an understanding and tested LDSC’s internal control for purposes of planning and performing our audit procedures. In obtaining our understanding and testing LDSC’s internal controls, we determined there were inadequate segregation of duties involving certain aspects of the financial reporting cycle. Criteria: As noted in 2 CFR 200.303 “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Cause: Due to the size of LDSC’s administrative staff, certain duties are performed by the same individual, as follows:  Initiate and approve vendor invoices for payment,  Write checks or initiating electronic disbursements,  Review and approve payroll, including the approver’s payroll  Initiate and approve reimbursements to themselves as the agency head,  Access to check stock, check signing authority, and approval authorization. The following responsibilities over cash receipts are performed by the same individual:  Receive and open mail,  Prepare bank deposits and deposit monies received,  Invoices customers for services provided (host sites). Effect: There is not adequate segregation of duties. Recommendation: To the extent possible, we recommend that board members or the contract accountant become further involved in the financial reporting process; such examples include, but are not limited to:  Approve monthly financial statements,  Bank statements and reconciliations,  Reimbursements (travel, expense, etc.) made to agency head,  Credit card activity initiated by the agency head,  The board of directors should adopt an annual budget and monitor on a periodic basis. We further recommend that management incorporate these recommendations to their financial policies and procedures handbook. This will ensure that financial policies are conducted consistently and in accordance with the expectations set by management and board governance. Additionally, such policies and procedures provide structure within LDSC in the event of employee turnover or absenteeism. Views of Responsible Officials: See views of responsible officials on page 29.

2023-002 Approval of Living Allowance Payments Title and Assistance Listing Number of the Federal Program: ALN 94.006 AmeriCorps State and National and ALN 94.006 COVID 19 - AmeriCorps State and National Year Finding Originated: 2023 Compliance Requirement: 2 CFR 200.303 Internal Controls, 2 CFR 200.404, 45 CFR 2522.230 Name of Federal Agency: Corporation for National and Community Service Pass-through Agency: State of Louisiana/Volunteer Louisiana Questioned Costs: None meeting the reporting threshold of $25,000. Condition: For two out of the thirteen living allowance periods tested, approval of the payroll disbursements was not able to be provided. For one of the thirteen living allowance payroll disbursement periods tested, approval was granted, however, the payment did not appear reasonable, as required by 2 CFR 200.404. In this instance, an individual completed approximately 68% of their hourly commitment in the program but was paid approximately 95% of their annual contracted amount. Our sample was not statistically valid. Criteria: As noted in 2 CFR 200.303 “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” As noted in 2 CFR 200.404 “A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person under the circumstances prevailing at the time the decision was made to incur the cost.” As noted in 45 CFR 2522.230 “An AmeriCorps program may release a participant from completing a term of service for compelling personal circumstances, as determined by the program, or for cause.” Cause: Internal controls over approval of living allowances are not operating effectively. Effect: Disbursements under the program may not have been for allowable purposes. Recommendation: LDSC should ensure internal controls over approval of living allowances are implemented as designed. Views of Responsible Officials: See views of responsible officials on page 29.

2023‐002 Department of the Treasury Federal Assistance Listing #21.027 COVID‐19 Coronavirus State and Local Fiscal Recovery Funds Activities Allowed or Unallowed and Allowable Costs/Cost Principles Significant Deficiency in Internal Control Over Compliance Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: BHD, LLC calculated their indirect cost rate based on the total grant budget and took an equal amount of that per month instead of calculating the indirect cost rate per direct expenditures for each month. Cause: BHD, LLC did not have an internal control process in place to ensure the correct amounts of indirect costs were requested based on the direct costs for the same period. Effect: Without an effective internal control process in place, improper costs could be charged to the program. Questioned Costs: None reported. Context: A nonstatistical sample of 4 out of 10 indirect expenditures were selected for testing. Repeat Finding from Prior Years: No Recommendation: We recommend BHD, LLC enhance internal control procedures to ensure the indirect cost rate is applied against the monthly direct costs when requestion program reimbursements. Views of Responsible Officials: Management agrees with the finding.

Assistance Listing Number: 84.425F Program Name: COVID-19: HEERF – Institutional Portion Pass Through Identifying Number: N/A Award Year: 2022-2023 Federal Agency: U.S. Department of Education Criteria: Non-federal entities are required to establish and maintain effective internal controls over compliance in accordance with 2 CFR 200.303(a). Management should ensure that internal controls related to federal and state awards are appropriately designed and operating effectively in order to comply with 2 CFR 200.305. Condition: The College did not ensure that internal controls were appropriately designed and operating in regards to HEERF drawdowns which resulted in the incorrect classification of two different awards within G-5, an overdraw of funds in the amount of $1.9M and the incorrect recording of associated grant revenues. Cause: Turnover at the College had led to unqualified personnel at the management level. Effect: Journal entries for drawdown of HEERF funds were not approved within Colleague, drawdown requests were not reviewed and approved prior to submitting within G5 reporting system. Additionally, bank reconciliations were not reviewed by the CFO/VP of Finance and Business Operations in order to reconcile payments received from the DOE to grant accounts. It was determined that controls in place were not operating effectively during the fiscal year. Questioned costs: N/A Recommendation: Management must review the roles and responsibilities of accounting personnel and ensure they have the necessary background and training to properly execute required accounting functions and adhere to necessary internal control functions. Management should review the controls in place and assess that such controls are designed appropriately given the positions in roles within the accounting department. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the findings and, as discussed, the College is currently searching for a candidate to fulfill the CFO position with the appropriate level of training. The College does intend to interview accounting professionals from the community to determine if appropriate levels are present. Responsible Party: Dr. Justin Hoggard, Board President and Dixie Lytle, Director of Human Resources Expected Completion: December 31, 2024 Anticipated Completion: December 31, 2024

U.S. Department of Education Education Stabilization Fund 84.425 Federal award identification number P425E204935 Requirements: (A) Activities Allowed or Unallowed and (B) Allowable Costs Condition: For 37 tested grant disbursements to students, the College provided documentation of management approval, but was unable to provide documentation of Executive Committee approval. Criteria: Per 2 CFR section 200.303, recipients of federal awards must establish, document, and maintain effective internal controls to provide reasonable assurance that the recipient manages the federal award in compliance with statutes, regulations, terms and conditions applicable to the federal award. The College’s internal control policies state that all institutional expenses above $100 must be approved by an Executive Committee Member. Cause: The College failed to document this required approval due to management level staff turnover and new staff not being aware of the approval process. Effect: The College could not demonstrate that grant disbursements totaling $60,311 were approved by the Executive Committee. Repeat Finding: Repeat of 2022-07 Recommendation: RBT recommends that the College develop and document detailed controls over grants. Perspective: This control deficiency appears to be systemic and could impact an additional 497 grant disbursements totaling $800,540 that were not tested. Management’s Response: See corrective action plan.

2023-001: United States Department of Health and Human Services Federal Assistance Listing Number 93.498; Reporting Period 4 COVID-19 Provider Relief Fund and American Rescue Plan Rural Distributions (PRF) Reporting - Material Weakness in Internal Control over Compliance and Material Noncompliance Reporting Period 4 Criteria: 2 CFR 200.303(a) establishes that the auditee must establish and maintain effective internal control over the federal award that provides assurance that the entity is managing the federal award in compliance with federal statutes, regulations, and conditions of the federal award. Condition: The Center was not able to provide records to support amounts reported for 2021 Total Revenue / Net Patient Charges, a part of the Lost Revenue Calculation on the PRF required reporting. Additionally, the Reporting Period 4 PRF Report did not contain evidence of proper review and approval prior to submission. Cause: The Center had a change in CFO in March 2022. The incoming CFO was unable to locate records used by the prior CFO to support the full lost revenue calculation. Further, Center policy did not require evidence of review to be included on PRF reports prior to submission. Effect: Lost revenue calculation amounts are partially unsupported, and may be materially misstated. Additionally, the Center is unable to demonstrate that the PRF reports were properly reviewed and free of other errors. However, the risk is mitigated as the Center claimed no lost revenue in Period 4. Questioned Costs: None Context/Sampling: Key line items related to the reporting were tested for the Period 4 report. Errors (unsupported amounts) were only noted in the Lost Revenue calculation (amounts reported for 2021 Total revenue). Lost Revenue calculation amounts for 2019, 2020, and 2022 were properly supported. Repeat Finding from Prior Year(s) No Recommendation: Because the PRF program is winding down, no future PRF reports are required to be filed. Accordingly, we recommend that management require the following be maintained for all federal and state program required reports: evidence to support all reported amounts, and evidence that report review occurred prior to submission. Views of Responsible Officials: Management agrees with the finding. Refer to Corrective Action Plan.

Title and Assistance Listing Number of the Federal Program: ALN 94.006 AmeriCorps State and National and ALN 94.006 COVID 19 - AmeriCorps State and National Year Finding Originated: 2022 Compliance Requirement: 2 CFR 200.303 Internal Controls Name of Federal Agency: Corporation for National and Community Service Pass-through Agency: State of Louisiana/Volunteer Louisiana Questioned Costs: None. Condition: During our audit, we obtained an understanding and tested LDSC’s internal control for purposes of planning and performing our audit procedures. In obtaining our understanding and testing LDSC’s internal controls, we determined there were inadequate segregation of duties involving certain aspects of the financial reporting cycle. Criteria: As noted in 2 CFR 200.303 “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Cause: Due to the size of LDSC’s administrative staff, certain duties are performed by the same individual, as follows: • Initiate and approve vendor invoices for payment, • Write checks or initiating electronic disbursements, • Review and approve payroll, including the approver’s payroll • Initiate and approve reimbursements to themselves as the agency head, • Access to check stock, check signing authority, and approval authorization. The following responsibilities over cash receipts are performed by the same individual: • Receive and open mail, • Prepare bank deposits and deposit monies received, • Invoices customers for services provided (host sites). Effect: There is not adequate segregation of duties. Recommendation: To the extent possible, we recommend that board members or the contract accountant become further involved in the financial reporting process; such examples include, but are not limited to: • Approve monthly financial statements, • Bank statements and reconciliations, • Reimbursements (travel, expense, etc.) made to agency head, • Credit card activity initiated by the agency head, • The board of directors should adopt an annual budget and monitor on a periodic basis. We further recommend that management incorporate these recommendations to their financial policies and procedures handbook. This will ensure that financial policies are conducted consistently and in accordance with the expectations set by management and board governance. Additionally, such policies and procedures provide structure within LDSC in the event of employee turnover or absenteeism.

Title and Assistance Listing Number of the Federal Program: ALN 94.006 AmeriCorps State and National and ALN 94.006 COVID 19 - AmeriCorps State and NationalYear Finding Originated: 2023 Compliance Requirement: 2 CFR 200.303 Internal Controls, 2 CFR 200.404, 45 CFR 2522.230 Name of Federal Agency: Corporation for National and Community Service Pass-through Agency: State of Louisiana/Volunteer Louisiana Questioned Costs: None meeting the reporting threshold of $25,000. Condition: For two out of the thirteen living allowance periods tested, approval of the payroll disbursements was not able to be provided. For one of the thirteen living allowance payroll disbursement periods tested, approval was granted, however, the payment did not appear reasonable, as required by 2 CFR 200.404. In this instance, an individual completed approximately 68% of their hourly commitment in the program but was paid approximately 95% of their annual contracted amount. Our sample was not statistically valid. Criteria: As noted in 2 CFR 200.303 “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” As noted in 2 CFR 200.404 “A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person under the circumstances prevailing at the time the decision was made to incur the cost.” As noted in 45 CFR 2522.230 “An AmeriCorps program may release a participant from completing a term of service for compelling personal circumstances, as determined by the program, or for cause.” Cause: Internal controls over approval of living allowances are not operating effectively. Effect: Disbursements under the program may not have been for allowable purposes. Recommendation: LDSC should ensure internal controls over approval of living allowances are implemented as designed.

Title and Assistance Listing Number of the Federal Program: ALN 94.006 AmeriCorps State and National and ALN 94.006 COVID 19 - AmeriCorps State and National Year Finding Originated: 2022 Compliance Requirement: 2 CFR 200.303 Internal Controls Name of Federal Agency: Corporation for National and Community Service Pass-through Agency: State of Louisiana/Volunteer Louisiana Questioned Costs: None. Condition: During our audit, we obtained an understanding and tested LDSC’s internal control for purposes of planning and performing our audit procedures. In obtaining our understanding and testing LDSC’s internal controls, we determined there were inadequate segregation of duties involving certain aspects of the financial reporting cycle. Criteria: As noted in 2 CFR 200.303 “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Cause: Due to the size of LDSC’s administrative staff, certain duties are performed by the same individual, as follows: • Initiate and approve vendor invoices for payment, • Write checks or initiating electronic disbursements, • Review and approve payroll, including the approver’s payroll • Initiate and approve reimbursements to themselves as the agency head, • Access to check stock, check signing authority, and approval authorization. The following responsibilities over cash receipts are performed by the same individual: • Receive and open mail, • Prepare bank deposits and deposit monies received, • Invoices customers for services provided (host sites). Effect: There is not adequate segregation of duties. Recommendation: To the extent possible, we recommend that board members or the contract accountant become further involved in the financial reporting process; such examples include, but are not limited to: • Approve monthly financial statements, • Bank statements and reconciliations, • Reimbursements (travel, expense, etc.) made to agency head, • Credit card activity initiated by the agency head, • The board of directors should adopt an annual budget and monitor on a periodic basis. We further recommend that management incorporate these recommendations to their financial policies and procedures handbook. This will ensure that financial policies are conducted consistently and in accordance with the expectations set by management and board governance. Additionally, such policies and procedures provide structure within LDSC in the event of employee turnover or absenteeism.

Title and Assistance Listing Number of the Federal Program: ALN 94.006 AmeriCorps State and National and ALN 94.006 COVID 19 - AmeriCorps State and NationalYear Finding Originated: 2023 Compliance Requirement: 2 CFR 200.303 Internal Controls, 2 CFR 200.404, 45 CFR 2522.230 Name of Federal Agency: Corporation for National and Community Service Pass-through Agency: State of Louisiana/Volunteer Louisiana Questioned Costs: None meeting the reporting threshold of $25,000. Condition: For two out of the thirteen living allowance periods tested, approval of the payroll disbursements was not able to be provided. For one of the thirteen living allowance payroll disbursement periods tested, approval was granted, however, the payment did not appear reasonable, as required by 2 CFR 200.404. In this instance, an individual completed approximately 68% of their hourly commitment in the program but was paid approximately 95% of their annual contracted amount. Our sample was not statistically valid. Criteria: As noted in 2 CFR 200.303 “The non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” As noted in 2 CFR 200.404 “A cost is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person under the circumstances prevailing at the time the decision was made to incur the cost.” As noted in 45 CFR 2522.230 “An AmeriCorps program may release a participant from completing a term of service for compelling personal circumstances, as determined by the program, or for cause.” Cause: Internal controls over approval of living allowances are not operating effectively. Effect: Disbursements under the program may not have been for allowable purposes. Recommendation: LDSC should ensure internal controls over approval of living allowances are implemented as designed.

Criteria: Uniform Grant Guidance (2 CFR 200.303) requires a non-federal entity receiving federal awards establish and maintain internal controls designed to reasonably ensure complaince with federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure that reimbursement is not requested for costs that were refunded or reimbursed by other means.; Condition: Internal controls over compliance failed to identify that amounts refunded or reimbursed by other means did not appropriately reduce the request for reimbursement.; Cause: In one instance, the amount refunded for a returned item was recorded into an account that was not included in the report run to prepare the request for reimbursement. In two other instances, insurance proceeds were received and recorded in a holding account since the repairs had not yet been performed. At the time the repairs were expensed, the insurance proceeds were not manually adjusted to offset the cost in order to reduce the amount requested for reimbursement.; Effect: Requests for reimbursement submitted were overstated by a total of $9,613.16.; Repeat Finding: No.; Recommendation: It is recommended that the System refund the grantee $9,613.16, and establish procedures and internal controls to prevent requesting reimbursement for items that have been refunded or already reimbursed by other means.; Management's Response: The System has contacted the Texas Department of Transportation requesting instructions on refunding the amounts. In addition, they will implement new procedures and controls surrounding the calculation of their request for reimbursement and the handling of insurance proceeds to prevent this from happening moving forward.

Criteria: Uniform Grant Guidance (2 CFR 200.303) requires a non-federal entity receiving federal awards establish and maintain internal controls designed to reasonably ensure complaince with federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure that reimbursement is not requested for costs that were refunded or reimbursed by other means.; Condition: Internal controls over compliance failed to identify that amounts refunded or reimbursed by other means did not appropriately reduce the request for reimbursement.; Cause: In one instance, the amount refunded for a returned item was recorded into an account that was not included in the report run to prepare the request for reimbursement. In two other instances, insurance proceeds were received and recorded in a holding account since the repairs had not yet been performed. At the time the repairs were expensed, the insurance proceeds were not manually adjusted to offset the cost in order to reduce the amount requested for reimbursement.; Effect: Requests for reimbursement submitted were overstated by a total of $9,613.16.; Repeat Finding: No.; Recommendation: It is recommended that the System refund the grantee $9,613.16, and establish procedures and internal controls to prevent requesting reimbursement for items that have been refunded or already reimbursed by other means.; Management's Response: The System has contacted the Texas Department of Transportation requesting instructions on refunding the amounts. In addition, they will implement new procedures and controls surrounding the calculation of their request for reimbursement and the handling of insurance proceeds to prevent this from happening moving forward.

Criteria: Uniform Grant Guidance (2 CFR 200.303) requires a non-federal entity receiving federal awards establish and maintain internal controls designed to reasonably ensure complaince with federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure that reimbursement is not requested for costs that were refunded or reimbursed by other means.; Condition: Internal controls over compliance failed to identify that amounts refunded or reimbursed by other means did not appropriately reduce the request for reimbursement.; Cause: In one instance, the amount refunded for a returned item was recorded into an account that was not included in the report run to prepare the request for reimbursement. In two other instances, insurance proceeds were received and recorded in a holding account since the repairs had not yet been performed. At the time the repairs were expensed, the insurance proceeds were not manually adjusted to offset the cost in order to reduce the amount requested for reimbursement.; Effect: Requests for reimbursement submitted were overstated by a total of $9,613.16.; Repeat Finding: No.; Recommendation: It is recommended that the System refund the grantee $9,613.16, and establish procedures and internal controls to prevent requesting reimbursement for items that have been refunded or already reimbursed by other means.; Management's Response: The System has contacted the Texas Department of Transportation requesting instructions on refunding the amounts. In addition, they will implement new procedures and controls surrounding the calculation of their request for reimbursement and the handling of insurance proceeds to prevent this from happening moving forward.

Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.

Allowable Costs/Cost Principles – Cost Allocations, Matching, Level of Effort, Earmarking (CHIP Only) Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture U.S. Department of Education Social Security Administration Federal Program Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) Children’s Health Insurance Program (CHIP) Block Grants for Community Mental Health Services (MHBG) Block Grants for Prevention and Treatment of Substance Abuse (SABG) Medicaid Cluster Aging Cluster (nonmajor) Disability Insurance/SSI Cluster (nonmajor) Money Follows the Person Rebalancing Demonstration (nonmajor) CCDF Cluster (nonmajor) SNAP Cluster (nonmajor) Special Education-Grants for Infants and Families (nonmajor) ALN: 10.557 93.558 93.667 93.767 93.958 93.959 93.775, 93.777, 93.778 93.044, 93.045, 93.053 (nonmajor) 96.001, 96.006 (nonmajor) 93.791 (nonmajor) 93.575, 93.596, 93.489 (nonmajor) 10.551, 10.561 (nonmajor) 84.181 (nonmajor) Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: WIC 6TX700527, 6TX700507 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023, October 1, 2022 – September 30, 2024 TANF 2301TXTANF, 2301TXTAN3, 2201TXTANF, and 2201TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2021 – September 30, 2022 SSBG 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 CHIP 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 MHBG 1B09SM087345, 6B09SM087345-01M001, 6B09SM087345-01M002, 6B09SM087345-01M003, 1B09SM087322-01,1B09SM085994-01, 6B09SM085994-01M001, 6B09SM085994-01M002, 6B09SM085994-01M003, 1B09SM083999 -01, 6B09SM083999-01M001, 1B09SM083830-01, 6B09SM083830- 01M001 October 1, 2022 – September 30, 2024, October 17, 2022 – October 16, 2024, October 1, 2021 – September 30, 2023, March 15, 2021 – March 14, 2024, March 15, 2021 – March 14, 2023, and October 1, 2020 – September 30, 2022 SABG 1B08TI085835-01,6B08TI085835-01M001, 6B08TI084673-01M001, 6B08TI084673-01M002, 1B08TI084673-01, 6B08TI083478-01 6B08TI083478- 01M002, 6B08TI083478-01M003, 6B08TI083478-01M004 October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023, and October 1, 2020 – September 30, 2022 Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 45 CFR Section 95.507, the State shall submit a cost allocation plan for the State agency as required below to the Director, Division of Cost Allocation (DCA), in the appropriate HHS Regional Office. The plan shall describe the procedures used to identify, measure, and allocate all costs to each of the programs operated by the State agency. The cost allocation plan shall contain the procedures used to identify, measure, and allocate all costs to each benefitting program and activity. Per 45 CFR Section 95.509, the State shall promptly amend the cost allocation plan and submit the amended plan to the Director, DCA, if any of the following events occur, including if other changes occur which make the allocation basis or procedures in the approval cost allocation plan invalid. Condition: HHSC’s approved Public Assistance Cost Allocation Plan (PACAP) expenditures and revenues are initially allocated based on an estimate of Project ID percentages. After actual base statistical data is available, expenditures are reallocated and adjustments between estimated and actual costs are made. The adjustments will result in costs claimed for each period being allocated based on actual base statistics for the same period. Data is updated either by voucher, monthly, quarterly, semi-annually, or annually, depending on the Project ID. HHSC experienced significant delays in updating factors. By the end of the fiscal year, cost allocations had been updated only through August 2022. Although there is no documented policy over when the FMAP should be updated, HHSC will allocate costs at the FMAP that is in effect at the time of the transaction and will reallocate the transactions using the FMAP in effect at the time of the reallocation. This procedure was not followed in 2023 when the costs for four of 40 sample allocations tested in the CHIP program were allocated using a rate other than the current one in effect resulting in noncompliance with matching requirements. Questioned costs: Unknown Context: See “Condition.” Cause: HHSC’s General Ledger Unit is responsible for cost allocations. At the start of fiscal year 2023, the Unit suffered a loss of more than half of its staff due to turnover. Additionally, the current Federal Medical Assistance Percentage (FMAP) rates were in a stepdown process whereby the rate changed quarterly as opposed to yearly which intensified the workload. In addition, since transformation, the number of Public Assistance Cost Allocation Plan (PACAP) methodologies (Project IDs) has increased by 243%. These methodologies have become increasingly more complex, now including over 80 dependent factors of which some comprise more than 100 fund sources each. This huge increase in both volume and complexity has greatly increased calculation labor and risk of error. Effect: Failure to update factor allocations timely can result in questioned costs. Repeat finding: 2022-010, 2021-004, 2020-016, 2019-006, 2018-005, 2017-009, and 2016-024 Recommendation: HHSC should allocate adequate resources to ensure factor allocations are performed and reallocations are updated timely in order to present accurate information. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Reporting – Information Technology – Password Configuration Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: MIP is GLO’s accounting application that serves as the agency’s system of record for budget, payroll, cash transactions, accounts receivable, and accounts payable. During our testing, we noted that Active Directory password configurations and the MIP lockout configurations do not adhere to the password policy defined in GLO’s Identification and Authentication policies or defined best practices. Questioned costs: None. Context: See “Condition.” Cause: GLO did not have processes in place to enforce password policies as outlined in the agency’s Identification and Authentication policies. Effect: Failure to follow GLO’s password policy increases the risk of inappropriate access. Repeat finding: No Recommendation: We recommend GLO update their password settings to align with the agency’s password policy. Views of responsible officials: We concur with the finding and the recommendation. Of note is that MIP is a standalone system and doesn’t provide the same password complexity and lockout capability that Active Directory offers, so we will address these individually. The risk associated with not having this same capability in the MIP system is somewhat mitigated by MIP being a system that is only available on-premises or via VPN with a valid Active Directory account.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Reporting – Information Technology – User Access Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Various Various Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Community Development and Revitalization (CDR) division of GLO uses TIGR as its primary grant management system of record. It is used to manage and process CDBG-DR and CDBG-MIT grant transactions. During our testing, we noted one of 13 terminations selected for testing did not have their Active Directory and TIGR access revoked upon termination in accordance with GLO’s Account Management policies, which state: 1.8 All access accounts established for contractors, consultants, vendors, and maintenance accounts must be disabled immediately upon termination or completion of the contract period. 1.9 In the event of involuntary termination of users, access must be removed or disabled prior to or at the same time the user is notified of the termination. The employee was terminated on July 5, 2023, however, their access was not removed. Subsequent to audit procedures, management terminated access to the Active Directory on September 25, 2023, and TIGR on September 28, 2023. Management was unable to provide evidence to support that neither system had been accessed between the date of the termination and the date that the system access was removed. We also noted that while management affirmed that a privileged user access review was completed for Active Directory accounts, there was no evidence maintained of the completion date, who the review was performed by, or frequency of review. Questioned costs: None. Context: See “Condition.” Cause: The exception related to the terminated employee was caused by a delay in communication between multiple departments within GLO. The exception related to user access reviews was caused by GLO not maintaining adequate documentation. Effect: Failure to disable and archive accounts for users that have been terminated increases the risk of inappropriate access and noncompliance. Failure to maintain adequate documentation of user access reviews may result in omission of steps in the review process. Repeat finding: No Recommendation: We recommend GLO enhance the existing process to allow for timely communication of terminated employees. Additionally, we recommend GLO develop a policy that outlines the documentation of user access reviews. Views of responsible officials: We concur with the finding and the recommendation and will take action to address the concerns.

Reporting – FFATA Subawards Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B-18-DP-48-0002 January 12, 2021 – January 12, 2033 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: GLO’s Contract Department determines subawards that are required to be reported in FSRS under FFATA reporting requirements. These subawards are subsequently provided to GLO’s Federal Finance and Grants Management to report in FSRS. During our testing, we noted the following exceptions: See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See “Condition.” Cause: Subawards were inadvertently omitted from the information provided to Federal Finance and Grants Management resulting in untimely submission. Effect: Failure to submit FFATA subawards timely may lead to noncompliance with federal requirements. Repeat finding: No Recommendation: We recommend that management establish standard operating procedures in order to guarantee accurate support and timely communication between departments to ensure timely submission of required reports. Views of responsible officials: We agree that two sub-awards were inadvertently omitted from the information provided to Federal Finance and Grants Management, resulting in an untimely submission.

Reporting – PR28 Financial Summary Report Federal Agency: U.S. Department of Housing and Urban Development Federal Program Title: Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii ALN: 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B-22-DC-48-004 September 1, 2022 – September 1, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per U.S. Department of Housing and Urban Development (HUD) notice CPD-21-11, when generating the PR28 PER Financial Summary in IDIS, states have the ability to enter various adjustment parameters to data summarized from within IDIS. These adjustments are specific to each individual PR28 PER Financial Summary and are displayed in the report output. For any PR28 PER Financial Summary where the grantee made adjustments, the grantee must attach an explanation to the report. Condition: Texas Department of Agriculture (TDA) is required to submit the PR28 Financial Summary report and record any necessary adjustments to the financial report. During our testing, we noted TDA did not make the necessary adjustments to match supporting documentation from TDA accounting systems. The following adjustments were not reported as follows:  Line B13: Adjustment to compute total set aside for State Administration - $421,994  Line B21: Adjustment to compute total redistributed – ($2,630,787)  Line B24: Adjustment to compute total not yet distributed - $2,181,312  Line D47: Adjustments to compute total subject to PS cap – ($5,756)  Line D56: Adjustments to compute total subject to P/A cap – ($5,756) Questioned costs: None. Context: See "Condition" Cause: While management maintained supporting documentation, they failed to make the appropriate adjustments to PR28 Financial Summary Report. Effect: Failure to report accurate data on the PR28 Financial Summary report could compromise HUD’s ability to monitor CDBG expenditures and compliance with statutory requirements. Repeat finding: No Recommendation: TDA should enhance internal controls surrounding reporting to ensure accurate data is being outputted in accordance with the requirements of the respective report. Views of responsible officials: TDA agrees with the finding. TDA acknowledges that the appropriate adjustments are not reflected in the PR-28 report originally submitted for Program Year 2022.

Reporting – FFATA Federal Agency: U.S. Department of Agriculture U.S. Department of Housing and Urban Development Federal Program Title: Child Nutrition Cluster (CNC) Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (CDBG) ALN: 10.553, 10.555, 10.556, 10.559, 10.582 14.228 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: CNC 236TX332N1099, 236TX332N1199, 236TX375L1603 October 1, 2022 – September 30, 2023 CDBG B-21-DC-48-0001, B-22-DC-48-0001 September 1, 2021 – September 1, 2028, September 1, 2021 – September 1, 2028, September 1, 2022 – September 1, 2029 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: Texas Department of Agriculture (TDA) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). During our testing, we noted the following compliance exceptions: Child Nutrition Cluster- Fresh Fruit and Vegetable Program (ALN 10.582) See chart or table in the Schedule of Findings and Questioned Costs. Child Nutrition Cluster- National School Lunch Program (ALN 10.555) See chart or table in the Schedule of Findings and Questioned Costs. Community Development Block Grant (ALN 14.228) See chart or table in the Schedule of Findings and Questioned Costs. Questioned costs: None. Context: See "Condition." Cause: As related to ALN 10.582 and 10.555, TDA reports expenditures at the end of the subaward period rather than reporting subawards over $30,000 by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. This was due to the nature of the subaward agreements, where subaward amounts are not specified in the agreement and subrecipients are reimbursed based on actual expenditures incurred each month. As related to subawards not reported for ALN 10.555, TDA did not attempt to report subawards during the fiscal year due to significant technical difficulties encountered uploading subaward data into the FSRS in previous periods. As related to 14.228, reports were submitted late due to management oversight. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: No Recommendation: TDA should revise its current policies and procedures to ensure all subaward/ subaward amendment obligations over $30,000 are identified and submitted in FSRS by the last day of the month following the month in which the subaward/ subaward amendment obligation was made or the subcontract award/subcontract modification was made. Additionally, TDA should attempt to submit subaward information as required. If unsuccessful due to technical matters related to FSRS, TDA should retain documentation of the resolution efforts and submit subaward information immediately after the matter has been resolved. Views of responsible officials: CNC – TDA FND agrees with the CLA’s recommendation. CDBG – TDA agrees with the finding. TDA acknowledges the FFATA reports were not submitted timely.

Subrecipient Monitoring Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0266 – 2021, 1505-0270 – 2021. January 6, 2022 – December 29, 2022 and May 5, 2021 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR sections 200.332 (d) through (f), all pass-through entities must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: TDHCA maintains a Master Planning Summary (MPS) to track all active subrecipient contracts that have expenditures in the planning phase, which are to be considered for sampling and potential selection for review. During our testing, we noted one subrecipient contract with expenditures during the fiscal year that was not included in the MPS for potential selection for a review. Questioned costs: None. Context: See “Condition.” Cause: Management is not adhering to the subrecipient monitoring procedures to ensure all active subrecipient contracts with expenditures incurred during the fiscal year are at least considered for review by being included in the MPS. Effect: Failure to complete proper monitoring over subrecipients may lead to noncompliance with grant terms and conditions. Repeat finding: No Recommendation: We recommend that TDHCA strengthen its internal controls to ensure that all subrecipients are included in the MPS and subject to review. Views of responsible officials: The Department’s Compliance Subrecipient Monitoring (CMSM) staff acknowledges that a subrecipient was erroneously not included in the Master Planning Summary. However, the Department’s procedures for risk assessment and monitoring activities for this review period remain compliant with 2 CFR section 200.303(a) as well as 2 CFR section 200.331(6)(b). Risk assessment for non-formula funded contracts is 100% risk based. Both risk assessment and subsequent monitoring functions represent a snapshot of the Department’s pass-through activities and 100% review is not required. It is the Department’s stance that this error does not materially impact the risk assessment process or the scope of this audit.

Special Tests and Provisions – ERA Funds Reallocation Federal Agency: U.S. Department of the Treasury Federal Program Title: Emergency Rental Assistance Program ALN: 21.023 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0270 – 2021 May 5, 2021 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.302, the non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. Further, the financial management system of each non-Federal entity must provide accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements. Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per Treasury’s ERA2 Reallocation Guidance Updated November 15, 2022, the ERA2 statute requires Treasury to identify funds for reallocation from amounts allocated to eligible Grantees, but not yet paid out to them. Specifically, the statute provides that beginning on March 31, 2022, Treasury must “reallocate funds allocated to eligible grantees … but not yet paid,” according to a procedure established by Treasury. Condition: Audit procedures included a review of the ERA2 Quarter 3 2022 (July-September) and ERA2 Quarter 4 2022 (October-December) Compliance Reports. We noted that $6,777,186 was double counted on the ‘Cumulative Amount of Award Obligated as of the end of the Reporting Period’ amount in the ERA2 Quarter 4 2022 Compliance Report. Questioned costs: None. Context: See "Condition" Cause: Obligated amounts were duplicated when preparing the supporting worksheets due to management oversight. Effect: Inaccurate supporting data when calculating reallocation expenditure ratios may result in an incorrect amount of excess funds subject to recapture by Treasury. Repeat finding: 2022-025 Recommendation: We recommend management enhance its internal controls over the review of supporting reallocation expenditure ratio calculations. Views of responsible officials: Management agrees with the finding and recommendation

Eligibility Federal Agency: U.S. Department of the Treasury Federal Program Title: Homeowner Assistance Fund Program ALN: 21.026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0269 – 2021 May 3, 2021 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of 60 individual payments to program participants, we noted the following exceptions for one sampled payment:  The servicer failed to provide an original loan amount. While the deed of trust was used to confirm conforming loan limits, it was not retained. The deed of trust was subsequently provided, however, we were unable to verify that the applicant provided a deed of trust prior to approval.  The applicant was enrolled in the Mortgage Reinstatement Program, which states that the debt to-income ratio must be between 31.01% and 55.0% and the applicant states they can afford to make the mortgage payments. We noted that the while the applicant had a 32.01% debt-to-income ratio, they stated they cannot afford to continue mortgage payments. As such, the applicant should have been enrolled in the Reinstatement plus Monthly payment assistance (R+U) program, which provides full monthly payment assistance to homeowners who are past due on their mortgage and unable to make full mortgage payments due to a continuing financial hardship associated with the Coronavirus pandemic. Questioned costs: None. Context: See "Condition" Cause: Management did not retain documentation to support eligibility determinations in the case file. With respect to program placement, the applicant was enrolled in the incorrect program due to changes in program types concurrently taking place. Effect: Ineffective controls over loan eligibility could result in payments on ineligible loans. Additionally, incorrectly placing participants in programs may result in ineligible payments or erroneously denying payments. Repeat finding: No Recommendation: We recommend enhancing current policies and procedures to ensure that the case auditors and supervisors are: (1) not approving applications with incomplete documentation and (2) properly placing participants in the correct program. Views of responsible officials: Management concurs with the control deficiency.

Reporting Federal Agency: U.S. Department of the Treasury Federal Program Title: Homeowner Assistance Fund Program ALN: 21.026 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 1505-0269 – 2021 May 3, 2021 – September 30, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR §200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Department of Treasury’s Homeowner Assistance Fund (HAF) guidance on participant compliance and reporting responsibilities, HAF participants are required to submit quarterly reports (PRA 1505-0269) that include data regarding programs, expenditures, demographic distribution, civil rights compliance, equity indicators, community engagement efforts, and programmatic data. To provide public transparency on whether programs are using practices that promote on-time and on-budget delivery, Treasury will seek information from HAF participants on their workforce plans and practices related to HAF programs. The reports contain key line items with critical information as follows: 1. Administrative Expenses - Quantifiable Objective Criteria: Obligations and expenditures do not exceed 15% for admin expenses. 2. Services, Counseling & Education - Quantifiable Objective Criteria: Obligations and expenditures do not exceed 5% for legal services, counseling, and education. Condition: Audit procedures included a review of the key line items within the quarterly reports for the periods ending December 31, 2022 and March 31, 2023. While TDHCA did not exceed the percentage maximums for each key line item, we noted the following variances for Administrative Obligations and Expenses: December 31, 2022 Report  Obligations – Total cumulative obligations reported was $121,740,816, however the amount per supporting documentation provided was $95,675,808, resulting in a variance of $26,065,008.  Expenditures – Total cumulative expenditures reported was $32,309,867, however, the amount per supporting documentation was $31,498,881 resulting in a variance of $810,986.  Specific to contracts with CDCs, Housing Counselors, Affordable Housing Providers for Intake Centers and Outreach, review of the expenditure detail indicated that the $1,781,278 of cumulative expenditures reported included other costs not related to this category. March 31, 2023 Report  Obligations – Total cumulative obligations reported was $104,384,814, however, the amount per supporting documentation was $96,426,918, resulting in a variance of $7,957,896.  Expenditures – Total cumulative expenditures reported was $41,113,838, however, the amount per supporting documentation was $45,208,650, resulting in a variance of ($4,094,812).  Specific to contracts with expenditures for CDCs, Housing Counselors, Affordable Housing Providers for Intake Centers and Outreach, review of the expenditure detail indicated that the $0 of cumulative expenditures reported is incorrect. We noted cumulative expenditures for 100% intake of $2,324,512. These are at minimum expenditures as there are subrecipient contracts allocated between intake, counseling, and legal. which TDHCA did incur expenditures in Q1 2023 and previous quarters. Management was unable to provide an analysis of these expenditures to allocate the respective portion to intake. Questioned costs: None. Context: See "Condition" Cause: TDHCA reported budgeted amounts rather than obligated amounts as defined by the U.S. Treasury Homeowner Assistance Fund Guidance on Participant Compliance and Reporting Responsibilities. Additionally, TDHCA’s controls over the review of reports were not operating at a precision level that would identify reported amounts that do not agree to supporting documentation. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported to the federal government. Repeat finding: No Recommendation: We recommend management enhance its internal controls to ensure obligations reported on federal reports meet the definition of an obligation per Treasury and that amounts agree to supporting documentation. Views of responsible officials: Management concurs with the control deficiency.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Change Management Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: System changes that were applied to the production Texas Travel Industry Recovery Grant Program (TTIR) environment were not documented in accordance with appropriate change management procedures. We were unable to verify that changes were requested, approved, and segregation of duties existed within the process for five of the five samples selected for testing. Questioned costs: None. Context: See “Condition.” Cause: OOG currently utilizes emails and Microsoft Teams messages to transmit information during the change management process request and approval process. However, documentation from these methods was not retained. Effect: Failure to formally document system changes could result in undocumented or unauthorized changes to the application. Repeat finding: No Recommendation: We recommend formally documenting and retaining the request and approval of all changes related to the TTIR application. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the documented evidence of Change Management execution is insufficient. While the change management procedure is in practice cohesive and in continued use, the documentation of such and evidence of the repeatability thereof, is insufficient for the Texas Travel Industry Recovery Grant Program (TTIR) Portal.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Logical Access Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year. Questioned costs: None. Context: See “Condition.” Cause: Management’s timeline to complete the user access review was delayed. Effect: Failure to perform user access reviews in a timely manner could result in undetected inappropriate access or inappropriate changes to the application. Repeat finding: No Recommendation: We recommend that OOG enforce current policies and procedures in relation to eGrants to complete timely user access reviews and document the results. The user access review should include a review of all privileged accounts on a periodic basis to verify that all active accounts are supported by a business purpose. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year.

Reporting Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and NoncomplianceCriteria or specific requirement: Per 2 CFR section 200.303(a), the a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Compliance and Reporting Guidance Version 5.0, for purposes of reporting in the SLFRF portal, an obligation is an order placed for property and services, contracts and subawards made, and similar transactions that require payment. Condition: OOG is the prime recipient of SLFRF funds for the State of Texas. Per Senate Bill 8, funds are passed through to other state agencies to expend on programs established by the Senate Bill. On a quarterly basis, OOG receives ‘Agency Reconcilers’ from each state agency with reported amounts for each of their respective programs per Senate Bill 8 in order to prepare the state-wide Project and Expenditure Report. Audit procedures included testing of the December 31, 2022 and March 31, 2023 Project and Expenditure Reports, which combined Agency Reconcilers for 33 programs and 41 programs, respectively. We compared the amounts reported on the Project and Expenditure Reports as submitted to Treasury to the amounts noted on the ‘Agency Reconcilers’ submitted by the pass-through state agencies noting the following variances by key line item: December 31, 2022 Project and Expenditure Report  OOG was unable to provide the Agency Reconciler for five programs. As such, we were unable to validate all key line items reported for those agencies.  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for nine programs, resulting in a variance of ($61,450,208).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 12 programs, resulting in a variance of $333,636,497.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for five programs, resulting in a variance of ($85,590,747)  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($74,511). March 31, 2023 Project and Expenditure Report  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 15 programs, resulting in a variance of ($115,194,311).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 22 programs, resulting in a variance of $572,738,964.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for eight programs, resulting in a variance of ($20,661,270).  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($32,479). Questioned costs: None. Context: See “Condition.” Cause: Variances related to cumulative obligations were due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances were due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. OOG reported amounts reported in its eGrants system rather than the amounts reported by the state agencies. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported to the federal government. Repeat finding: No Recommendation: We recommend management enhance its internal controls to ensure obligations reported on federal reports meet the definition of an obligation per SLFRF Compliance and Reporting Guidance Version 5.0 and that amounts reported by the state agencies reconcile to the amounts reported in eGrants and the Project and Expenditures Reports. Management should reconcile discrepancies between eGrants and the amounts reported by the state agencies and obtain revised Agency Reconcilers, if appropriate. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the variances related to cumulative obligations are due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances are due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. When variances occurred, it was typically the result of data entry errors within the Agency Reconcilers. In these cases, the OOG deferred to the amounts reported in its eGrants system rather than the amounts reported by the state agencies in the Agency Reconcilers.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Change Management Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: System changes that were applied to the production Texas Travel Industry Recovery Grant Program (TTIR) environment were not documented in accordance with appropriate change management procedures. We were unable to verify that changes were requested, approved, and segregation of duties existed within the process for five of the five samples selected for testing. Questioned costs: None. Context: See “Condition.” Cause: OOG currently utilizes emails and Microsoft Teams messages to transmit information during the change management process request and approval process. However, documentation from these methods was not retained. Effect: Failure to formally document system changes could result in undocumented or unauthorized changes to the application. Repeat finding: No Recommendation: We recommend formally documenting and retaining the request and approval of all changes related to the TTIR application. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the documented evidence of Change Management execution is insufficient. While the change management procedure is in practice cohesive and in continued use, the documentation of such and evidence of the repeatability thereof, is insufficient for the Texas Travel Industry Recovery Grant Program (TTIR) Portal.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Logical Access Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year. Questioned costs: None. Context: See “Condition.” Cause: Management’s timeline to complete the user access review was delayed. Effect: Failure to perform user access reviews in a timely manner could result in undetected inappropriate access or inappropriate changes to the application. Repeat finding: No Recommendation: We recommend that OOG enforce current policies and procedures in relation to eGrants to complete timely user access reviews and document the results. The user access review should include a review of all privileged accounts on a periodic basis to verify that all active accounts are supported by a business purpose. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year.

Reporting Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and NoncomplianceCriteria or specific requirement: Per 2 CFR section 200.303(a), the a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Compliance and Reporting Guidance Version 5.0, for purposes of reporting in the SLFRF portal, an obligation is an order placed for property and services, contracts and subawards made, and similar transactions that require payment. Condition: OOG is the prime recipient of SLFRF funds for the State of Texas. Per Senate Bill 8, funds are passed through to other state agencies to expend on programs established by the Senate Bill. On a quarterly basis, OOG receives ‘Agency Reconcilers’ from each state agency with reported amounts for each of their respective programs per Senate Bill 8 in order to prepare the state-wide Project and Expenditure Report. Audit procedures included testing of the December 31, 2022 and March 31, 2023 Project and Expenditure Reports, which combined Agency Reconcilers for 33 programs and 41 programs, respectively. We compared the amounts reported on the Project and Expenditure Reports as submitted to Treasury to the amounts noted on the ‘Agency Reconcilers’ submitted by the pass-through state agencies noting the following variances by key line item: December 31, 2022 Project and Expenditure Report  OOG was unable to provide the Agency Reconciler for five programs. As such, we were unable to validate all key line items reported for those agencies.  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for nine programs, resulting in a variance of ($61,450,208).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 12 programs, resulting in a variance of $333,636,497.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for five programs, resulting in a variance of ($85,590,747)  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($74,511). March 31, 2023 Project and Expenditure Report  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 15 programs, resulting in a variance of ($115,194,311).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 22 programs, resulting in a variance of $572,738,964.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for eight programs, resulting in a variance of ($20,661,270).  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($32,479). Questioned costs: None. Context: See “Condition.” Cause: Variances related to cumulative obligations were due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances were due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. OOG reported amounts reported in its eGrants system rather than the amounts reported by the state agencies. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported to the federal government. Repeat finding: No Recommendation: We recommend management enhance its internal controls to ensure obligations reported on federal reports meet the definition of an obligation per SLFRF Compliance and Reporting Guidance Version 5.0 and that amounts reported by the state agencies reconcile to the amounts reported in eGrants and the Project and Expenditures Reports. Management should reconcile discrepancies between eGrants and the amounts reported by the state agencies and obtain revised Agency Reconcilers, if appropriate. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the variances related to cumulative obligations are due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances are due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. When variances occurred, it was typically the result of data entry errors within the Agency Reconcilers. In these cases, the OOG deferred to the amounts reported in its eGrants system rather than the amounts reported by the state agencies in the Agency Reconcilers.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Change Management Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: System changes that were applied to the production Texas Travel Industry Recovery Grant Program (TTIR) environment were not documented in accordance with appropriate change management procedures. We were unable to verify that changes were requested, approved, and segregation of duties existed within the process for five of the five samples selected for testing. Questioned costs: None. Context: See “Condition.” Cause: OOG currently utilizes emails and Microsoft Teams messages to transmit information during the change management process request and approval process. However, documentation from these methods was not retained. Effect: Failure to formally document system changes could result in undocumented or unauthorized changes to the application. Repeat finding: No Recommendation: We recommend formally documenting and retaining the request and approval of all changes related to the TTIR application. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the documented evidence of Change Management execution is insufficient. While the change management procedure is in practice cohesive and in continued use, the documentation of such and evidence of the repeatability thereof, is insufficient for the Texas Travel Industry Recovery Grant Program (TTIR) Portal.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Logical Access Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year. Questioned costs: None. Context: See “Condition.” Cause: Management’s timeline to complete the user access review was delayed. Effect: Failure to perform user access reviews in a timely manner could result in undetected inappropriate access or inappropriate changes to the application. Repeat finding: No Recommendation: We recommend that OOG enforce current policies and procedures in relation to eGrants to complete timely user access reviews and document the results. The user access review should include a review of all privileged accounts on a periodic basis to verify that all active accounts are supported by a business purpose. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year.

Reporting Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and NoncomplianceCriteria or specific requirement: Per 2 CFR section 200.303(a), the a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Compliance and Reporting Guidance Version 5.0, for purposes of reporting in the SLFRF portal, an obligation is an order placed for property and services, contracts and subawards made, and similar transactions that require payment. Condition: OOG is the prime recipient of SLFRF funds for the State of Texas. Per Senate Bill 8, funds are passed through to other state agencies to expend on programs established by the Senate Bill. On a quarterly basis, OOG receives ‘Agency Reconcilers’ from each state agency with reported amounts for each of their respective programs per Senate Bill 8 in order to prepare the state-wide Project and Expenditure Report. Audit procedures included testing of the December 31, 2022 and March 31, 2023 Project and Expenditure Reports, which combined Agency Reconcilers for 33 programs and 41 programs, respectively. We compared the amounts reported on the Project and Expenditure Reports as submitted to Treasury to the amounts noted on the ‘Agency Reconcilers’ submitted by the pass-through state agencies noting the following variances by key line item: December 31, 2022 Project and Expenditure Report  OOG was unable to provide the Agency Reconciler for five programs. As such, we were unable to validate all key line items reported for those agencies.  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for nine programs, resulting in a variance of ($61,450,208).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 12 programs, resulting in a variance of $333,636,497.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for five programs, resulting in a variance of ($85,590,747)  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($74,511). March 31, 2023 Project and Expenditure Report  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 15 programs, resulting in a variance of ($115,194,311).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 22 programs, resulting in a variance of $572,738,964.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for eight programs, resulting in a variance of ($20,661,270).  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($32,479). Questioned costs: None. Context: See “Condition.” Cause: Variances related to cumulative obligations were due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances were due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. OOG reported amounts reported in its eGrants system rather than the amounts reported by the state agencies. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported to the federal government. Repeat finding: No Recommendation: We recommend management enhance its internal controls to ensure obligations reported on federal reports meet the definition of an obligation per SLFRF Compliance and Reporting Guidance Version 5.0 and that amounts reported by the state agencies reconcile to the amounts reported in eGrants and the Project and Expenditures Reports. Management should reconcile discrepancies between eGrants and the amounts reported by the state agencies and obtain revised Agency Reconcilers, if appropriate. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the variances related to cumulative obligations are due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances are due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. When variances occurred, it was typically the result of data entry errors within the Agency Reconcilers. In these cases, the OOG deferred to the amounts reported in its eGrants system rather than the amounts reported by the state agencies in the Agency Reconcilers.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Change Management Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: System changes that were applied to the production Texas Travel Industry Recovery Grant Program (TTIR) environment were not documented in accordance with appropriate change management procedures. We were unable to verify that changes were requested, approved, and segregation of duties existed within the process for five of the five samples selected for testing. Questioned costs: None. Context: See “Condition.” Cause: OOG currently utilizes emails and Microsoft Teams messages to transmit information during the change management process request and approval process. However, documentation from these methods was not retained. Effect: Failure to formally document system changes could result in undocumented or unauthorized changes to the application. Repeat finding: No Recommendation: We recommend formally documenting and retaining the request and approval of all changes related to the TTIR application. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the documented evidence of Change Management execution is insufficient. While the change management procedure is in practice cohesive and in continued use, the documentation of such and evidence of the repeatability thereof, is insufficient for the Texas Travel Industry Recovery Grant Program (TTIR) Portal.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Logical Access Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year. Questioned costs: None. Context: See “Condition.” Cause: Management’s timeline to complete the user access review was delayed. Effect: Failure to perform user access reviews in a timely manner could result in undetected inappropriate access or inappropriate changes to the application. Repeat finding: No Recommendation: We recommend that OOG enforce current policies and procedures in relation to eGrants to complete timely user access reviews and document the results. The user access review should include a review of all privileged accounts on a periodic basis to verify that all active accounts are supported by a business purpose. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year.

Reporting Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and NoncomplianceCriteria or specific requirement: Per 2 CFR section 200.303(a), the a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Compliance and Reporting Guidance Version 5.0, for purposes of reporting in the SLFRF portal, an obligation is an order placed for property and services, contracts and subawards made, and similar transactions that require payment. Condition: OOG is the prime recipient of SLFRF funds for the State of Texas. Per Senate Bill 8, funds are passed through to other state agencies to expend on programs established by the Senate Bill. On a quarterly basis, OOG receives ‘Agency Reconcilers’ from each state agency with reported amounts for each of their respective programs per Senate Bill 8 in order to prepare the state-wide Project and Expenditure Report. Audit procedures included testing of the December 31, 2022 and March 31, 2023 Project and Expenditure Reports, which combined Agency Reconcilers for 33 programs and 41 programs, respectively. We compared the amounts reported on the Project and Expenditure Reports as submitted to Treasury to the amounts noted on the ‘Agency Reconcilers’ submitted by the pass-through state agencies noting the following variances by key line item: December 31, 2022 Project and Expenditure Report  OOG was unable to provide the Agency Reconciler for five programs. As such, we were unable to validate all key line items reported for those agencies.  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for nine programs, resulting in a variance of ($61,450,208).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 12 programs, resulting in a variance of $333,636,497.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for five programs, resulting in a variance of ($85,590,747)  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($74,511). March 31, 2023 Project and Expenditure Report  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 15 programs, resulting in a variance of ($115,194,311).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 22 programs, resulting in a variance of $572,738,964.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for eight programs, resulting in a variance of ($20,661,270).  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($32,479). Questioned costs: None. Context: See “Condition.” Cause: Variances related to cumulative obligations were due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances were due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. OOG reported amounts reported in its eGrants system rather than the amounts reported by the state agencies. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported to the federal government. Repeat finding: No Recommendation: We recommend management enhance its internal controls to ensure obligations reported on federal reports meet the definition of an obligation per SLFRF Compliance and Reporting Guidance Version 5.0 and that amounts reported by the state agencies reconcile to the amounts reported in eGrants and the Project and Expenditures Reports. Management should reconcile discrepancies between eGrants and the amounts reported by the state agencies and obtain revised Agency Reconcilers, if appropriate. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the variances related to cumulative obligations are due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances are due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. When variances occurred, it was typically the result of data entry errors within the Agency Reconcilers. In these cases, the OOG deferred to the amounts reported in its eGrants system rather than the amounts reported by the state agencies in the Agency Reconcilers.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Change Management Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: System changes that were applied to the production Texas Travel Industry Recovery Grant Program (TTIR) environment were not documented in accordance with appropriate change management procedures. We were unable to verify that changes were requested, approved, and segregation of duties existed within the process for five of the five samples selected for testing. Questioned costs: None. Context: See “Condition.” Cause: OOG currently utilizes emails and Microsoft Teams messages to transmit information during the change management process request and approval process. However, documentation from these methods was not retained. Effect: Failure to formally document system changes could result in undocumented or unauthorized changes to the application. Repeat finding: No Recommendation: We recommend formally documenting and retaining the request and approval of all changes related to the TTIR application. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the documented evidence of Change Management execution is insufficient. While the change management procedure is in practice cohesive and in continued use, the documentation of such and evidence of the repeatability thereof, is insufficient for the Texas Travel Industry Recovery Grant Program (TTIR) Portal.

Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Earmarking, Procurement, Suspension and Debarment, Reporting – Information Technology – Logical Access Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non_x0002_Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year. Questioned costs: None. Context: See “Condition.” Cause: Management’s timeline to complete the user access review was delayed. Effect: Failure to perform user access reviews in a timely manner could result in undetected inappropriate access or inappropriate changes to the application. Repeat finding: No Recommendation: We recommend that OOG enforce current policies and procedures in relation to eGrants to complete timely user access reviews and document the results. The user access review should include a review of all privileged accounts on a periodic basis to verify that all active accounts are supported by a business purpose. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the OOG did not perform a documented periodic access review of users for the eGrants application, which would include a review of privileged users’ access during the fiscal year.

Reporting Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: CACT Section 3: Children’s Advocacy; OOG TTIR Section 2; OOG Section 24: Trusted Programs within the Office of the Governor November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and NoncomplianceCriteria or specific requirement: Per 2 CFR section 200.303(a), the a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Compliance and Reporting Guidance Version 5.0, for purposes of reporting in the SLFRF portal, an obligation is an order placed for property and services, contracts and subawards made, and similar transactions that require payment. Condition: OOG is the prime recipient of SLFRF funds for the State of Texas. Per Senate Bill 8, funds are passed through to other state agencies to expend on programs established by the Senate Bill. On a quarterly basis, OOG receives ‘Agency Reconcilers’ from each state agency with reported amounts for each of their respective programs per Senate Bill 8 in order to prepare the state-wide Project and Expenditure Report. Audit procedures included testing of the December 31, 2022 and March 31, 2023 Project and Expenditure Reports, which combined Agency Reconcilers for 33 programs and 41 programs, respectively. We compared the amounts reported on the Project and Expenditure Reports as submitted to Treasury to the amounts noted on the ‘Agency Reconcilers’ submitted by the pass-through state agencies noting the following variances by key line item: December 31, 2022 Project and Expenditure Report  OOG was unable to provide the Agency Reconciler for five programs. As such, we were unable to validate all key line items reported for those agencies.  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for nine programs, resulting in a variance of ($61,450,208).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 12 programs, resulting in a variance of $333,636,497.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for five programs, resulting in a variance of ($85,590,747)  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($74,511). March 31, 2023 Project and Expenditure Report  Current period obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 15 programs, resulting in a variance of ($115,194,311).  Cumulative obligations – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for 22 programs, resulting in a variance of $572,738,964.  Current period expenditures – Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for eight programs, resulting in a variance of ($20,661,270).  Cumulative expenditures - Amounts reported in the Project and Expenditure Report did not agree to the Agency Reconcilers for one program, resulting in a variance of ($32,479). Questioned costs: None. Context: See “Condition.” Cause: Variances related to cumulative obligations were due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances were due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. OOG reported amounts reported in its eGrants system rather than the amounts reported by the state agencies. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported to the federal government. Repeat finding: No Recommendation: We recommend management enhance its internal controls to ensure obligations reported on federal reports meet the definition of an obligation per SLFRF Compliance and Reporting Guidance Version 5.0 and that amounts reported by the state agencies reconcile to the amounts reported in eGrants and the Project and Expenditures Reports. Management should reconcile discrepancies between eGrants and the amounts reported by the state agencies and obtain revised Agency Reconcilers, if appropriate. Views of responsible officials: The Office of the Governor (OOG) management agrees with the finding that the variances related to cumulative obligations are due to OOG reporting budgeted amounts rather than obligated amounts as defined by the SLFRF Compliance and Reporting Guidance Version 5.0. The remaining variances are due to discrepancies between the Agency Reconcilers and amounts reported in OOG’s eGrants system. When variances occurred, it was typically the result of data entry errors within the Agency Reconcilers. In these cases, the OOG deferred to the amounts reported in its eGrants system rather than the amounts reported by the state agencies in the Agency Reconcilers.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.