Findings Citing § 200.334

FINDING REFERENCE NUMBER 2024-041 FEDERAL PROGRAM (ALN – 93.568) LOW-INCOME HOME ENERGY ASSISTANCE U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES AWARD NUMBERS 2301PRLIEA (Federal Award Year: 10/1/2022 – 9/30/2024) 2401PRLIEA (Federal Award Year: 10/1/2023 – 9/30/2025) 2301PRLIEE (Federal Award Year: 10/1/2022 – 9/30/2024) 2301PRLIEI (Federal Award Year: 10/1/2022 – 9/30/2024) ADMINISTRATION ADMINISTRATION FOR SOCIOECONOMIC DEVELOPMENT OF THE FAMILY (ADSEF, BY ITS SPANISH ACRONYM) COMPLIANCE REQUIREMENT REPORTING – PERFORMANCE TYPE OF FINDING INTERNAL CONTROL AND COMPLIANCE – MATERIAL WEAKNESS AND MATERIAL NONCOMPLIANCE CRITERIA Uniform Guidance at 2 CFR § 200.302, Financial Management, establishes that: (a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State's funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. (See § 200.450.) (b) The recipient's and subrecipient's financial management system must provide for the following (see §§ 200.334, 200.335, 200.336, and 200.337): (1) Identification of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number, year the Federal award was issued, and name of the Federal agency or pass-through entity. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. When a Federal agency or pass-through entity requires reporting on an accrual basis from a recipient or subrecipient that maintains its records other than on an accrual basis, the recipient or subrecipient must not be required to establish an accrual accounting system. This recipient or subrecipient may develop accrual data for its reports based on an analysis of the documentation on hand. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. (4) Effective control over and accountability for all funds, property, and assets. The recipient or subrecipient must safeguard all assets and ensure they are used solely for authorized purposes. See § 200.303. … (6) Written procedures to implement the requirements of § 200.305 and (7) Written procedures for determining the allowability of costs in accordance with subpart E and the terms and conditions of the Federal award. LlHEAP Performance Data Form (OMB No 0970-0449) – State grant recipients must submit this report by January 3lst regarding the prior Federal fiscal year. The first section of the report is the Grant recipient Survey that collects and reports data on sources and uses of LIHEAP funds. The Grant recipient Survey includes Section III: Estimated Sources of Funds and Section IV: Estimated Use of LIHEAP Funds. Note: that these are referencing obligated not expended funding. The rest of the report is regarding performance metrics, mostly related to home energy burden targeting and reduction, as well as the continuity of home energy service. The Grantee Survey obligation amounts should be compared with the Carryover and Reallotment and FFR-425 reports. This reconciliation is needed to make sure the obligated balances for the program year being tested are accurate. Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) https://omb.report/icr/202211-0970-005 – As part of the application for block grant funds each year, a report is required for the preceding fiscal year of (1) the number and income levels of the households assisted for each component and any type of LHEAP assistance (heating, cooling, crisis, and weatherization); and (2) the number of households served that contained young children, elderly, or persons with disabilities, or any vulnerable household for each component. Quarterly Performance and Management Report (OMB No. 0970-0589) https://omb.report/icr/202205-0970-017/doc/121847100 – Grant recipients must submit data and information about LIHEAP during the current FY, including success, challenges, needs and innovations. The quarterly reports focus on assisted households, performance management, obligation of funding, changes made due to anticipated increase in energy bills, collaboration with other utility programs, training and technical assistance needs. STATEMENT OF CONDITION As part of our audit procedures over the financial reporting requirements for LIHEAP program, we selected three reports submitted during our fiscal year. We noted that the administrative expenditures do not reconcile with the accounting information from PRIFAS. In addition, there are no written procedures describing internal controls over this requirement. We requested the LIHEAP Performance Data (OMB No 0970-0449), but no evidence of the report was provided. We obtained a copy of the Annual Report on Households Assisted by LlHEAP (OMB No. 0970-0060), but no supporting documentation regarding the information reported was provided. We requested two quarterly reports for the Quarterly Performance and Management Report (OMB No. 0970-0589) for the 2301LIEA grant, but no documentation was provided. QUESTIONED COSTS None. PERSPECTIVE INFORMATION This is a systematic deficiency. Procedures and internal controls manuals should provide for and ensure the segregation of duties, and the reconciliation of financial information reported to federal agencies against the accounting records used to prepare financial statements and SEFA. ADSEF failure to support reported amounts with verifiable documentation and the absence of independent review increases the risk of inaccurate or misstated financial data being reported to the Federal awarding agency. In relation to Special and Performance Reports, there are no proper controls over the data reported and the supporting information. STATEMENT OF CAUSE During our interviews and understanding of the internal controls over financial reporting, we noted that only one person prepares, submits and certifies the SF– 425 reports. No proper segregation of duties exists, that allows for validation of all accounting data before submitting the reports. In addition, the procedures manual for preparing reports does not establish a clear process for obtaining information, validating it, recording it, preparing it, and reporting it, as well as the responsibilities and segregation of duties to ensure that the reported information is consistent with ADSEF's accounting records. ADSEF lacks internal controls that allow for the timely validation and reconciliation of financial information. Furthermore, they lack a written procedures manual detailing the processes to follow in obtaining accounting data and reporting it to the Federal government, ensuring that the responsibility does not fall on a single individual. In relation to the Special and Performance Reports, the lack of written procedures and proper safeguarding of documentation does not allow for demonstrating compliance with the requirements of these reports. POSSIBLE ASSERTED EFFECT ADSEF does not ensure that the reports are accurate and traceable to the accounting database used to prepare their financial reports to the Federal Agencies and their financial statement. We were unable to evaluate internal controls and compliance over the Special and Performance Reports. ADSEF might not comply with the requirements of the program and not report it on time to the regulatory agencies. IDENTIFICATION OF REPEAT FINDING This is a repeat of a finding reported in the prior audit as Finding Numbers 2023-021/2023-051. RECOMMENDATIONS We recommend ADSEF to establish written procedures and internal controls manuals to provide and document the segregation of duties related to the reporting compliance requirement. In addition, in relation to the Special and Performance Reports create internal controls that provide for obtaining information, preparing reports, and filing evidence of reports.

FINDING REFERENCE NUMBER 2024-042 FEDERAL PROGRAM (ALN – 93.558) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES (TANF) U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES AWARD NUMBERS 2022G996117 (Federal Award Year: 10/1/2021 – 9/30/2022) 2023G996117 (Federal Award Year: 10/1/2022 – 9/30/2023) ADMINISTRATION ADMINISTRATION FOR SOCIOECONOMIC DEVELOPMENT OF THE FAMILY (ADSEF, BY ITS SPANISH ACRONYM) COMPLIANCE REQUIREMENT REPORTING – PERFORMANCE TYPE OF FINDING INTERNAL CONTROL AND COMPLIANCE – MATERIAL WEAKNESS AND MATERIAL NONCOMPLIANCE CRITERIA In accordance with 45 CFR, Subtitle B, Chapter II, Part 265.7, states that: (a) Each State's quarterly reports [the TANF Data Report, the TANF Financial Report (or Territorial Financial Report), the SSP-MOE Data Report, and the Work Outcomes of TANF Exciters Report] must be complete and accurate and filed by the due date. (b) For a disaggregated data report, “a complete and accurate report” means that: (1) The reported data accurately reflects information available to the State in case records, financial records, and automated data systems, and includes correction of the quarterly data by the end of the fiscal year reporting period; (2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so); (3) The State reports data for all required elements (i.e., no data is missing); (4) (i) The State provides data on all families; or (ii) If the State opts to use sampling, the State reports data on all families selected in a sample that meets the specification and procedures in the TANF Sampling Manual (except for families listed in error); and (5) Where estimates are necessary (e.g., some types of assistance may require cost estimates), the State uses reasonable methods to develop these estimates. (c) For an aggregated data report, “a complete and accurate report” means that: (1) The reported data accurately reflects information available to the State in case records, financial records, and automated data systems; (2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so); (3) The State reports data on all applicable elements; and (4) Monthly totals are unduplicated counts for all families (e.g., the number of families and the number of out-of-wedlock births are unduplicated counts). In addition, 2 CFR § 200.302 (a) establishes that each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State's funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. See § 200.450. In section (b) the recipient's and subrecipient's financial management system must provide for the following (see §§ 200.334, 200.335, 200.336, and 200.337): (6) written procedures to implement the requirements of § 200.305 and (7) written procedures for determining the allowability of costs in accordance with subpart E and the terms and conditions of the Federal award. STATEMENT OF CONDITION As part of our procedures for understanding internal controls for the preparation of ACF-199 reports, we request a procedures manual on how these reports are processed and the personnel responsible for each process. ADSEF did not provide us with a manual describing the data collection process, how the information provided by the regions is validated, and the individuals responsible for submitting the reports. Also, they should have completed the ACF-209 report for the quarters of December 2023 and June 2024 and no evidence was provided. QUESTIONED COSTS None. PERSPECTIVE INFORMATION This is a systemic deficiency. Following the sample selection, ADSEF failed to demonstrate a control structure, as it was unable to provide a formal procedures manual for the reporting process. The sampling was a statistically valid sample. STATEMENT OF CAUSE ADSEF did not establish and implement written policies and procedures governing the preparation, review, validation, and submission of TANF reports. In addition, management did not implement adequate monitoring controls to ensure that required reports were prepared, reviewed, and submitted timely in accordance with Federal requirements. POSSIBLE ASSERTED EFFECT As a result, ADSEF was unable to demonstrate that adequate controls existed to ensure the completeness, accuracy, and timeliness of TANF reporting. This condition resulted in the failure to submit the required ACF-209 reports for the quarters ended December 31, 2023, and June 30, 2024, and increases the risk that Federal reports may contain incomplete or inaccurate information, thereby affecting Federal oversight and decision-making. IDENTIFICATION OF REPEAT FINDING This is a repeat of a finding reported in the prior audit as Finding Number is 2023-052. RECOMMENDATIONS We recommend that management establish internal control procedures manuals that clearly outline the processes to be followed for data collection, recording, and reporting. Additionally, standardize the way documents related to participant files are filed.

FINDING REFERENCE NUMBER 2024-044 (See Finding Reference Number 2024-016) FEDERAL PROGRAMS (ALN – 93.556) MARYLEE ALLEN PROMOTING SAFE AND STABLE FAMILIES (ALN – 93.667) SOCIAL SERVICES BLOCK GRANT U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES AWARD NUMBER 2203PRFPSS (Federal Award Years: 10/1/2021 through 9/30/2023); 2202PRFPCV (Federal Award Years: 10/1/2021 through 9/30/2023) 2211PRSOSR (Federal Award Years: 10/1/2021 through 9/30/2023) ADMINISTRATION ADMINISTRATION FOR FAMILIES AND CHILDREN (ADFAN, BY ITS SPANISH ACRONYM) COMPLIANCE REQUIREMENT REPORTING TYPE OF FINDING INTERNAL CONTROL AND COMPLIANCE – MATERIAL WEAKNESS AND MATERIAL NONCOMPLIANCE CRITERIA Uniform Guidance at 2 CFR § 200.302 (a) establishes that each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State's funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. See § 200.450. In addition, the SF-425 Federal Financial Report requires the reporting of financial activities related to Federal awards. The accounting basis used for reporting expenditures (whether cash or accrual) must align with the accounting system employed by the recipient organization. The 2 CFR § 200.302 (b), establish that the recipient's and subrecipient's financial management system must provide for the following (see §§ 200.334, 200.335, 200.336, and 200.337): … (6) written procedures to implement the requirements of § 200.305 and (7) written procedures for determining the allowability of costs in accordance with subpart E and the terms and conditions of the Federal award. The 2 CFR section 200.328(c) establishes that the recipient or subrecipient must submit financial reports as required by the Federal award. Reports submitted annually by the recipient or subrecipient must be due no later than 90 calendar days after the reporting period. Reports submitted quarterly or semiannually must be due no later than 30 calendar days after the reporting period. The 2 CFR §200.303 (a) establishes that the recipient and subrecipient must: establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). STATEMENT OF CONDITION As part of our audit procedures over internal controls and compliance for reporting requirements, we selected the Grant Awards 2203PRFPSS and 2202PRFPCV, which closes in the audit period from July 2023 to June 2024, to validate the recorded amounts. Upon evaluating the report for the Grant Award 2203PRFPSS, we found the following deficiencies: 1) The accounting basis should be Cash Basis instead of Accrual Basis, according to the accounting system used. Additionally, they provided a Procedures Manual for the Finance and Budget Divisions, approved in 2009 and delivered in Word format, which states that the accounting basis is “accrual”, even though their current system operates on a cash basis and no conversion to accrual basis was made. 2) The total Federal expenditure reported on line (e) does not match the database provided by the PRDF. 3) The matching expenditure on line (j) does not match the database provided by the PRDF. 4) The report was not submitted within the established deadline, December 31, 2023 and they submitted the report on July 8, 2024. 5) During the internal control’s interviews, we found that there is no designated person responsible for reviewing the information entered by the preparer. As part of our audit procedures over internal controls and compliance for reporting requirements, we selected the Grant Award 2211PRSOSR, which closes in the audit period from July 1, 2023 to June 30, 2024, to validate the recorded amounts. Upon evaluating the report, we found the following deficiencies: 1) The accounting basis should be Cash Basis instead of Accrual Basis, according to the accounting system used. Additionally, they provided a Procedures Manual for the Finance and Budget Divisions, approved in 2009 and delivered in Word format, which states that the accounting basis is “accrual”, even though their current system operates on a cash basis and no conversion to accrual basis was made. 2) The total Federal expenditure reported on line (e) does not match the database provided by the PRDF. 3) The report was not submitted within the established deadline, December 31, 2023 and they submitted the report on June 10, 2024. 4) During the internal control’s interviews, we found that there is no designated person responsible for reviewing the information entered by the preparer. QUESTIONED COSTS None. PERSPECTIVE INFORMATION This deficiency is a systemic problem. Procedures and internal controls manuals should provide for and ensure the segregation of duties, training, and the reconciliation of financial information reported to Federal agencies against the accounting records used to prepare financial statement and SEFA. STATEMENT OF CAUSE ADFAN does not have internal controls to effectively review the process and comply with the reporting requirements. The absence of effective internal controls at ADFAN to review processes and ensure compliance with reporting requirements can be attributed to inadequate organizational structure and insufficiently defined roles and responsibilities. There is no designated individual or team responsible for overseeing the accuracy and completeness of financial data entered reports. As mentioned above in the condition, this responsibility falls under one person and does not have segregation of duties. This gap in accountability stems from a lack of internal review and insufficient oversight mechanisms, which restrains the organization's ability to ensure that reports are fully aligned with the required compliance standards. Additionally, there is a lack of training or resources dedicated to maintaining and monitoring compliance which contributes to the failure in reporting requirements. POSSIBLE ASSERTED EFFECT ADFAN does not ensure that the reports are accurate and traceable to the accounting database used to prepare their financial reports for the Federal Agencies and their financial statement. IDENTIFICATION OF REPEAT FINDING This is a repeat of a finding reported in the prior audit as Finding Numbers is 2023-023/2023-054. RECOMMENDATIONS We recommend that ADFAN ensures the SF-425 is completed using the appropriate accounting basis consistent with the organization’s financial system. Additionally, ADFAN should establish and implement internal control procedures that include formal review process to verify the accuracy and completeness of the reported information and designate responsible personnel for the review and approval of reports prior to submission to ensure compliance with Federal reporting requirements.

FINDING REFERENCE NUMBER 2024-046 (See Finding Reference Number 2024-018) FEDERAL PROGRAMS (ALN – 93.558) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES (TANF) (ALN – 93.560) PAYMENT TO TERRITORIES – ADULT U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES AWARD NUMBERS 2022G996117 (Federal Award Year: 10/1/2021 – 9/30/2022) 2023G996117 (Federal Award Year: 10/1/2022 – 9/30/2023) 2022G9922PT (Federal Award Years: 10/1/2022 through 9/30/2025) 2301PRTABD (Federal Award Years: 10/1/2023 through 9/30/2026) ADMINISTRATION ADMINISTRATION FOR SOCIOECONOMIC DEVELOPMENT OF THE FAMILY (ADSEF, BY ITS SPANISH ACRONYM) COMPLIANCE REQUIREMENT REPORTING – FINANCIAL REPORTING TYPE OF FINDING INTERNAL CONTROL AND COMPLIANCE – MATERIAL WEAKNESS AND MATERIAL NONCOMPLIANCE CRITERIA The 2 CFR 200 §200.302, Financial Management, establishes that: “(a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State's funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. See § 200.450. (b) The recipient's and subrecipient's financial management system must provide for the following (see §§ 200.334, 200.335, 200.336, and 200.337): (1) Identification of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number, year the Federal award was issued, and name of the Federal agency or pass-through entity. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. When a Federal agency or pass-through entity requires reporting on an accrual basis from a recipient or subrecipient that maintains its records other than on an accrual basis, the recipient or subrecipient must not be required to establish an accrual accounting system. This recipient or subrecipient may develop accrual data for its reports based on an analysis of the documentation on hand. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. (4) Effective control over and accountability for all funds, property, and assets. The recipient or subrecipient must safeguard all assets and ensure they are used solely for authorized purposes. See § 200.303. … (6) Written procedures to implement the requirements of § 200.305 and (7) Written procedures for determining the allowability of costs in accordance with subpart E and the terms and conditions of the Federal award. STATEMENT OF CONDITION As part of our audit procedures over the reporting requirements for the Temporary Assistance for Needy Families (TANF) and Payment to Territories – Adult (PTTA) programs, we reviewed two ACF-196TR reports submitted during the fiscal year under audit. Our review disclosed deficiencies related to the accuracy, support, reconciliation, and timeliness of reported expenditures. Specifically, we noted the following: • Administrative expenditures for both TANF and PTTA are recorded under the same accounting account number and Assistance Listing Number associated with TANF. As a result, the PRIFA accounting system does not segregate administrative expenditures by federal award or Assistance Listing Number, limiting the ability to identify and track expenditures attributable to each program. • Amounts reported in the ACF-196TR reports could not be reconciled to the PRIFA accounting records, particularly for administrative expenditures. Upon request, management was unable to provide supporting schedules, reconciliations, or documentation demonstrating how the reported amounts were derived. Supporting information was prepared only after it was requested during the audit. • For grant award 2023G996117, reported expenditures in the quarterly report of September 30, 2023, that did not agree with the underlying accounting records. We identified differences of $7,266.40 in Line 6A (Work-Related Activities and Expenses), $1,745,668.00 in Line 5A (Basic Assistance), $1,645,366.55 in Line 6J (Administration), $2,007,611.62 in Line 3 (Transfer to SSBG), and $103,052.41 in Line 10 (Total Expenditures). In addition, the report was submitted after the applicable due date. • For grant award 2401PRTANF, reported expenditures in the June 30, 2024 quarterly report that also differed from the accounting records. We identified differences of $12,312.07 in Line 6A (Work-Related Activities and Expenses), $1,898,639.95 in Line 6J (Administration), $3,786,696.14 in Line 3 (Transfer to SSBG), and $1,902,297.08 in Line 10 (Total Expenditures). Furthermore, the report maintained by ADSEF did not contain evidence of the submission date; therefore, we were unable to determine whether the report was submitted within the required timeframe. QUESTIONED COSTS None. PERSPECTIVE INFORMATION This is a systematic deficiency. Procedures and internal controls manuals should provide for and ensure the segregation of duties, and the reconciliation of financial information reported to Federal agencies against the accounting records used to prepare financial statements and SEFA. In addition, the financial management system should provide to account separately the administrative expenditures incurred among all Federal programs administered. ADSEF failure to support reported amounts with verifiable documentation and the absence of independent review increases the risk of inaccurate or misstated financial data being reported to the Federal awarding agency. STATEMENT OF CAUSE During our interviews and understanding of the internal controls over financial reporting, we noted that only one person prepares, submits and certifies the ACF-196TR reports. No proper segregation of duties exists, that allows for validation of all accounting data before submitting the reports. In addition, the procedures manual for preparing reports does not establish a clear process for obtaining information, validating it, recording it, preparing it, and reporting it, as well as the responsibilities and segregation of duties to ensure that the reported information is consistent with ADSEF's accounting records. PRIFAS accounting data base as configured, does not provide for the administrative expenditures incurred from the TANF and Payment to Territories – Adult programs to be segregated. ADSEF lacks internal controls that allow for the timely validation and reconciliation of financial information. Furthermore, they lack a written procedures manual detailing the processes to follow in obtaining accounting data and reporting it to the Federal government, ensuring that the responsibility does not fall on a single individual. POSSIBLE ASSERTED EFFECT ADSEF does not ensure that the reports are accurate and traceable to the accounting database used to prepare their financial reports to the Federal Agencies and their financial statement. IDENTIFICATION OF REPEAT FINDING This is a repeat of a finding reported in the prior audit as Finding Numbers is 2023-025/2023-056. RECOMMENDATIONS We recommend ADSEF to establish written procedures and internal controls manuals to provide and document the segregation of duties related to the reporting compliance requirement. Additionally, work with the Puerto Rico Department of the Treasury to provide accounting records to segregate the administrative expenditures of both programs.

FINDING REFERENCE NUMBER 2024-051 FEDERAL PROGRAMS (ALN – 93.558) TEMPORARY ASSISTANCE FOR NEEDY FAMILIES (TANF) U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES AWARD NUMBERS 2022G996117 (Federal Award Year: 10/1/2021 – 9/30/2022) 2023G996117 (Federal Award Year: 10/1/20212 – 9/30/2023) 2401PRTANF1 (Federal Award Years: 10/1/2023 through 9/30/2026) ADMINISTRATION ADMINISTRATION FOR SOCIOECONOMIC DEVELOPMENT OF THE FAMILY (ADSEF, BY ITS SPANISH ACRONYM) COMPLIANCE REQUIREMENT SPECIAL TESTS & PROVISIONS – PENALTY FOR REFUSAL TO WORK / LACK OF CHILD CARE FOR SINGLE CUSTODIAL PARENT OF CHILD UNDER AGE SIX / PENALTY FOR FAILURE TO COMPLY WITH WORK VERIFICATION PLAN TYPE OF FINDING INTERNAL CONTROL AND COMPLIANCE – MATERIAL WEAKNESS AND MATERIAL NONCOMPLIANCE CRITERIA 2 CFR 200.334, Record retention requirements, establishes that: the recipient and subrecipient must retain all Federal award records for three years from the date of submission of their final financial report. For awards that are renewed quarterly or annually, the recipient and subrecipient must retain records for three years from the date of submission of their quarterly or annual financial report, respectively. Records to be retained include but are not limited to financial records, supporting documentation, and statistical records. Further, in §200.337, Access to records, requires in (a) Records of recipients and subrecipients. The Federal agency or pass-through entity, Inspectors General, the Comptroller General of the United States, or any of their authorized representatives must have the right of access to any records of the recipient or subrecipient pertinent to the Federal award to perform audits, execute site visits, or for any other official use. This right also includes timely and reasonable access to the recipient's or subrecipient's personnel for the purpose of interviewing and discussion related to such documents or the Federal award in general. STATEMENT OF CONDITION As part of our audit procedures related to tests and special provisions, we selected the following samples: a. Five (5) participants from a population of 23 individuals who were sanctioned for non-compliance with the employment requirement. b. Twenty-five (25) files from a population of 294 participants who were sanctioned for non-compliance with the employment verification plan. c. Twenty-five (25) files from a population of 285 participants who had documented just cause for not having childcare responsibilities. During our review of the selected files, we identified the following deficiencies: a. Just Cause for Not Having Childcare Responsibilities 1. Five (5) files were not provided for audit review. b. Sanctioned for Non-Compliance with the Employment Requirement 1. One (1) file did not contain information for the audit period under review. 2. One (1) file was in the process of being digitized and was therefore unavailable for evaluation. c. Non-Cooperation with the PRI 1. Five (5) files were not provided for audit review. 2. Three (3) files did not indicate the sanction period. 3. Three (3) files lacked documentation for the audit period under review. 4. One (1) file did not contain the required forms necessary to evaluate the sanction. QUESTIONED COSTS None. PERSPECTIVE INFORMATION This deficiency is systematic. ADSEF lacks an adequate process for archiving files and the information each file should contain. This is a statistically valid sample. STATEMENT OF CAUSE ADSEF does not have an adequate archiving process that allows for the identification of files in a reasonable timeframe. Additionally, there is no formal training or archive process for all regions and local authorities for the personnel involved in determining eligibility and the required evidence that should be kept for the audit process. Further, the information related to any sanction should be clearly identified in the participant’s file, so a follow up can be performed adequately and timely. POSSIBLE ASSERTED EFFECT ADSEF was unable to provide the requested information for auditing within a reasonable timeframe. Furthermore, the lack of a uniform archiving process prevents the information contained in the files from being properly identified and reviewed. In addition, these deficiencies in the documentation, do not allow proper follow-up of the sanction period, this could allow payments to participants who are not in compliance with the regulations. IDENTIFICATION OF REPEAT FINDING This is a repeat of a finding reported in the prior audit as Finding Numbers is 2023-060. RECOMMENDATIONS We recommend that management establish an adequate internal controls process that provides for the archiving of information in participant files and the identification of files within a reasonable timeframe. In addition, a structure for follow up on the sanctions should be in place in order to properly monitor compliance with this requirement.

FINDING 2024-006 Subject: Title I Grants to Local Educational Agencies Federal Agency: Department of Education Federal Program: Title I Grants to Local Educational Agencies Assistance Listings Number: 84.010 Federal Award Numbers and Years (or Other Identifying Numbers): S010A210014, S010A220014, S010A230014 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management; Matching, Level of Effort, Earmarking; Reporting; Special Tests and Provisions - Participation of Private School Children; Special Tests and Provisions - Annual Report Card, High School Graduation Rate; Special Tests and Provisions - Assessment Testing Audit Findings: Material Weakness, Modified Opinion INDIANA STATE BOARD OF ACCOUNTS 39 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Repeat Finding This is a repeat finding from the immediately prior audit report for control activities - activities allowed or unallowed; allowable costs/cost principles; cash management; reporting; matching, level of effort, earmarking; and special tests and provisions - participation in private school children. The prior audit finding numbers were 2022-005, 2022-006, 2022-008, and 2022-009. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the entity will achieve its objectives. For federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards to provide reasonable assurance that the entity will comply with applicable federal statutes, regulations, and the terms and conditions of its awards. Internal control is not a single event but an ongoing process that operates through five integrated components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. Each component must function effectively, and the components must operate together in an integrated manner, for an internal control system to be effective. Deficiencies in the internal control system were identified across the five components and are described below. Control Environment - Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management; Matching, Level of Effort, Earmarking; Reporting; Special Tests and Provisions - Participation of Private School Children; Special Tests and Provisions - Annual Report Card, High School Graduation Rate; Special Tests and Provisions - Assessment Testing The School Corporation had not established a strong foundation for an effective internal control system. There was no demonstrated emphasis on the importance of internal controls or on compliance with federal program requirements. Risk Assessment - Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management; Matching, Level of Effort, Earmarking; Reporting; Special Tests and Provisions - Participation of Private School Children; Special Tests and Provisions - Annual Report Card, High School Graduation Rate; Special Tests and Provisions - Assessment Testing The School Corporation had not defined objectives necessary to identify risks or determine risk tolerances. Management did not identify, analyze, or respond to risks that could affect the achievement of objectives, including risks arising from significant changes to operations or the potential for fraud. Control Activities The School Corporation did not maintain sufficient financial records for its Title I programs. Although separate funds were established, expenditures were not accurately recorded, preventing the auditors from properly testing compliance with the federal requirements for the Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management; Matching, Level of Effort, Earmarking; Reporting; Special Tests and Provisions - Participation of Private School Children compliance requirements. Notable errors included payroll mapping errors, as well as unsupported reimbursement requests. INDIANA STATE BOARD OF ACCOUNTS 40 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Expenditures as reported on the Schedule of Expenditures of Federal Awards are based on reimbursements received during the audit period. To determine the specific expenditures associated with each reimbursement request the corresponding ledger activity or other applicable supporting documentation was requested. Based on the documentation provided, or lack thereof, it was determined that reimbursement requests were not prepared using expenditures recorded in the Title I funds. Instead, other undocumented or inconsistently retained records were used, and the amounts in those records did not align with the reimbursement requests submitted or the related fund activity. Of the 13 reimbursement claims submitted:  There were 5 reimbursement requests totaling $854,889 filed in fiscal year 2022-2023 that had no supporting documentation, and the amounts requested did not agree with the disbursement activity recorded in the grant program funds.  There were 8 reimbursement requests totaling $496,155 and received in 2023-2024 that had supporting documentation; however, the documentation agreed with reimbursement request amount in only 4 instances. For the other 4 reimbursement requests where documentation was provided, discrepancies totaling $15,982 were identified between the documentation and the amounts requested. Additionally, the documentation used to support 2023-2024 reimbursement requests did not correspond to the ledger activity recorded in the Title I program funds; instead, the School Corporation relied on separate individual payroll reports that were not tied to the program's financial records. Due to the lack of adequate documentation, we were unable to determine the validity of expenditures claimed for reimbursement, and, therefore, could not determine a population of expenditures to verify for compliance testing. This resulted in questioned costs totaling $1,351,044. Additional issues included:  The former Chief Financial Officer did not direct the payroll clerk to allocate salaries and benefits for Title I personnel to the appropriate funds. As a result, salary and benefit costs were charged to the Title I funds for employees who did not work on the program, while costs for employees who did work on the program were charged to non-Title I funds.  Receipt activity recorded in the Title I program funds did not always reflect actual Title I grant receipts. For example, receipts totaling $63,901 for the Supportive Effective Instruction State Grants program (formerly Improving Teacher Quality State Grants), Assistance Listings Number 84.367, were incorrectly recorded in the Title I fund.  A separate fund was not created for the 2022-2023 grant project year as required by the pass-through entity; instead, an existing project year fund was used.  Transfers totaling $993,763 in 2022-2023 and $73,107 in 2023-2024 were made into the Title I program funds from other funds or between Title I project years without adequate supporting documentation explaining the composition of the transfer amounts.  Transfers totaling $650,150 in 2022-2023 were made out of the Title I program funds to other funds or other Title I project years, without sufficient supporting documentation identifying the nature of the transferred amounts. INDIANA STATE BOARD OF ACCOUNTS 41 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Information and Communication - Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management; Matching, Level of Effort, Earmarking; Reporting; Special Tests and Provisions - Participation of Private School Children; Special Tests and Provisions - Annual Report Card, High School Graduation Rate; Special Tests and Provisions - Assessment Testing The School Corporation had not established adequate communication methods or practices to ensure that reliable information was identified, captured, and communicated to the appropriate internal and external parties. Monitoring - Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management; Matching, Level of Effort, Earmarking; Reporting; Special Tests and Provisions - Participation of Private School Children; Special Tests and Provisions - Annual Report Card, High School Graduation Rate; Special Tests and Provisions - Assessment Testing The School Corporation did not perform ongoing or periodic evaluations to determine whether internal controls were operating effectively or to identify needed improvement. In addition, the School Corporation did not have a process in place to track or to follow-up on corrective actions written in response to audit findings. Due to the number and severity of the issues identified with the program's financial records and supporting documentation, we were unable to perform the procedures necessary to test the program for compliance. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following (see also §§ 200.334, 200.335, 200.336, and 200.337): (1) Identification, in its accounts, of all Federal awards received and expended and the Federal programs under which they were received. . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . . INDIANA STATE BOARD OF ACCOUNTS 42 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (3) Records that identify adequately the source and application of funds for federallyfunded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. (4) Effective control over, and accountability for, all funds, property, and other assets. The non-Federal entity must adequately safeguard all assets and assure that they are used solely for authorized purposes. See § 200.303. . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for the Federal awards that are renewed quarterly or annual, from the date of submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." Cause The School Corporation had not implemented an effective system of internal controls. Changes in key financial personnel, along with insufficient employee training, contributed to processes and procedures not being properly developed or consistently followed. Additionally, employees' salaries and benefits associated with the Title I programs were not mapped to the proper funds in the accounting software. Finally, reimbursement requests were completed based upon documentation, other than the ledger, that was not always retained or when retained did not agree with the amounts requested. Transfers in and out of Title I program funds did not contain sufficient supporting documentation to determine the specific purposes of the transfers Effect Because the five components of internal control were not properly designed or implemented, the School Corporation's internal control system could not be effective. As a result, general and fraud-related risks, as well as risks arising from significant operational changes, could negatively impact the School Corporation. Existing internal control deficiencies may continue undetected, and additional weaknesses may exist without being identified. Additionally, because the School Corporation did not establish an effective system of internal controls to ensure that the required documentation was obtained and retained, we were unable to obtain sufficient appropriate audit evidence to determine whether the School Corporation complied with the applicable federal program compliance requirements. This lack of documentation created a scope limitation for the audit and increased the risk that noncompliance, if present, may not have been detected. The inability to demonstrate compliance with federal requirements may affect the School Corporation's ability to support current program expenditures and may place eligibility for future federal funding at risk. Finally, salary and benefit expenditures were recorded to the Title I grant program funds for employees who were not involved with the program and expenditures for those involved with the program were recorded to non-Title I funds. Reimbursement requests could not be reconciled to the detailed ledger of expenditures. As such, a complete and accurate population of expenditures, that reconciled to the Schedule of Expenditures of Federal Awards or the financial statement could not be determined. INDIANA STATE BOARD OF ACCOUNTS 43 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs Questioned costs in the amount of $1,351,044 were identified as detailed in the Condition and Context. Recommendation We recommended the School Corporation design and implement a system of internal controls, which would include policies and procedures related to the five components of internal control. Management should define clear objectives, identify and assess risks, and develop policies and procedures to address those risks. Regular monitoring should be conducted to ensure internal controls are operating effectively and deficiencies are addressed promptly. We also recommended that the School Corporation ensure employees' salaries and benefits are properly mapped within the accounting system. Additionally, we recommended that all documentation to support a reimbursement request be attached to the reimbursement request and reconciled to the ledger at the time of request. We also recommended that any necessary transfers contain sufficient supporting documentation. Finally, we recommended that the School Corporation maintain complete and accurate records for all grant funds and project years. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-007 Subject: Title I Grants to Local Educational Agencies - Eligibility Federal Agency: Department of Education Federal Program: Title I Grants to Local Educational Agencies Assistance Listings Number: 84.010 Federal Award Numbers and Years (or Other Identifying Numbers): S010A210014, S010A220014, S010A230014 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Eligibility Audit Findings: Material Weakness, Other Matters Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-007. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the entity will achieve its objectives. For federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards to provide reasonable assurance that the entity will comply with applicable federal statutes, regulations, and the terms and conditions of its awards. INDIANA STATE BOARD OF ACCOUNTS 44 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not a single event, but an ongoing process that operates through five integrated components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. Each component must function effectively, and the components must operate together in an integrated manner, for an internal control system to be effective. Deficiencies in the internal control system were identified across the five components and are described below. Control Environment The School Corporation had not established a strong foundation for an effective internal control system. There was no demonstrated emphasis on the importance of internal controls or on compliance with federal program requirements. Risk Assessment The School Corporation had not defined objectives necessary to identify risks or determine risk tolerances. Management did not identify, analyze, or respond to risks that could affect the achievement of objectives, including risks arising from significant changes to operations or the potential for fraud. Control Activities The School Corporation had not established an effective system of internal controls to ensure that proper documentation was retained for audit. Summary data of nonpublic enrollment and poverty status were verbally provided to the School Corporation by the participating nonpublic school. The summary data should have been accompanied by supporting documentation. The School Corporation did not retain any supporting documentation for fiscal year 2022-2023 or 2023-2024 nonpublic school enrollment and poverty data. Information and Communication The School Corporation had not established adequate communication methods or practices to ensure that reliable information was identified, captured, and communicated to the appropriate internal and external parties. Monitoring The School Corporation did not perform ongoing or periodic evaluations to determine whether internal controls were operating effectively or to identify needed improvement. In addition, the School Corporation did not have a process in place to track or to follow-up on corrective actions written in response to audit findings. The lack of internal controls and the failure to retain supporting documentation for nonpublic enrollment and poverty figures were systemic issues throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 45 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for the Federal awards that are renewed quarterly or annual, from the date of submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 34 CFR 200.78(a)(1) states: "After reserving funds, as applicable, under § 200.77, including funds for equitable services for private school students, their teachers, and their families, an LEA must allocate funds under this subpart to school attendance areas and schools, identified as eligible and selected to participate under section 1113(a) or (b) of the ESEA, in rank order on the basis of the total number of public school children from low-income families in each area or school." Cause The School Corporation had not implemented an effective system of internal controls. Changes in key financial personnel, along with insufficient employee training, contributed to processes and procedures not being properly developed or consistently followed. Additionally, management had not established a system of internal controls that would have ensured compliance, or that supporting documentation would have been retained and made available for audit. The Director of Grants relied on verbal nonpublic information from the nonpublic director and assistance and did not implement procedures to verify, collect, or maintain the detailed supporting records for the nonpublic data. Effect Because the five components of internal control were not properly designed or implemented, the School Corporation's internal control system could not be effective. As a result, general and fraud-related risks, as well as risks arising from significant operational changes, could negatively impact the School Corporation. Existing internal control deficiencies may continue undetected, and additional weaknesses may exist without being identified. Additionally, the School Corporation was unable to demonstrate the accuracy and completeness of the nonpublic school enrollment and poverty data used for 2022-2023 and 2023-2024. The absence of supporting documentation limited the ability to verify compliance with program requirements and increased the risk of reporting errors and misallocation of program resources. INDIANA STATE BOARD OF ACCOUNTS 46 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation establish and implement a system of internal controls and provide training on the system of internal controls to its employees. Additionally, we recommended the School Corporation establish and implement an effective system of internal controls to ensure that required supporting documentation for nonpublic school enrollment and poverty status be obtained and retained. Procedures could include requiring participating nonpublic schools to provide detailed student lists and corresponding poverty (socioeconomic) status as part of the data submission. Management should ensure that all documentation provided is securely maintained and readily available for audit and for verification of compliance with program requirements. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-008 Subject: Special Education Cluster (IDEA) Federal Agency: Department of Education Federal Programs: Special Education Grants to States, COVID-19 - Special Education Grants to States, Special Education Preschool Grants, COVID-19 - Special Education Preschool Grants Assistance Listings Numbers: 84.027, 84.027X, 84.173, 84.173X Federal Award Numbers and Years (or Other Identifying Numbers): 22611-138-PN01, 23611-138-PN01, 24611-138-PN01, 22611-138-ARP, 22619-138-PN01, 23619-138-PN01, 24619-138-PN01, 22619-138-ARP Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management; Matching, Level of Effort, Earmarking; Period of Performance; Reporting Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding numbers were 2022-010, 2022-011, and 2022-012. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the entity will achieve its objectives. For federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards to provide reasonable assurance that the entity will comply with applicable federal statutes, regulations, and the terms and conditions of its awards. INDIANA STATE BOARD OF ACCOUNTS 47 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Internal control is not a single event but an ongoing process that operates through five integrated components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. Each component must function effectively, and the components must operate together in an integrated manner, for an internal control system to be effective. Deficiencies in the internal control system were identified across the five components and are described below. Control Environment The School Corporation had not established a strong foundation for an effective internal control system. There was no demonstrated emphasis on the importance of internal controls or on compliance with federal program requirements. Risk Assessment The School Corporation had not defined objectives necessary to identify risks or determine risk tolerances. Management did not identify, analyze, or respond to risks that could affect the achievement of objectives, including risks arising from significant changes to operations or the potential for fraud. Control Activities The School Corporation receives federal funding through the Special Education Cluster (IDEA), including the Special Education Grants to States and Special Education Preschool Grants programs, administered by the Indiana Department of Education. These funds are subject to federal requirements regarding activities allowed or unallowed; allowable costs/cost principles; cash management; matching, level of effort, earmarking; period of performance; reporting; and financial documentation. The School Corporation did not maintain sufficient financial records for its special education programs. Although separate funds were established expenditures were not accurately recorded, preventing the auditors from properly testing compliance with the federal requirements for the Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management; Matching, Level of Effort, Earmarking; Period of Performance; and Reporting compliance requirements. Notable errors included payroll and fund mapping errors, as well as unsupported reimbursement requests. Salaries and benefits for special education staff were incorrectly mapped, resulting in expenditures being charged to the wrong funds. Additionally, program reimbursement requests were not based upon ledger expenditures and relied on documentation that was either missing or inconsistent with the amounts claimed. Due to insufficient documentation, most expenditures claimed for reimbursement could not be verified, resulting in questioned costs totaling $1,694,906. Of the 23 claims for reimbursement filed:  There were 11 reimbursements totaling $1,289,892 that lacked supporting documentation and the amount claimed did not agree with the ledger disbursement activity.  There were 11 reimbursements totaling $404,904 that either agreed with the grant fund ledger activity or documentation was retained to support the amount claimed for reimbursement. INDIANA STATE BOARD OF ACCOUNTS 48 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued)  There was 1 reimbursement totaling $110 that differed from the amount claimed by $1,837, with the amount claimed being less than the supporting documentation. Additional issues included:  Receipt activity within the funds was not always reflective of the program grant money received. Special education program receipts totaling $47,913 were receipted to nonspecial education grant funds.  A separate fund was not created to identify and record financial activity for each grant project year as required by the pass-through entity. Specifically, separate funds were not created for the Special Education Preschool grant for project years 2022 and 2023.  Transfers between funds were made to address deficit fund balances, either due to financial activity being misallocated or errors discovered in transaction recording. However, supporting documentation for these corrections was not kept. In fiscal year 2022-2023, a total of $222,602 was moved into program funds from other sources or between various special education grant project year funds, while $6,653 was transferred in during 2023-2024. Conversely, funds totaling $699,655 in 2022-2023 and $722,283 in 2023-2024 were transferred out of program grant funds to other accounts or between special education grant project year funds. Information and Communication The School Corporation had not established adequate communication methods or practices to ensure that reliable information was identified, captured, and communicated to the appropriate internal and external parties. Monitoring The School Corporation did not perform ongoing or periodic evaluations to determine whether internal controls were operating effectively or to identify needed improvement. In addition, the School Corporation did not have a process in place to track or to follow-up on corrective actions written in response to audit findings. Due to the number and severity of the issues identified with the program's financial records and supporting documentation, we were unable to perform the procedures necessary to test the program for compliance. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." INDIANA STATE BOARD OF ACCOUNTS 49 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following (see also §§ 200.334, 200.335, 200.336, and 200.337): (1) Identification, in its accounts, of all Federal awards received and expended and the Federal programs under which they were received. . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . . (3) Records that identify adequately the source and application of funds for federallyfunded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. (4) Effective control over, and accountability for, all funds, property, and other assets. The non-Federal entity must adequately safeguard all assets and assure that they are used solely for authorized purposes. See § 200.303. . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for the Federal awards that are renewed quarterly or annual, from the date of submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." Cause The School Corporation had not implemented an effective system of internal controls. Changes in key financial personnel, along with insufficient employee training, contributed to processes and procedures not being properly developed or consistently followed. Additionally, employees' salaries and benefits associated with the special education programs were not mapped to the proper funds in the accounting software. Finally, reimbursement requests were completed based on documentation, other than the ledger, that was not always retained or when retained did not agree with the amounts being requested. Effect Because the five components of internal control were not properly designed or implemented, the School Corporation's internal control system could not be effective. As a result, general and fraud-related risks, as well as risks arising from significant operational changes, could negatively impact the School Corporation. Existing internal control deficiencies may continue undetected, and additional weaknesses may exist without being identified. INDIANA STATE BOARD OF ACCOUNTS 50 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Additionally, because the School Corporation did not establish an effective system of internal controls to ensure that the required documentation was obtained and retained, we were unable to obtain sufficient appropriate audit evidence to determine whether the School Corporation complied with the applicable federal program compliance requirements. This lack of documentation created a scope limitation for the audit and increased the risk that noncompliance, if present, may not have been detected. The inability to demonstrate compliance with federal requirements may affect the School Corporation's ability to support current program expenditures and may place eligibility for future federal funding at risk. Finally, salary and benefit expenditures were recorded to the special education grant program funds for employees who were not involved with the program and expenditures for those involved with the program were recorded to nonspecial education funds. Reimbursement requests could not be reconciled to the detailed ledger of expenditures. As such, a complete and accurate population of expenditures, that reconciled to the Schedule of Expenditures of Federal Awards or the financial statement could not be determined. Questioned Costs Questioned costs in the amount of $1,694,906 were identified as detailed in the Condition and Context. Recommendation We recommended the School Corporation design and implement a system of internal controls, which would include policies and procedures related to the five components of internal control. Management should define clear objectives, identify and assess risks, and develop policies and procedures to address those risks. Regular monitoring should be conducted to ensure internal controls are operating effectively and deficiencies are addressed promptly. We also recommended that the School Corporation ensure employees' salaries and benefits are properly mapped within the accounting system. Additionally, we recommended that all documentation to support a reimbursement request be attached to the reimbursement request and reconciled to the ledger at the time of request. We also recommended that any necessary transfers contain sufficient supporting documentation. Finally, we recommended that the School Corporation maintain complete and accurate records for all grant funds and project years. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-009 Subject: COVID-19 - Education Stabilization Fund Federal Agency: Department of Education Federal Programs: COVID-19 - Education Stabilization Fund Assistance Listings Numbers: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management; Equipment and Real Property Management; Matching, Level of Effort, Earmarking; Reporting; Special Tests and Provisions - Wage Rate Requirements; Special Tests and Provisions - Participation of Private School Children Audit Findings: Material Weakness, Modified Opinion Repeat Finding This is a repeat finding from the immediately prior audit report for activities allowed or unallowed, allowable costs/cost principles, cash management, equipment and real property management, and reporting. The prior audit finding numbers were 2022-013, 2022-014, 2022-015, and 2022-016. Condition and Context Internal control is generally defined as a process affected by an entity's oversight body, management, and other personnel that provides reasonable assurance that the entity will achieve its objectives. For federal awards, nonfederal entities, such as the School Corporation, are required to establish and maintain internal control over federal awards to provide reasonable assurance that the entity will comply with applicable federal statutes, regulations, and the terms and conditions of its awards. Internal control is not a single event but an ongoing process that operates through five integrated components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring. Each component must function effectively, and the components must operate together in an integrated manner, for an internal control system to be effective. Deficiencies in the internal control system were identified across the five components and are described below. Control Environment The School Corporation had not established a strong foundation for an effective internal control system. There was no demonstrated emphasis on the importance of internal controls or on compliance with federal program requirements. Risk Assessment The School Corporation had not defined objectives necessary to identify risks or determine risk tolerances. Management did not identify, analyze, or respond to risks that could affect the achievement of objectives, including risks arising from significant changes to operations or the potential for fraud. INDIANA STATE BOARD OF ACCOUNTS 52 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Control Activities The School Corporation did not maintain sufficient financial records for its COVID-19 - Education Stabilization Fund program. Although separate funds were established, expenditures were not accurately recorded, preventing the auditors from properly testing compliance with the federal requirements for Activities Allowed or Unallowed; Allowable Costs/Cost Principles; Cash Management; Equipment and Real Property Management; Matching, Level of Effort, Earmarking; Reporting; Special Tests and Provisions - Wage Rate Requirements; and Special Tests and Provision - Participation of Private School Children compliance requirements. Notable errors included expenditures recorded to the grant funds in the amount of $1,623,704 more than the grant amount awarded, as well as unsupported reimbursement requests. The School Corporation attempted to identify expenditures that they no longer wanted to be considered costs under the grant program to correct the overspending. However, instead of reclassifying the expenditures to the proper funds, monies were transferred into the grant funds from other School Corporation funds. The documentation to support the expenditures to be reallocated was not complete as $296,202 of the transfer amount could not be associated with specific expenditure transactions. Additionally, $839,096 in transactions identified to be reclassified were associated with the prior fiscal year 2021-2022 financial activity. After considering transactions recorded in the fund during 2022-2023 and 2023-2024 that were reallocated to other funds the remaining expenditures in the grant program funds were $138,134 less than the total grant funds claimed for reimbursement during the audit period. Due to insufficient documentation, expenditures claimed for reimbursement could not be verified, resulting in questioned costs totaling $1,654,481. Information and Communication The School Corporation had not established adequate communication methods or practices to ensure that reliable information was identified, captured, and communicated to the appropriate internal and external parties. Monitoring The School Corporation did not perform ongoing or periodic evaluations to determine whether internal controls were operating effectively or to identify needed improvement. In addition, the School Corporation did not have a process in place to track or to follow-up on corrective actions written in response to audit findings. Due to the number and severity of the issues identified with the program's financial records and supporting documentation, we were unable to perform the procedures necessary to test the program for compliance. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 53 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following (see also §§ 200.334, 200.335, 200.336, and 200.337): (1) Identification, in its accounts, of all Federal awards received and expended and the Federal programs under which they were received. . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . . (3) Records that identify adequately the source and application of funds for federallyfunded activities. These records must contain information pertaining to Federal awards, authorizations, financial obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. (4) Effective control over, and accountability for, all funds, property, and other assets. The non-Federal entity must adequately safeguard all assets and assure that they are used solely for authorized purposes. See § 200.303. . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for the Federal awards that are renewed quarterly or annual, from the date of submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." Cause The School Corporation had not implemented an effective system of internal controls. Changes in key financial personnel, along with insufficient employee training, contributed to processes and procedures not being properly developed or consistently followed. Additionally, expenditures were not properly reviewed to determine if costs were properly recorded to grant funds. Finally, reimbursement requests were completed based on documentation, other than the ledger, that was not always retained or when retained did not agree with the amounts being requested. INDIANA STATE BOARD OF ACCOUNTS 54 SCOTT COUNTY SCHOOL DISTRICT 2 SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Because the five components of internal control were not properly designed or implemented, the School Corporation's internal control system could not be effective. As a result, general and fraud-related risks, as well as risks arising from significant operational changes, could negatively impact the School Corporation. Existing internal control deficiencies may continue undetected, and additional weaknesses may exist without being identified. Additionally, because the School Corporation did not establish an effective system of internal controls to ensure that the required documentation was obtained and retained, we were unable to obtain sufficient appropriate audit evidence to determine whether the School Corporation complied with the applicable federal program compliance requirements. This lack of documentation created a scope limitation for the audit and increased the risk that noncompliance, if present, may not have been detected. The inability to demonstrate compliance with federal requirements may affect the School Corporation's ability to support current program expenditures and may place eligibility for future federal funding at risk. Finally, reimbursement requests could not be reconciled to the detailed ledger of expenditures. As such, a complete and accurate population of expenditures, that reconciled to the Schedule of Expenditures of Federal Awards or the financial statement could not be determined. Questioned Costs Questioned costs in the amount of $1,654,481 were identified as detailed in the Condition and Context. Recommendation We recommended the School Corporation design and implement a system of internal controls, which would include policies and procedures related to the five components of internal control. Management should define clear objectives, identify and assess risks, and develop policies and procedures to address those risks. Regular monitoring should be conducted to ensure internal controls are operating effectively and deficiencies are addressed promptly. We also recommended that the School Corporation review expenditures and financial ledger reports to ensure activity is recorded to the correct fund. Additionally, we recommended that all documentation to support a reimbursement request be attached to the reimbursement request and reconciled to the ledger at the time of request. Finally, we recommended that the School Corporation maintain complete and accurate records for all grant funds and project years. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2023-003: Reporting Federal Program: Economic Adjustment Assistance [AL #11.307]. Criteria: Per 2 CFR 200.334, financial records, supports documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Condition: The Bureau was unable to provide documentation that their annual report was submitted to the Kentucky Department of Tourism. As such, the report was unable to be tested. Cause: Controls were not in place to ensure records were maintained in accordance with the Uniform Guidance. Effect: The reporting requirements were unable to be tested. Questioned Costs: None Context: This is not a systemic problem. Repeat Finding: This is not a repeat finding. Recommendation: We recommend the Bureau maintain all records related to Federal awards, including making copies of reports submitted, to ensure compliance with the award. Management Response: The management team received limited guidance on the testing, reporting, and retention requirements of federal funds. In the future, copies of all reports and documentation of timely submission will be maintained by the management team.

#2023-010 – Major Federal Award Finding – Document Retention Nature of Finding: Compliance Finding – Uniform Guidance Administrative Requirements and Material Weakness in Internal Controls Over Compliance This is a repeat of prior year finding #2022-011. Criteria/Condition: Federal regulations 2 CFR 200.334 provides that a non-federal entity must retain all records pertinent to a federal award for a minimum period of three years from the date of submission of the annual financial report. We noted during testing that records were not consistently being maintained. Cause/Context: For 4 of the 40 expenditures selected for testing, the Organization was unable to provide appropriate invoice documentation supporting the amount charged to the grant. Effect: Federal expenditures could be charged to the grant at incorrect amounts or for unallowable costs. Recommendation: We recommend the Organization implement a document retention policy that is consistent with the federal document retention requirements. Views of Responsible Officials and Planned Corrective Actions: MARR will retain a CPA consultant to implement a document retention policy that is consistent with federal document retention requirements.

#2023-010 – Major Federal Award Finding – Document Retention Nature of Finding: Compliance Finding – Uniform Guidance Administrative Requirements and Material Weakness in Internal Controls Over Compliance This is a repeat of prior year finding #2022-011. Criteria/Condition: Federal regulations 2 CFR 200.334 provides that a non-federal entity must retain all records pertinent to a federal award for a minimum period of three years from the date of submission of the annual financial report. We noted during testing that records were not consistently being maintained. Cause/Context: For 4 of the 40 expenditures selected for testing, the Organization was unable to provide appropriate invoice documentation supporting the amount charged to the grant. Effect: Federal expenditures could be charged to the grant at incorrect amounts or for unallowable costs. Recommendation: We recommend the Organization implement a document retention policy that is consistent with the federal document retention requirements. Views of Responsible Officials and Planned Corrective Actions: MARR will retain a CPA consultant to implement a document retention policy that is consistent with federal document retention requirements.

FINDING 2023-006 Subject: COVID-19 - Community Development Block Grants/State's program and Non-Entitlement Grants in Hawaii- Reporting Federal Agency: Department of Housing and Urban Development Federal Programs: COVID-19 - Community Development Block Grants/State's program and Non-Entitlement Grants in Hawaii Assistance Listings Number: 14.228 Federal Award Number and Year (or Other Identifying Number): CV-CV1-233 Pass-Through Entity: Indiana Office of Community and Rural Affairs Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion INDIANA STATE BOARD OF ACCOUNTS 25 JEFFERSON COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Condition and Context An effective internal control system was not in place at the County in order to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The passthrough agency required the County to submit a CDBG-CV report on Jobs Retained. The County collected the required information via phone calls made by one individual who compiled the information and submitted the required CDBG-CV report on Jobs Retained for the grant program without a documented oversight or review process. Furthermore, supporting documentation for the report was not retained for audit. Due to the lack of supporting documentation, we were unable to determine the accuracy of the report submitted. The lack of internal controls and the failure to maintain adequate supporting documentation was isolated to the CDBG-CV Report on Jobs Retained report. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." Cause Management had not established a system of internal controls that would have ensured that adequate supporting documentation would have been maintained and made available for audit. Effect Without the proper implementation of an effectively designed system of internal controls, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As such, we could not determine the County's compliance with the CDBG-CV Report on Jobs Retained report. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the County. INDIANA STATE BOARD OF ACCOUNTS 26 JEFFERSON COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County strengthen its system of internal controls to provide for a segregation of duties in the preparation and review of federal reports to ensure appropriate reviews, approvals, and oversight are taking place. We also recommended strengthening its policies and procedures to ensure appropriate supporting documentation is retained to be presented for audit. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2023-003: Reporting Federal Program: Economic Adjustment Assistance [AL #11.307]. Criteria: Per 2 CFR 200.334, financial records, supports documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Condition: The Bureau was unable to provide documentation that their annual report was submitted to the Kentucky Department of Tourism. As such, the report was unable to be tested. Cause: Controls were not in place to ensure records were maintained in accordance with the Uniform Guidance. Effect: The reporting requirements were unable to be tested. Questioned Costs: None Context: This is not a systemic problem. Repeat Finding: This is not a repeat finding. Recommendation: We recommend the Bureau maintain all records related to Federal awards, including making copies of reports submitted, to ensure compliance with the award. Management Response: The management team received limited guidance on the testing, reporting, and retention requirements of federal funds. In the future, copies of all reports and documentation of timely submission will be maintained by the management team.

#2023-010 – Major Federal Award Finding – Document Retention Nature of Finding: Compliance Finding – Uniform Guidance Administrative Requirements and Material Weakness in Internal Controls Over Compliance This is a repeat of prior year finding #2022-011. Criteria/Condition: Federal regulations 2 CFR 200.334 provides that a non-federal entity must retain all records pertinent to a federal award for a minimum period of three years from the date of submission of the annual financial report. We noted during testing that records were not consistently being maintained. Cause/Context: For 4 of the 40 expenditures selected for testing, the Organization was unable to provide appropriate invoice documentation supporting the amount charged to the grant. Effect: Federal expenditures could be charged to the grant at incorrect amounts or for unallowable costs. Recommendation: We recommend the Organization implement a document retention policy that is consistent with the federal document retention requirements. Views of Responsible Officials and Planned Corrective Actions: MARR will retain a CPA consultant to implement a document retention policy that is consistent with federal document retention requirements.

#2023-010 – Major Federal Award Finding – Document Retention Nature of Finding: Compliance Finding – Uniform Guidance Administrative Requirements and Material Weakness in Internal Controls Over Compliance This is a repeat of prior year finding #2022-011. Criteria/Condition: Federal regulations 2 CFR 200.334 provides that a non-federal entity must retain all records pertinent to a federal award for a minimum period of three years from the date of submission of the annual financial report. We noted during testing that records were not consistently being maintained. Cause/Context: For 4 of the 40 expenditures selected for testing, the Organization was unable to provide appropriate invoice documentation supporting the amount charged to the grant. Effect: Federal expenditures could be charged to the grant at incorrect amounts or for unallowable costs. Recommendation: We recommend the Organization implement a document retention policy that is consistent with the federal document retention requirements. Views of Responsible Officials and Planned Corrective Actions: MARR will retain a CPA consultant to implement a document retention policy that is consistent with federal document retention requirements.

FINDING 2023-006 Subject: COVID-19 - Community Development Block Grants/State's program and Non-Entitlement Grants in Hawaii- Reporting Federal Agency: Department of Housing and Urban Development Federal Programs: COVID-19 - Community Development Block Grants/State's program and Non-Entitlement Grants in Hawaii Assistance Listings Number: 14.228 Federal Award Number and Year (or Other Identifying Number): CV-CV1-233 Pass-Through Entity: Indiana Office of Community and Rural Affairs Compliance Requirement: Reporting Audit Findings: Material Weakness, Modified Opinion INDIANA STATE BOARD OF ACCOUNTS 25 JEFFERSON COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Condition and Context An effective internal control system was not in place at the County in order to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The passthrough agency required the County to submit a CDBG-CV report on Jobs Retained. The County collected the required information via phone calls made by one individual who compiled the information and submitted the required CDBG-CV report on Jobs Retained for the grant program without a documented oversight or review process. Furthermore, supporting documentation for the report was not retained for audit. Due to the lack of supporting documentation, we were unable to determine the accuracy of the report submitted. The lack of internal controls and the failure to maintain adequate supporting documentation was isolated to the CDBG-CV Report on Jobs Retained report. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." Cause Management had not established a system of internal controls that would have ensured that adequate supporting documentation would have been maintained and made available for audit. Effect Without the proper implementation of an effectively designed system of internal controls, including policies and procedures that provide segregation of duties and additional oversight as needed, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As such, we could not determine the County's compliance with the CDBG-CV Report on Jobs Retained report. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the County. INDIANA STATE BOARD OF ACCOUNTS 26 JEFFERSON COUNTY SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that management of the County strengthen its system of internal controls to provide for a segregation of duties in the preparation and review of federal reports to ensure appropriate reviews, approvals, and oversight are taking place. We also recommended strengthening its policies and procedures to ensure appropriate supporting documentation is retained to be presented for audit. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2023-005: Significant Deficiency – Documentation Retention Federal grantor: Department of Commerce Condition: The Chamber was unable to provide supporting documentation for one expense sample. Criteria: According to 2 CFR § 200.334, recipients of federal awards must retain financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a federal award for a period of three years from the date of submission of the final expenditure report. Cause: The lack of documentation appears to result from inadequate procedures or oversight in retaining and securely storing required financial records related to the federal program. Effect: Failure to retain supporting documentation compromises the Chamber's ability to demonstrate allowability of costs, may result in questioned costs, and exposes the Chamber to risk in audits or federal monitoring reviews. Recommendation: We recommend the Chamber enhance its record retention policies and internal controls to ensure that all documentation supporting federal program expenditures is retained in compliance with 2 CFR § 200.334. Staff responsible for federal grants should receive training on documentation and retention requirements. Views of Responsible Officials and Planned Corrective Actions: The Chamber agrees with the findings and will improve its record retention practices to ensure all supporting documentation is properly maintained in compliance with federal requirements.

Criteria: The Company should establish and maintain effective internal control over federal awards to provide reasonable assurance that the award is managed in compliance with federal statutes, regulations, and the terms and conditions of the award. Adequate documentation must be maintained to support internal control activities and compliance with federal requirements. Statement of Condition: During our walkthroughs and substantive testing, supporting documentation was not available to allow us to evaluate whether required internal controls were performed. The documents were unavailable due to the expiration of the entity’s document retention period and employee turnover, which resulted in the loss of institutional knowledge about the controls performed during the award period. Because the requested documentation could not be provided, we were unable to verify the performance or effectiveness of internal controls related to the compliance requirement tested. Cause of Condition: The entity did not maintain documentation of internal control activities beyond the minimum required retention period and did not have processes in place to preserve institutional knowledge during employee turnover. As a result, supporting records necessary for testing internal controls over federal awards were no longer available. Effect of Condition: Due to the absence of supporting documentation, we were unable to determine whether internal controls over the compliance requirement were properly designed and operating effectively. This results in the inability to test internal controls and assess control risk at a “low” level. Recommendation: We recommend that management (1) strengthen record retention practices to ensure that documentation of internal control activities is preserved in accordance with 2 CFR 200.334 and is available for future audits, (2) implement procedures to maintain institutional knowledge, particularly during periods of employee turnover (e.g., documented policies, cross-training, centralized recordkeeping), and (3) consider extending retention periods for documents supporting high-risk federal programs or key internal control activities. Management should ensure documentation is sufficient to demonstrate compliance and support internal control operations. Identification of Repeat Finding: This finding is a repeat of the finding noted in the audit for December 31, 2022 as finding 2022-003. Views of Responsible Officials: Management understands and accepts the recommendation as outlined in the Corrective Action Plan.

Criteria: 1. In accordance with 2 CFR § 200.319(a), all procurement transactions under a Federal award must be conducted in a manner that provides full and open competition. Further, 2 CFR § 200.320(a)(1)(i) requires that, to the extent practicable, micro‑purchases be distributed equitably among qualified suppliers. 2. 2 CFR § 200.214 subjects non‑Federal entities to the non-procurement suspension and debarment regulations in 2 CFR part 180, which restrict awards, subawards, and contracts with parties that are debarred, suspended, or otherwise excluded from Federal awards. Under 2 CFR § 180.300, before entering into a covered transaction with another person or entity at the next lower tier, the non Federal entity must verify that the party is not excluded or disqualified. This verification may be completed by reviewing the SAM.gov Exclusions, obtaining a certification from the entity, or including an appropriate suspension and debarment clause or condition in the contract or agreement. Further, in accordance with 2 CFR § 200.318(i), non‑federal entities must maintain records sufficient to document the history of procurement transactions; and 2 CFR § 200.334 requires retention of all supporting documentation for Federal awards. Together, these regulations require that documentation of the suspension and debarment verification be retained to demonstrate compliance with Federal procurement and suspension and debarment requirements. Condition: 1. The Republic’s procurement regulation § 625(c)(3) permits small purchases under $2,500 after obtaining one written price quotation. However, the policy does not demonstrate full and open competition to ensure that to the extent practicable, small purchases are distributed equitably among qualified suppliers. Of the 131 procurement transactions, 54 were identified as within the threshold established under § 625(c)(3)No. No. of Transactions General Ledger Account Name Amount 1 20 General Supplies $ 16,123 2 18 Fuel & Other Pol Products 9,220 3 7 Advertising 5,480 4 4 All Other Rentals 3,467 5 3 Boat Rentals 4,900 6 1 Medical Supplies 364 7 1 Vehicle Cycle Etc Rentl 540 Total: 54 $ 40,094 2. The Republic represents that vendors are verified in SAM.gov before entering into covered transactions; however, no documentation was retained to demonstrate that the required verification occurred. Documentation such as screenshots, printouts, approval records, or other system‑based evidence showing that the SAM.gov check was performed, was not available in the procurement or vendor files. Of the 57 purchase orders issued during the year ended September 30, 2023, 4 were identified as covered transactions subject to federal suspension and debarment requirements, totaling $1,978,024. No. Purchase Order # Vendor Amount 1 22301491 PATIENT FOCUS ARFICA (PTY) TD. $ 48,349 2 22303764 ARC CONSULTANCY 131,924 3 22305075 GOPHER SPORT 95,036 4 PC2 ROJECT BELAU SUBMARINE CABLE CORPORATION 1,702,715 Total: $ 1,978,024 Auditor verification of the above vendors in SAM.gov did not identify any as suspended or debarred. However, the absence of documentation prevents the Republic from demonstrating compliance with Federal suspension and debarment requirements. Cause: The Republic’s procurement policy does not ensure full and open competition for small purchases due to lack of required procedures to equitably distribute small purchases among qualified suppliers. Additionally, the Republic’s procurement procedures do not require the retention of documentation evidencing that suspension and debarment checks were performed. Effect: The Republic is not in compliance with Federal procurement, suspension and debarment requirements. Without federally compliant procedures and supporting documentation, the extent of questioned costs cannot be determined, resulting in an undeterminable question cost. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Republic update its procurement policies and procedures to include specific guidance to ensure full and open competition to equitably distribute small purchases among available qualified suppliers. Management should ensure that documentation supporting the basis for supplier selection is consistently maintained in procurement files. Additionally, we recommend that the Republic strengthen its procurement and vendor‑approval procedures to require retention of evidence demonstrating that suspension and debarment verification was performed for each covered transaction. Acceptable documentation may include date‑stamped screenshots of the SAM.gov search, system‑generated verification logs, or signed certifications. Documentation should be consistently retained in the procurement or vendor file to support compliance with Federal requirements. Views of Responsible Officials: The Republic’s Corrective Action Plan does not indicate disagreement and provides planned corrective action.

Criteria: 1. In accordance with 2 CFR § 200.319(a), all procurement transactions under a Federal award must be conducted in a manner that provides full and open competition. Further, 2 CFR § 200.320(a)(1)(i) requires that, to the extent practicable, micro‑purchases be distributed equitably among qualified suppliers. 2. 2 CFR § 200.214 subjects non‑Federal entities to the non-procurement suspension and debarment regulations in 2 CFR part 180, which restrict awards, subawards, and contracts with parties that are debarred, suspended, or otherwise excluded from Federal awards. Under 2 CFR § 180.300, before entering into a covered transaction with another person or entity at the next lower tier, the non Federal entity must verify that the party is not excluded or disqualified. This verification may be completed by reviewing the SAM.gov Exclusions, obtaining a certification from the entity, or including an appropriate suspension and debarment clause or condition in the contract or agreement. Further, in accordance with 2 CFR § 200.318(i), non‑federal entities must maintain records sufficient to document the history of procurement transactions, and 2 CFR § 200.334 requires retention of all supporting documentation for Federal awards. Together, these regulations require that documentation of the suspension and debarment verification be retained to demonstrate compliance with Federal procurement and suspension and debarment requirements. Condition: 1. The Republic’s procurement regulation § 625(c)(3) permits purchases under $2,500 after obtaining one written price quotation. However, the policy does not demonstrate full and open competition to ensure that to the extent practicable, small purchases are distributed equitably among qualified suppliers. Of the 143 procurement transactions, 46 were identified as within the threshold established under § 625(c)(3). No. No. of transactions GL Account Name Amount 1 19 Machinery & Equip Repair $ 6,103 2 24 General Supplies 17,106 3 1 Professional 425 4 1 Advertising 500 5 1 Conference 504 Total: 46 $ 24,638 2. The Republic represents that vendors are verified in SAM.gov before entering into covered transactions; however, no documentation was retained to demonstrate that the required verification occurred. Documentation such as screenshots, printouts, approval records, or other system‑based evidence showing that the SAM.gov check was performed was not available in the procurement or vendor files. Of the 38 purchase orders issued during the year ended September 30, 2023, 2 were identified as covered transactions subject to federal suspension and debarment requirements, totaling $92,149. No. Purchase Order # Vendor Amount 1 22305991 EDHANNAH EDUCATION CONSULTING SERVICES $ 21,000 2 22300871 GUAM CEDDERS 71,149 Total: $ 92,149 Auditor verification of the above vendors in SAM.gov did not identify any as suspended or debarred. However, the absence of documentation prevents the Republic from demonstrating compliance with Federal suspension and debarment requirements. Cause: The Republic’s procurement policy does not ensure full and open competition for small purchases due to lack of required procedures to equitably distribute micro‑purchases among qualified suppliers. Additionally, the Republic’s procurement procedures do not require the retention of documentation evidencing that suspension and debarment checks were performed. Effect: The Republic is not in compliance with Federal procurement, suspension and debarment requirements. Without federally compliant procedures and supporting documentation, the extent of questioned costs cannot be determined, resulting in an undeterminable question cost. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Republic update its procurement policies and procedures to include specific guidance to ensure full and open competition to equitably distribute small purchases among available qualified suppliers. Management should ensure that documentation supporting the basis for supplier selection is consistently maintained in procurement files. Additionally, we recommend that the Republic strengthen its procurement and vendor‑approval procedures to require retention of evidence demonstrating that suspension and debarment verification was performed for each covered transaction. Acceptable documentation may include date‑stamped screenshots of the SAM.gov search, system‑generated verification logs, or signed certifications. Documentation should be consistently retained in the procurement or vendor file to support compliance with Federal requirements. Views of Responsible Officials: The Republic’s Corrective Action Plan does not indicate disagreement and provides planned corrective action.

Criteria: 1. In accordance with 2 CFR § 200.319(a), all procurement transactions under a Federal award must be conducted in a manner that provides full and open competition. Further, 2 CFR § 200.320(a)(1)(i) requires that, to the extent practicable, micro‑purchases be distributed equitably among qualified suppliers. 2. 2 CFR § 200.214 subjects non‑Federal entities to the non-procurement suspension and debarment regulations in 2 CFR part 180, which restrict awards, subawards, and contracts with parties that are debarred, suspended, or otherwise excluded from Federal awards. Under 2 CFR § 180.300, before entering into a covered transaction with another person or entity at the next lower tier, the non Federal entity must verify that the party is not excluded or disqualified. This verification may be completed by reviewing the SAM.gov Exclusions, obtaining a certification from the entity, or including an appropriate suspension and debarment clause or condition in the contract or agreement. Further, in accordance with 2 CFR § 200.318(i), non‑federal entities must maintain records sufficient to document the history of procurement transactions, and 2 CFR § 200.334 requires retention of all supporting documentation for Federal awards. Together, these regulations require that documentation of the suspension and debarment verification be retained to demonstrate compliance with Federal procurement and suspension and debarment requirements. Condition: 1. The Republic’s procurement regulation § 625(c)(3) permits purchases under $2,500 after obtaining one written price quotation. However, the policy does not demonstrate full and open competition to ensure that small purchases are distributed equitably among qualified suppliers. Of the 583 procurement transactions, 140 were identified as within the threshold established under § 625(c)(3). No. No. of Transactions General Ledger Account Name Amount 1 7 Boat Rentals $ 9,400 2 64 General Supplies 60,349 3 7 Advertising 1,045 4 6 Conference 11,800 5 1 All Other Purchased Serv 1,999 6 39 Vehicle Cycle Repair 7,987 7 12 Building/Space Rentals 5,830 8 4 Machinery & Equip Repair 837 Total: 140 $ 99,247 2. The Republic represents that vendors are verified in SAM.gov before entering into covered transactions; however, no documentation was retained to demonstrate that the required verification occurred. Documentation such as screenshots, printouts, approval records, or other system‑based evidence showing that the SAM.gov check was performed was not available in the procurement or vendor files. Of the 185 purchase orders issued during the year ended September 30, 2023, 19 were identified as covered transactions subject to federal suspension and debarment requirements, totaling $2,101,228, of which 12 totaling $1,919,175 were selected for testing. No. Purchase Order # Vendor Amount 1 22300843 MEDPHARM $ 93,032 2 22301907 PACIFIC SOURCE INC. LTD. 490,573 3 22301908 PACIFIC SOURCE INC. LTD. 512,382 4 22301909 PACIFIC SOURCE INC. LTD. 463,320 5 22302788 MEDPHARM 111,550 6 22300845 MD WHOLESALE 55,160 7 22301465 MD WHOLESALE 11,952 8 22302557 MD WHOLESALE 29,607 9 22302790 MEDPHARM 80,946 10 22303546 G&N CLEANING EXPRESS 16,560 11 22306254 ARC HEALTH 37,125 12 22307066 MD WHOLESALE 16,968 Total: $ 1,919,175 Auditor verification of the above vendors in SAM.gov did not identify any as suspended or debarred. However, the absence of documentation prevents the Republic from demonstrating compliance with Federal suspension and debarment requirements. Cause: The Republic’s procurement policy does not ensure full and open competition for small purchases and does not include procedures to equitably distribute micro‑purchases among qualified suppliers. Additionally, the Republic’s procurement and vendor compliance procedures do not require the retention of documentation evidencing that suspension and debarment checks were performed. Effect: The Republic is not in compliance with Federal procurement, suspension and debarment requirements. Without federally compliant procedures and supporting documentation, the extent of questioned costs cannot be determined, resulting in an undeterminable question cost. Identification as a Repeat Finding: Finding 2022-009 Recommendation: We recommend that the Republic update its procurement policies and procedures to include specific guidance to ensure full and open competition and to equitably distribute micro‑purchases among qualified suppliers. Management should ensure that documentation supporting the basis for supplier selection is consistently maintained in procurement files. Additionally, we recommend that the Republic strengthen its procurement and vendor‑approval procedures to require retention of evidence demonstrating that suspension and debarment verification was performed for each covered transaction. Acceptable documentation may include date‑stamped screenshots of the SAM.gov search, system‑generated verification logs, or signed certifications. Documentation should be consistently retained in the procurement or vendor file to support compliance with Federal requirements. Views of Responsible Officials: The Republic’s Corrective Action Plan does not indicate disagreement and provides planned corrective action.

Criteria: 1. In accordance with 2 CFR § 200.319(a), all procurement transactions under a Federal award must be conducted in a manner that provides full and open competition. Further, 2 CFR § 200.320(a)(1)(i) requires that, to the extent practicable, micro‑purchases be distributed equitably among qualified suppliers. 2. 2 CFR § 200.214 subjects non‑Federal entities to the non-procurement suspension and debarment regulations in 2 CFR part 180, which restrict awards, subawards, and contracts with parties that are debarred, suspended, or otherwise excluded from Federal awards. Under 2 CFR § 180.300, before entering into a covered transaction with another person or entity at the next lower tier, the non Federal entity must verify that the party is not excluded or disqualified. This verification may be completed by reviewing the SAM.gov Exclusions, obtaining a certification from the entity, or including an appropriate suspension and debarment clause or condition in the contract or agreement. Further, in accordance with 2 CFR § 200.318(i), non‑federal entities must maintain records sufficient to document the history of procurement transactions, and 2 CFR § 200.334 requires retention of all supporting documentation for Federal awards. Together, these regulations require that documentation of the suspension and debarment verification be retained to demonstrate compliance with Federal procurement and suspension and debarment requirements. Condition: 1. The Republic’s procurement regulation § 625(c)(3) permits small purchases under $2,500 after obtaining one written price quotation. However, the policy does not demonstrate full and open competition to ensure that micro‑purchases are distributed equitably among qualified suppliers. Of the 224 procurement transactions, 72 were identified as within the threshold established under § 625(c)(3). Condition, continued: No. No. of transactions General Ledger Account Name Amount 1 18 General Supplies $ 19,541 2 1 All Other Rentals 240 3 13 Freight 6,894 4 3 Boat Rentals 3,000 5 3 All Other Purchased Serv 1,635 6 3 Conference 6,463 7 5 Vehicle Cycle Repair 628 8 11 Advertising 4,309 9 1 Dues & Fees 700 10 3 Machinery & Equip Repair 899 11 11 Fuel & Other Pol Products 5,865 Total: 72 $ 50,174 2. The Republic represents that vendors are verified in SAM.gov before entering into covered transactions; however, no documentation was retained to demonstrate that the required verification occurred. Documentation such as screenshots, printouts, approval records, or other system‑based evidence showing that the SAM.gov check was performed was not available in the procurement or vendor files. Of the 70 purchase orders issued during the year ended September 30, 2023, 7 were identified as covered transactions subject to federal suspension and debarment requirements totaling $229,639. No. Purchase Order # Vendor Amount 1 22300343 TLAU T. RIDPATH $ 32,500 2 22301468 MD WHOLESALE 5,371 3 22302270 UNIVERSITY OF HAWAII - OFFICE OF RESEARCH SERVICES 59,738 4 22304018 JMI-EDISON 93,300 5 22304084 SOCIAL SECURITY ADMINISTRATION 7,500 6 22306331 BELAU MEDICAL CLINIC 21,870 7 22307680 DIAGNOSTIC LABORATORY SERVICES, INC 9,360 Total: $ 229,639 Condition, continued: Auditor verification of the above vendors in SAM.gov not identify any as suspended or debarred. However, the absence of documentation prevents the Republic from demonstrating compliance with Federal suspension and debarment requirements. Cause: The Republic’s procurement policy does not ensure full and open competition for small purchases due to lack of procedures to equitably distribute small purchases among qualified suppliers. Additionally, the Republic’s procurement and vendor compliance procedures do not require the retention of documentation evidencing that suspension and debarment checks were performed. Effect: The Republic is not in compliance with Federal procurement, suspension and debarment requirements. Without federally compliant procedures and supporting documentation, the extent of questioned costs cannot be determined, resulting in an undeterminable question cost. Identification as a Repeat Finding: This is not a repeat finding. Recommendation: We recommend that the Republic update its procurement policies and procedures to include specific guidance to ensure full and open competition and to equitably distribute small purchases among available qualified suppliers. Management should ensure that documentation supporting the basis for supplier selection is consistently maintained in procurement files. Additionally, we recommend that the Republic strengthen its procurement and vendor‑approval procedures to require retention of evidence demonstrating that suspension and debarment verification was performed for each covered transaction. Acceptable documentation may include date‑stamped screenshots of the SAM.gov search, system‑generated verification logs, or signed certifications. Documentation should be consistently retained in the procurement or vendor file to support compliance with Federal requirements. Views of Responsible Officials: The Republic’s Corrective Action Plan does not indicate disagreement and provides planned corrective action.

FEDERAL PROGRAM ALL FEDERAL PROGRAMS ON THE SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS AWARD NUMBERS ALL AWARDS COMPLIANCE REQUIREMENT ACTIVITIES ALLOWED OR UNALLOWED TYPE OF FINDING MATERIAL NONCOMPLIANCE AND MATERIAL WEAKNESS CRITERIA Uniform Guidance at 2 CFR 200 §200.302, Financial Management, establishes that: “(a) Each State must expend and account for the Federal award in accordance with State laws and procedures for expending and accounting for the State's funds. All recipient and subrecipient financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by the terms and conditions; and tracking expenditures to establish that funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. (See § 200.450). (b) The recipient's and subrecipient's financial management system must provide for the following (see §§ 200.334, 200.335, 200.336, and 200.337): (1) Identification of all Federal awards received and expended and the Federal programs under which they were received. Federal program and Federal award identification must include, as applicable, the Assistance Listings title and number, Federal award identification number, year the Federal award was issued, and name of the Federal agency or pass-through entity. (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements in §§ 200.328 and 200.329. When a Federal agency or pass-through entity requires reporting on an accrual basis from a recipient or subrecipient that maintains its records other than on an accrual basis, the recipient or subrecipient must not be required to establish an accrual accounting system. This recipient or subrecipient may develop accrual data for its reports based on an analysis of the documentation on hand. (3) Maintaining records that sufficiently identify the amount, source, and expenditure of Federal funds for Federal awards. These records must contain information necessary to identify Federal awards, authorizations, financial obligations, unobligated balances, as well as assets, expenditures, income, and interest. All records must be supported by source documentation. … (6) Written procedures to implement the requirements of § 200.305. (7) Written procedures for determining the allowability of costs in accordance with subpart E and the terms and conditions of the Federal award.” STATEMENT OF CONDITION As part of our understanding of internal controls and compliance testing regarding activities allowed or unallowed, we obtained a procedures manual. We found the following deficiencies: • The Center provided written internal control procedures over federal funds management. We observed that the policy didn’t include any detail of procedures, just a general requirement. In addition, the policy does not identify the personnel responsible for the processes to establish segregation of duties. • We selected a sample of 10 (number of disbursements selected) federal funds disbursed and noted that invoices are not marked as they are paid. • From the sample of federal funds disbursed, no evidence was found of approval or verification of allowability of the disbursement, proper segregation of duties, or accountability. • The Center lacks an adequate process to provide regular training to staff on Generally Accepted Government Auditing Standards, general documentation, acquisitions levels, formal agreements with vendors, vendor selections guidelines and best practices, required documentation regarding grant requirements and other internal best practices. QUESTIONED COSTS No questioned costs identified. PERSPECTIVE INFORMATION This is a systematic deficiency. After conducting personnel interviews, we were able to identify procedures for validating the payments. The person told us that after a need to purchase goods or services is identified by the centers, the entity Administrator requests authorization from the President. The President validates with the external accounting firm that the expense category is included in the approved budget and that funds are available before approving the payment. Procedures and internal controls manuals should provide for and ensure the segregation of duties. STATEMENT OF CAUSE The Center didn't have adequate internal controls in place, or documentation that presented adequate segregation of duties and compliance with applicable laws and regulations. In addition, no internal controls were documented that supported proper accountability of funds. POSSIBLE ASSERTED EFFECT The Center could incur in unallowable costs or activities and not be able to prevent or detect a transaction that doesn't comply with the Federal regulation. IDENTIFICATION OF REPEAT FINDING No reported as prior audit finding. RECOMMENDATIONS We recommend that management establish an adequate internal controls process that identifies documentation, personnel responsible and authorizations. In addition, we recommend management to update established written procedures and internal controls manuals to provide and document the segregation of duties related to the activities allowed or unallowed compliance requirement.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass_x0002_through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. Title 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: 1. The number of eligible individuals who received services paid for in part or in whole with federal funds under the SSBG. 2. The amount of Social Services Block Grant funds spent in providing each service. Condition: During testing of key line items noted above in the FY2022 Annual Post Expenditure Report submitted in March 2023, we noted the following variances between the amounts reported and supporting documentation: Key Line Item 1 Children  Family Planning Services – variance of 1,796  Prevention and Intervention – variance of 9,866  Protective Services – Children – variance of 13,511 Adults Age 59 Years and Younger  Family Planning Services – variance of 107,476  Prevention and Intervention – variance of 19,398  Protective Services – Adults – variance of 21,973  Other Services – variance of 10,733 Adults Age 60 Years and Older  Family Planning Services – variance of 4,549  Prevention and Intervention – variance of 868  Protective Services – Adults – variance of 71,969  Other Services – variance of 14,408 Adults of Unknown Age  Prevention and Intervention – variance of 151 Key Line Item 2 SSBG Allocation  Foster Care Services – Children – variance of ($77,124)  Information & Referral – variance of $2,116  Protective Services – Adults – variance of ($59,467)  Protective Services – Children – variance of ($114,243) Funds Transferred into SSBG  Protective Services – Children – variance of ($6,948,063) Expenditures of All Other Federal, State, and Local Funds  Family Planning Services – variance of $172,504,171  Foster Care Services – Children – variance of $674,230,152  Information & Referral – variance of $35,508,405  Protective Services – Adults – variance of $67,694,139  Protective Services – Children – variance of $1,145,408,512  Other Services – $171,788,478 Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure the completeness and accuracy of the report. Additionally, HHSC did not follow current policies and procedures regarding record retention. More specifically, all variances listed for key line item 1 were due to lack of supporting documentation except for the Protective Services – Children variance of 13,511, which was the difference between amounts reported and supporting documentation provided. All variances for key line item 2 were due to lack of supporting documentation except the four amounts listed under SSBG Allocation, which are a result difference between amounts reported and supporting documentation provided. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend management revise its internal controls to reconcile expenditures reported on federal reports to federal expenditures in the general ledger. Additionally, HHSC should implement or revise policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance. Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual).  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers for CHIP, which resulted in one exception for the following:  A copy of the completed application was not included in the file.  Enrollment of the provider was not completed within the last 5 years.  Verification of the provider’s license was not included in the file.  Required information on ownership and control was not disclosed.  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk.  A copy of the provider agreement was not included in the files.  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk.  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving CHIP funds. Repeat Finding: No Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in CHIP. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance. Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual).  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers for CHIP, which resulted in one exception for the following:  A copy of the completed application was not included in the file.  Enrollment of the provider was not completed within the last 5 years.  Verification of the provider’s license was not included in the file.  Required information on ownership and control was not disclosed.  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk.  A copy of the provider agreement was not included in the files.  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk.  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving CHIP funds. Repeat Finding: No Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in CHIP. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual)  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers each for Medicaid, which resulted in the following (sampled exceptions noted in parentheses):  A copy of the completed application was not included in the file. (9 providers)  Enrollment of the provider was not completed within the last 5 years. (7 providers)  Verification of the provider’s license was not included in the file. (7 providers)  Required information on ownership and control was not disclosed. (11 providers)  Supporting documentation was not included in the file indicating the provider consented to a criminal background check. (9 providers)  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. (13 providers)  A copy of the provider agreement was not included in the files. (13 providers)  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. (13 providers)  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. (9 providers) Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat finding: 2022-014, 2021-008 Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: HHSC concurs with this repeat finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual)  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers each for Medicaid, which resulted in the following (sampled exceptions noted in parentheses):  A copy of the completed application was not included in the file. (9 providers)  Enrollment of the provider was not completed within the last 5 years. (7 providers)  Verification of the provider’s license was not included in the file. (7 providers)  Required information on ownership and control was not disclosed. (11 providers)  Supporting documentation was not included in the file indicating the provider consented to a criminal background check. (9 providers)  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. (13 providers)  A copy of the provider agreement was not included in the files. (13 providers)  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. (13 providers)  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. (9 providers) Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat finding: 2022-014, 2021-008 Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: HHSC concurs with this repeat finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual)  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers each for Medicaid, which resulted in the following (sampled exceptions noted in parentheses):  A copy of the completed application was not included in the file. (9 providers)  Enrollment of the provider was not completed within the last 5 years. (7 providers)  Verification of the provider’s license was not included in the file. (7 providers)  Required information on ownership and control was not disclosed. (11 providers)  Supporting documentation was not included in the file indicating the provider consented to a criminal background check. (9 providers)  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. (13 providers)  A copy of the provider agreement was not included in the files. (13 providers)  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. (13 providers)  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. (9 providers) Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat finding: 2022-014, 2021-008 Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: HHSC concurs with this repeat finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual)  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers each for Medicaid, which resulted in the following (sampled exceptions noted in parentheses):  A copy of the completed application was not included in the file. (9 providers)  Enrollment of the provider was not completed within the last 5 years. (7 providers)  Verification of the provider’s license was not included in the file. (7 providers)  Required information on ownership and control was not disclosed. (11 providers)  Supporting documentation was not included in the file indicating the provider consented to a criminal background check. (9 providers)  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. (13 providers)  A copy of the provider agreement was not included in the files. (13 providers)  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. (13 providers)  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. (9 providers) Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat finding: 2022-014, 2021-008 Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: HHSC concurs with this repeat finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual)  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers each for Medicaid, which resulted in the following (sampled exceptions noted in parentheses):  A copy of the completed application was not included in the file. (9 providers)  Enrollment of the provider was not completed within the last 5 years. (7 providers)  Verification of the provider’s license was not included in the file. (7 providers)  Required information on ownership and control was not disclosed. (11 providers)  Supporting documentation was not included in the file indicating the provider consented to a criminal background check. (9 providers)  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. (13 providers)  A copy of the provider agreement was not included in the files. (13 providers)  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. (13 providers)  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. (9 providers) Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat finding: 2022-014, 2021-008 Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: HHSC concurs with this repeat finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2205TX5ADM, 2205TX5MAP, 2205TXIMPL; 2305TX5ADM, 2305TX5MAP, 2305TXIMPL October 1, 2021 – September 30, 2022, October 1, 2022 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual)  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers each for Medicaid, which resulted in the following (sampled exceptions noted in parentheses):  A copy of the completed application was not included in the file. (9 providers)  Enrollment of the provider was not completed within the last 5 years. (7 providers)  Verification of the provider’s license was not included in the file. (7 providers)  Required information on ownership and control was not disclosed. (11 providers)  Supporting documentation was not included in the file indicating the provider consented to a criminal background check. (9 providers)  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment. (12 providers)  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk. (13 providers)  A copy of the provider agreement was not included in the files. (13 providers)  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk. (13 providers)  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. (9 providers) Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving Medicaid funds. Repeat finding: 2022-014, 2021-008 Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in Medicaid. Views of responsible officials: HHSC concurs with this repeat finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of the Treasury Federal Program Title: Coronavirus State and Local Fiscal Recovery Funds ALN: 21.027 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: SLT – 8809: Project Name: HHSC Section 33; HHSC Section 12: Rural Hospitals, HHSC Section 22: Sunrise Canyon Hospital November 8, 2021 – December 31, 2026 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In the 2021 Texas Senate Bill 8, HHSC was appropriated money in various sections of the bill received by Texas from the Coronavirus State Fiscal Recovery Fund for the following purposes related to costs incurred during the period beginning October 8, 2021, and ending November 8, 2023, due to the coronavirus pandemic:  Section 11(a) – funding for the construction of a state hospital in Dallas, Texas.  Section 12 – funding for grants to support rural hospitals that have been affected by the COVID-19 pandemic.  Section 13 – funding for the creation of a consolidated internet portal for Medicaid and the Children’s Health Insurance Program medical services provider data.  Section 14 – funding for technology updates to the Medicaid eligibility computer system.  Section 15 – funding for COVID-19 related expenses incurred by the Texas Civil Commitment Office related to consumable supplies and travel.  Section 22 – funding for the expansion of capacity of Sunrise Canyon Hospital.  Section 33 – funding to administer one-time grants related to providing critical staffing needs resulting from frontline healthcare workers affected by COVID-19, including recruitment and retention bonuses for staff. Condition: Audit procedures included a selection of 60 sampled expenditures totaling $143,092,786 incurred during the fiscal year to test allowability with the grant awards. We noted that for 48 out of the 60 samples totaling $9,600,062, the agency did not obtain supporting documentation from the vendor to verify that the amounts advanced to the vendor were expended on allowable costs. We were unable to substantiate the amounts expended by the vendor and allowability of those expenditures in accordance with the relevant Senate Bill 8 section and the Department of the Treasury Final Rule. Questioned costs: $9,600,062. Context: See “Condition.” Cause: HHSC is not fully monitoring the use of program funds through collection, review, and maintenance of invoices supporting the expenditures. Effect: Failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat finding: No Recommendation: HHSC should implement policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2301TXSOSR, 2201TXSOSR and 2101TXSOSR October 1, 2022 – September 30, 2024, October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass_x0002_through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. Title 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: 1. The number of eligible individuals who received services paid for in part or in whole with federal funds under the SSBG. 2. The amount of Social Services Block Grant funds spent in providing each service. Condition: During testing of key line items noted above in the FY2022 Annual Post Expenditure Report submitted in March 2023, we noted the following variances between the amounts reported and supporting documentation: Key Line Item 1 Children  Family Planning Services – variance of 1,796  Prevention and Intervention – variance of 9,866  Protective Services – Children – variance of 13,511 Adults Age 59 Years and Younger  Family Planning Services – variance of 107,476  Prevention and Intervention – variance of 19,398  Protective Services – Adults – variance of 21,973  Other Services – variance of 10,733 Adults Age 60 Years and Older  Family Planning Services – variance of 4,549  Prevention and Intervention – variance of 868  Protective Services – Adults – variance of 71,969  Other Services – variance of 14,408 Adults of Unknown Age  Prevention and Intervention – variance of 151 Key Line Item 2 SSBG Allocation  Foster Care Services – Children – variance of ($77,124)  Information & Referral – variance of $2,116  Protective Services – Adults – variance of ($59,467)  Protective Services – Children – variance of ($114,243) Funds Transferred into SSBG  Protective Services – Children – variance of ($6,948,063) Expenditures of All Other Federal, State, and Local Funds  Family Planning Services – variance of $172,504,171  Foster Care Services – Children – variance of $674,230,152  Information & Referral – variance of $35,508,405  Protective Services – Adults – variance of $67,694,139  Protective Services – Children – variance of $1,145,408,512  Other Services – $171,788,478 Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure the completeness and accuracy of the report. Additionally, HHSC did not follow current policies and procedures regarding record retention. More specifically, all variances listed for key line item 1 were due to lack of supporting documentation except for the Protective Services – Children variance of 13,511, which was the difference between amounts reported and supporting documentation provided. All variances for key line item 2 were due to lack of supporting documentation except the four amounts listed under SSBG Allocation, which are a result difference between amounts reported and supporting documentation provided. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. In addition, failure to maintain adequate documentation pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: We recommend management revise its internal controls to reconcile expenditures reported on federal reports to federal expenditures in the general ledger. Additionally, HHSC should implement or revise policies and procedures to ensure documentation is maintained for a period of at least three years from the date of submission of the final expenditure report for the grant in accordance with 2 CFR 200.334. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance. Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual).  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers for CHIP, which resulted in one exception for the following:  A copy of the completed application was not included in the file.  Enrollment of the provider was not completed within the last 5 years.  Verification of the provider’s license was not included in the file.  Required information on ownership and control was not disclosed.  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk.  A copy of the provider agreement was not included in the files.  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk.  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving CHIP funds. Repeat Finding: No Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in CHIP. Views of responsible officials: HHSC concurs with the finding.

Special Tests and Provisions – Provider Eligibility – Lack of Documentation Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Children’s Health Insurance Program ALN: 93.767 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2105TX5021, 2205TX5021, 2305TX3002, 2305TX5021 October 1, 2020 – September 30, 2022, October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance. Criteria or specific requirement: Per 2 CFR 200.303, a non-Federal entity must: Establish and maintain effective internal controls over federal awards that provide reasonable assurance they are managing federal awards in compliance with federal statutes, regulations, and the provisions of contracts or grant agreements that could have a material effect on each of its federal programs. Per 2 CFR 200.334, financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. Federal awarding agencies and pass-through entities must not impose any other record retention requirements upon non-Federal entities. In order to comply with federal provider eligibility requirements, HHSC must adhere to various subsections of 42 CFR Section 455 including but not limited to: § 455.104 – HHSC must require that disclosing entities, fiscal agents, and managed care entities provide the following disclosures:  The name and address of any person (individual or corporation) with an ownership or control interest in the disclosing entity, fiscal agent, or managed care entity. The address for corporate entities must include as applicable primary business address, every business location, and P.O. Box address.  Date of birth and Social Security Number (in the case of an individual).  Other tax identification number (in the case of a corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) or in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest.  Whether the person (individual or corporation) with an ownership or control interest in the disclosing entity (or fiscal agent or managed care entity) is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling; or whether the person (individual or corporation) with an ownership or control interest in any subcontractor in which the disclosing entity (or fiscal agent or managed care entity) has a 5 percent or more interest is related to another person with ownership or control interest in the disclosing entity as a spouse, parent, child, or sibling.  The name of any other disclosing entity (or fiscal agent or managed care entity) in which an owner of the disclosing entity (or fiscal agent or managed care entity) has an ownership or control interest.  The name, address, date of birth, and Social Security Number of any managing employee of the disclosing entity (or fiscal agent or managed care entity). § 455.105 – HHSC must enter into an agreement with each provider under which the provider agrees to furnish to it the following information related to business transactions within 35 days of request:  The ownership of any subcontractor with whom the provider has had business transactions totaling more than $25,000 during the 12-month period ending on the date of the request; and  Any significant business transactions between the provider and any wholly owned supplier, or between the provider and any subcontractor, during the 5-year period ending on the date of the request. § 455.106 – Before HHSC enters into or renews a provider agreement, or at any time upon written request by HHSC, the provider must disclose to HHSC the identity of any person who:  Has ownership or control interest in the provider, or is an agent or managing employee of the provider; and  Has been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the title XX services program since the inception of those programs. § 455.410 – HHSC must require all ordering or referring physicians or other professionals providing services under the State plan or under a waiver of the plan to be enrolled as participating providers. § 455.412 – HHSC must:  Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State.  Confirm that the provider's license has not expired and that there are no current limitations on the provider's license. § 455.414 – HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. § 455.432 – HHSC must:  Conduct pre-enrollment and post-enrollment site visits of providers who are designated as “moderate” or “high” categorical risks to the Medicaid program.  Require any enrolled provider to permit CMS, its agents, its designated contractors, or HHSC to conduct unannounced on-site inspections of any and all provider locations. § 455.434 – HHSC must:  Require providers to consent to criminal background checks including fingerprinting when required to do so under State law or by the level of screening based on risk of fraud, waste or abuse as determined for that category of provider.  Establish categorical risk levels for providers and provider categories who pose an increased financial risk of fraud, waste or abuse to the Medicaid program. o Upon HHSC determining that a provider, or a person with a 5 percent or more direct or indirect ownership interest in the provider, meets HHSC's criteria hereunder for criminal background checks as a “high” risk to the Medicaid program, HHSC will require that each such provider or person submit fingerprints, in a form and manner to be determined by HHSC, within 30 days upon request from CMS or HHSC. § 455.436 – HHSC must confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. Upon enrollment and reenrollment, HHSC must check the Social Security Administration's Death Master File (SSADMF), the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. During the period the provider is enrolled, HHSC must check the LEIE and EPLS no less frequently than monthly. § 455.434 – HHSC must screen all initial applications, including applications for a new practice location, and any applications received in response to a re-enrollment or revalidation of enrollment request based on a categorical risk level of “limited,” “moderate,” or “high.” If a provider could fit within more than one risk level described in this section, the highest level of screening is applicable. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 60 providers for CHIP, which resulted in one exception for the following:  A copy of the completed application was not included in the file.  Enrollment of the provider was not completed within the last 5 years.  Verification of the provider’s license was not included in the file.  Required information on ownership and control was not disclosed.  Supporting documentation was not included in the file indicating the SSADMF database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the NPPES database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the LEIE database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the EPLS database was checked at the time of the most recent enrollment.  Supporting documentation was not included in the file indicating the provider was categorized during screening as limited, moderate, or high risk.  A copy of the provider agreement was not included in the files.  Supporting documentation was not included indicating a pre- or post-enrollment site visit was conducted as required for providers designated as moderate or high risk.  Supporting documentation was not included indicating the provider disclosed the identity of any person who had been convicted of a criminal offense related to that person's involvement in any program under Medicare, Medicaid, or the Title XX services program since the inception of those programs. Questioned costs: None. Context: See “Condition.” Cause: HHSC does not have adequate procedures in place to ensure required documentation is obtained and maintained to comply with federal provider eligibility requirements. Effect: Failure to obtain and maintain adequate documentation during the provider screening and enrollment process may result in otherwise ineligible or fraudulent providers receiving CHIP funds. Repeat Finding: No Recommendation: HHSC should implement controls to ensure:  Documentation is maintained for at least the length of the providers’ current enrollment period or three years, whichever is greater in accordance with 2 CFR 200.334.  Provider licenses are verified during enrollment.  Providers are re-enrolled at least once every five years.  Provider agreements are obtained, and the proper disclosures are made.  Providers are categorized according to risk level and pre- and post-enrollment site visits are conducted as required for those deemed moderate or high risk.  Relevant federal databases are checked during initial enrollment and at least monthly for all providers currently enrolled in CHIP. Views of responsible officials: HHSC concurs with the finding.